AWS AWSEC2 medium security documentation change

Service: AWSEC2 · 2025-05-01 · Security-related medium

File: AWSEC2/latest/UserGuide/snp-work-launch.md

Summary

Expanded documentation for launching EC2 instances with AMD SEV-SNP, added verification methods (CLI/PowerShell/CloudTrail), and restructured content

Security assessment

AMD SEV-SNP is a hardware-based memory encryption technology that protects against VM memory access/exfiltration. The changes document how to enable and verify this security feature, which directly relates to securing EC2 workloads. The addition of verification methods strengthens security posture by ensuring proper configuration.

Diff

diff --git a/AWSEC2/latest/UserGuide/snp-work-launch.md b/AWSEC2/latest/UserGuide/snp-work-launch.md
index 513df526d..296a74d8b 100644
--- a//AWSEC2/latest/UserGuide/snp-work-launch.md
+++ b//AWSEC2/latest/UserGuide/snp-work-launch.md
@@ -5 +5 @@
-# Enable AMD SEV-SNP for an Amazon EC2 instance
+Launch an instance with AMD SEV-SNP enabledCheck if an EC2 instance is enabled for AMD SEV-SNP
@@ -7 +7 @@
-You can use the AWS CLI to launch an instance with AMD SEV-SNP enabled. You can't enable AMD SEV-SNP after launch.
+# Enable AMD SEV-SNP for an EC2 instance
@@ -9 +9,12 @@ You can use the AWS CLI to launch an instance with AMD SEV-SNP enabled. You can'
-To launch an instance with AMD SEV-SNP enabled, you must use the AWS CLI. Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command and include the `--cpu-options AmdSevSnp=enabled` option. For `--image-id`, specify an AMI with the `uefi` or `uefi-prefered` boot mode and an operating system that supports AMD SEV-SNP. For `--instance-type`, specify a [supported instance type](./snp-work.html).
+You can launch an instance with AMD SEV-SNP enabled. You can't enable AMD SEV-SNP after launch.
+
+## Launch an instance with AMD SEV-SNP enabled
+
+You can't enable AMD SEV-SNP using the Amazon EC2 console.
+
+AWS CLI
+    
+
+###### To launch an instance with AMD SEV-SNP enabled
+
+Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command with the `--cpu-options` option. For additional requirements, see [AMD SEV-SNP requirements](./sev-snp.html#snp-requirements).
@@ -12,5 +22,0 @@ To launch an instance with AMD SEV-SNP enabled, you must use the AWS CLI. Use th
-    $ aws ec2 run-instances \
-    --image-id supported_ami_id \
-    --instance-type supported_instance_type \
-    --key-name key_pair_name \
-    --subnet-id subnet_id \
@@ -18,0 +25,63 @@ To launch an instance with AMD SEV-SNP enabled, you must use the AWS CLI. Use th
+PowerShell
+    
+
+###### To launch an instance with AMD SEV-SNP enabled
+
+Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet with the `-CpuOption` parameter.
+    
+    
+    -CpuOption @{AmdSevSnp="enabled"}
+
+## Check if an EC2 instance is enabled for AMD SEV-SNP
+
+You can find instances that are enabled for AMD SEV-SNP. The Amazon EC2 console does not display this information.
+
+AWS CLI
+    
+
+###### To check whether AMD SEV-SNP is enabled for an instance
+
+Use the [describe-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html) command.
+    
+    
+    aws ec2 describe-instances \
+        --instance-ids i-1234567890abcdef0 \
+        --query Reservations[].Instances[].CpuOptions
+
+The following is example output. If `AmdSevSnp` is not present in `CpuOptions`, then AMD SEV-SNP is disabled.
+    
+    
+    [
+        {
+            "AmdSevSnp": "enabled",
+            "CoreCount": 1,
+            "ThreadsPerCore": 2
+        }
+    ]
+
+PowerShell
+    
+
+###### To find the instance types that support AMD SEV-SNP
+
+Use the [Get-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html) cmdlet.
+    
+    
+    (Get-EC2Instance `
+        -InstanceId i-1234567890abcdef0).Instances.CpuOptions
+
+The following is example output. If the value of `AmdSevSnp` is not present, then AMD SEV-SNP is disabled.
+    
+    
+    AmdSevSnp CoreCount ThreadsPerCore
+    --------- --------- --------------
+    enabled   1         2
+
+AWS CloudTrail
+    
+
+In the AWS CloudTrail event for the instance launch request, the following property indicates that AMD SEV-SNP is enabled for the instance.
+    
+    
+    "cpuOptions": {"AmdSevSnp": "enabled"}
+
@@ -25 +94 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Check supported instance types
+Find supported instance types