AWS AWSEC2 documentation change
Summary
Expanded AMD SEV-SNP documentation to include Dedicated Host allocation, instance launching on dedicated hosts, firmware updates, and shared tenancy launch procedures. Added detailed CLI/PowerShell examples and operational guidance.
Security assessment
The changes document AMD SEV-SNP (a hardware-based memory encryption security feature) implementation procedures. While this adds security feature documentation, there's no evidence of addressing a specific vulnerability or incident. The firmware update section mentions security patches but doesn't reference any CVE or specific threat.
Diff
diff --git a/AWSEC2/latest/UserGuide/snp-work-launch.md b/AWSEC2/latest/UserGuide/snp-work-launch.md index aef4f17f8..930f1c45b 100644 --- a//AWSEC2/latest/UserGuide/snp-work-launch.md +++ b//AWSEC2/latest/UserGuide/snp-work-launch.md @@ -7 +7 @@ -Launch an instance with AMD SEV-SNP enabledCheck if an EC2 instance is enabled for AMD SEV-SNP +Allocate a Dedicated Host with AMD SEV-SNPLaunch instances on a AMD SEV-SNP Dedicated HostUpdate firmware on a AMD SEV-SNP Dedicated HostLaunch an instance with AMD SEV-SNP on shared tenancyCheck if an EC2 instance is enabled for AMD SEV-SNP @@ -13 +13 @@ You can launch an instance with AMD SEV-SNP enabled. You can't enable AMD SEV-SN -## Launch an instance with AMD SEV-SNP enabled +###### Contents @@ -15 +15,138 @@ You can launch an instance with AMD SEV-SNP enabled. You can't enable AMD SEV-SN -You can't enable AMD SEV-SNP using the Amazon EC2 console. + * Allocate a Dedicated Host with AMD SEV-SNP + + * Launch instances on a AMD SEV-SNP Dedicated Host + + * Update firmware on a AMD SEV-SNP Dedicated Host + + * Launch an instance with AMD SEV-SNP on shared tenancy + + * Check if an EC2 instance is enabled for AMD SEV-SNP + + + + +## Allocate a Dedicated Host with AMD SEV-SNP + +Before you can launch instances with AMD SEV-SNP on a Dedicated Host, you must allocate a Dedicated Host with AMD SEV-SNP support enabled. You allocate a Dedicated Host by instance family (for example, m6a, r6a, or c6a), and then you can run any supported instance type from that family on the host. You can allocate a Dedicated Host with AMD SEV-SNP in any commercial AWS Region. + +Console + + +###### To allocate a Dedicated Host with AMD SEV-SNP enabled + + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + + 2. In the navigation pane, choose **Dedicated Hosts**. + + 3. Choose **Allocate Dedicated Host**. + + 4. For **AMD SEV-SNP** , choose **Enable**. + + 5. Configure the remaining host settings as needed, and then choose **Allocate**. + + + + +AWS CLI + + +###### To allocate a Dedicated Host with AMD SEV-SNP enabled + +Use the [allocate-hosts](https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-hosts.html) command with the `--instance-type` and `--cpu-options` parameters. + + + aws ec2 allocate-hosts \ + --instance-type "m6a.large" \ + --availability-zone "us-east-1a" \ + --auto-placement "off" \ + --cpu-options AmdSevSnp=enabled \ + --quantity 1 + +The following is example output. + + + { + "HostIds": [ + "h-0123456789abcdef0" + ] + } + +###### Note + +When you allocate a Dedicated Host with AMD SEV-SNP enabled, the host enters a `configuring` state while AWS applies the latest firmware. This can take from a few minutes up to 2 hours. You are charged during the `configuring` state. + +## Launch instances on a AMD SEV-SNP Dedicated Host + +You can launch an instance with AMD SEV-SNP enabled once the Dedicated Host is configured. + +###### Note + +You can also launch instances without AMD SEV-SNP enabled on a Dedicated Host that was allocated with AMD SEV-SNP. Both AMD SEV-SNP and non-AMD SEV-SNP instances can run alongside each other on the same host. + +AWS CLI + + +###### To launch an instance with AMD SEV-SNP on a Dedicated Host + +Use the [run-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html) command with the `--cpu-options` and `--placement` options. Replace `h-0123456789abcdef0` with the ID of your allocated Dedicated Host. + + + aws ec2 run-instances \ + --instance-type m6a.xlarge \ + --image-id ami-0123456789example \ + --cpu-options AmdSevSnp=enabled \ + --placement HostId=h-0123456789abcdef0 + +PowerShell + + +###### To launch an instance with AMD SEV-SNP on a Dedicated Host + +Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet with the `-CpuOption` and `-Placement_HostId` parameters. + + + New-EC2Instance ` + -InstanceType m6a.xlarge ` + -ImageId ami-0123456789example ` + -CpuOption @{AmdSevSnp="enabled"} ` + -Placement_HostId h-0123456789abcdef0 + +## Update firmware on a AMD SEV-SNP Dedicated Host + +When you allocate a Dedicated Host with AMD SEV-SNP enabled, AWS applies the latest available firmware to the host. Firmware updates can include security patches and feature improvements from AMD. + +To apply firmware updates, allocate a new host (which receives the latest firmware), move your instances to the new host, and then release the old host. + + 1. Allocate a new Dedicated Host with AMD SEV-SNP enabled. The new host receives the latest available firmware. For more information, see Allocate a Dedicated Host with AMD SEV-SNP. + + 2. Stop the running instances on the old Dedicated Host. + + aws ec2 stop-instances \ + --instance-ids i-0123456789example + + 3. Modify the instance placement to target the new Dedicated Host. Use the [modify-instance-placement](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-placement.html) command. + + aws ec2 modify-instance-placement \ + --instance-id i-0123456789example \ + --host-id h-09876543210abcdef + + 4. Start the instances on the new Dedicated Host. + + aws ec2 start-instances \ + --instance-ids i-0123456789example + + 5. Release the old Dedicated Host. Use the [release-hosts](https://docs.aws.amazon.com/cli/latest/reference/ec2/release-hosts.html) command. + + aws ec2 release-hosts \ + --host-ids h-0123456789abcdef0 + + + + +###### Note + +You receive maintenance notifications for your Dedicated Hosts the same way you receive them for other Dedicated Host maintenance events. When you receive a notification, follow the preceding steps to move to a new host with updated firmware. + +## Launch an instance with AMD SEV-SNP on shared tenancy + +You can launch an instance with AMD SEV-SNP on shared tenancy in US East (Ohio) and Europe (Ireland). @@ -20 +157 @@ AWS CLI -###### To launch an instance with AMD SEV-SNP enabled +###### To launch an instance with