AWS AWSEC2 documentation change
Summary
Expanded AMD SEV-SNP documentation to include Dedicated Host support, differentiated requirements/considerations between Dedicated Hosts and shared tenancy, updated attestation signing mechanisms (VCEK for Dedicated Hosts/VLEK for shared), and revised pricing structure.
Security assessment
The changes enhance documentation for AMD SEV-SNP (a security feature providing memory encryption and attestation) but show no evidence of addressing a specific vulnerability. Updates clarify deployment models and technical details without referencing security incidents.
Diff
diff --git a/AWSEC2/latest/UserGuide/sev-snp.md b/AWSEC2/latest/UserGuide/sev-snp.md index 4ccafa059..d71a995e5 100644 --- a//AWSEC2/latest/UserGuide/sev-snp.md +++ b//AWSEC2/latest/UserGuide/sev-snp.md @@ -13 +13 @@ AMD Secure Encrypted Virtualization-Secure Nested Paging (AMD SEV-SNP) is a CPU - * **Attestation** – AMD SEV-SNP enables you to retrieve a signed attestation report that contains a cryptographic measure that can be used to validate the instance’s state and identity, and that it is running on genuine AMD hardware. For more information, see [Attest an Amazon EC2 instance with AMD SEV-SNP](./snp-attestation.html). + * **Attestation** – AMD SEV-SNP enables you to retrieve a signed attestation report that contains a cryptographic measure that can be used to validate the instance's state and identity, and that it is running on genuine AMD hardware. For more information, see [Attest an Amazon EC2 instance with AMD SEV-SNP](./snp-attestation.html). @@ -15 +15 @@ AMD Secure Encrypted Virtualization-Secure Nested Paging (AMD SEV-SNP) is a CPU - * **Memory encryption** – Starting with AMD EPYC (Milan), AWS Graviton2, and Intel Xeon Scalable (Ice Lake) processors, instance memory is always encrypted. Instances that are enabled for AMD SEV-SNP use an instance-specific key for their memory encryption. + * **Memory encryption** – Starting with AMD EPYC (Milan), AWS Graviton2, and Intel Xeon Scalable (Ice Lake) processors, instance memory is always encrypted. @@ -19,0 +20,2 @@ AMD Secure Encrypted Virtualization-Secure Nested Paging (AMD SEV-SNP) is a CPU +You can use AMD SEV-SNP with Dedicated Hosts or with shared tenancy. + @@ -45 +47,5 @@ Before you begin using AMD SEV-SNP, ensure that you are familiar with the follow -The AMD SEV-SNP attestation report is a document that an instance can request from the CPU. The AMD SEV-SNP attestation report can be used to validate the state and identity of an instance, and to verify that it is running in a sanctioned AMD environment. The report includes a launch measurement, which is a cryptographic hash of the initial boot state of an instance, including its initial instance memory contents and initial state of the vCPUs. The AMD SEV-SNP attestation report is signed with a VLEK signature that chains back to an AMD root of trust. +The AMD SEV-SNP attestation report is a document that an instance can request from the CPU. The AMD SEV-SNP attestation report can be used to validate the state and identity of an instance, and to verify that it is running in a sanctioned AMD environment. The report includes a launch measurement, which is a cryptographic hash of the initial boot state of an instance, including its initial instance memory contents and initial state of the vCPUs. The AMD SEV-SNP attestation report is signed with either a VCEK signature (on Dedicated Hosts) or a VLEK signature (on shared tenancy) that chains back to an AMD root of trust. + +###### VCEK + +The Versioned Chip Endorsement Key (VCEK) is a per-chip signing key that is certified by AMD and used by the AMD CPU to sign the AMD SEV-SNP attestation reports on Dedicated Hosts. VCEK signatures can be validated using certificates provided by AMD. @@ -49 +55 @@ The AMD SEV-SNP attestation report is a document that an instance can request fr -The Versioned Loaded Endorsement Key (VLEK) is a versioned signing key that is certified by AMD and used by the AMD CPU to sign the AMD SEV-SNP attestation reports. VLEK signatures can be validated using certificates provided by AMD. +The Versioned Loaded Endorsement Key (VLEK) is a versioned signing key that is certified by AMD and used by the AMD CPU to sign the AMD SEV-SNP attestation reports on shared tenancy. VLEK signatures can be validated using certificates provided by AMD. @@ -57 +63,5 @@ The Open Virtual Machine Firmware (OVMF) is the early-boot code that is used to -To use AMD SEV-SNP, you must do the following: +The requirements for AMD SEV-SNP depend on whether you use Dedicated Hosts or shared tenancy. + +###### Requirements for Dedicated Hosts + +To use AMD SEV-SNP with Dedicated Hosts, you must meet the following requirements: @@ -67 +77,7 @@ To use AMD SEV-SNP, you must do the following: - * Launch your instance in a supported AWS Region. Currently, only US East (Ohio) and Europe (Ireland) are supported. + * Allocate a Dedicated Host with AMD SEV-SNP enabled. For more information, see [Allocate a Dedicated Host with AMD SEV-SNP](./snp-work-launch.html#snp-allocate-dh). + + * Launch your instance in any commercial AWS Region. + + * Use an AMI with `uefi` or `uefi-preferred` boot mode and an operating system that supports AMD SEV-SNP. For AWS, AMD SEV-SNP is supported on AL2023, RHEL 9.3, SLES 15 SP4, and Ubuntu 23.04 and later. + + @@ -69 +85,16 @@ To use AMD SEV-SNP, you must do the following: - * Use an AMI with `uefi` or `uefi-preferred` boot mode and an operating system that supports AMD SEV-SNP. For more information about AMD SEV-SNP support on your operating system, refer to the respective operating system's documentation. For AWS, AMD SEV-SNP is supported on AL2023, RHEL 9.3, SLES 15 SP4, and Ubuntu 23.04 and later. + +###### Requirements for shared tenancy + +To use AMD SEV-SNP with shared tenancy, you must meet the following requirements: + + * Use one of the following supported instance types: + + * **General purpose** : `m6a.large` | `m6a.xlarge` | `m6a.2xlarge` | `m6a.4xlarge` | `m6a.8xlarge` + + * **Compute optimized** : `c6a.large` | `c6a.xlarge` | `c6a.2xlarge` | `c6a.4xlarge` | `c6a.8xlarge` | `c6a.12xlarge` | `c6a.16xlarge` + + * **Memory optimized** : `r6a.large` | `r6a.xlarge` | `r6a.2xlarge` | `r6a.4xlarge` + + * Launch your instance in a supported AWS Region: US East (Ohio) or Europe (Ireland). + + * Use an AMI with `uefi` or `uefi-preferred` boot mode and an operating system that supports AMD SEV-SNP. For AWS, AMD SEV-SNP is supported on AL2023, RHEL 9.3, SLES 15 SP4, and Ubuntu 23.04 and later. @@ -84 +115,19 @@ You can only enable AMD SEV-SNP when you launch an instance. When AMD SEV-SNP is - * Dedicated Hosts aren't supported. + + + +###### Additional considerations for Dedicated Hosts + +The following additional considerations apply when you use AMD SEV-SNP with Dedicated Hosts: + + * Firmware updates are applied when you allocate a host. To get the latest firmware, release the existing host and allocate a new one. For more information, see [Update firmware on a AMD SEV-SNP Dedicated Host](./snp-work-launch.html#snp-firmware). + + * You can launch instances with or without AMD SEV-SNP enabled on a Dedicated Host that has AMD SEV-SNP support. + + * Host Resource Groups and Dedicated Host Reservations are supported. + + + + +###### Additional considerations for shared tenancy + +The following additional considerations apply when you use AMD SEV-SNP with shared tenancy: @@ -93 +142,5 @@ You can only enable AMD SEV-SNP when you launch an instance. When AMD SEV-SNP is -When you launch an Amazon EC2 instance with AMD SEV-SNP enabled, you are charged an additional hourly usage fee that is equivalent to 10 percent of the [On-Demand hourly rate](https://aws.amazon.com/ec2/pricing/on-demand/) of the selected instance type. +###### Dedicated Hosts + +There is no additional charge for using AMD SEV-SNP on Dedicated Hosts. You pay only the standard Dedicated Host pricing. For more information, see [Dedicated Host pricing](https://aws.amazon.com/ec2/dedicated-hosts/pricing/). + +###### Shared tenancy @@ -95 +148 @@ When you launch an Amazon EC2 instance with AMD SEV-SNP enabled, you are charged -This AMD SEV-SNP usage fee is a separate charge to your Amazon EC2 instance usage. Reserved Instances, Savings Plans, and operating system usage don't impact this fee. +When you launch an Amazon EC2 instance with AMD SEV-SNP enabled on shared tenancy, you are charged an additional hourly usage fee that is equivalent to 10 percent of the [On-Demand hourly rate](https://aws.amazon.com/ec2/pricing/on-demand/) of the selected instance type. This AMD SEV-SNP usage fee is a separate charge to your Amazon EC2 instance usage. Reserved Instances, Savings Plans, and operating system usage don't impact this fee. @@ -97 +150 @@ This AMD SEV-SNP usage fee is a separate charge to your Amazon EC2 instance usag -If you configure a Spot Instance to launch with [AMD SEV-SNP](./sev-snp.html) enabled, you are charged an additional hourly usage fee that is equivalent to 10 percent of the [On-Demand hourly rate](https://aws.amazon.com/ec2/pricing/on-demand/) of the selected instance type. If the allocation strategy uses price as an input, Spot Fleet does not include this additional fee; only the Spot price is used. +If you configure a Spot Instance to launch with AMD SEV-SNP enabled on shared tenancy, you are charged an additional hourly usage fee that is equivalent to 10 percent of the [On-Demand hourly rate](https://aws.amazon.com/ec2/pricing/on-demand/) of the selected instance type. If the allocation strategy uses price as an input, Spot Fleet does not include this additional fee; only the Spot price is used.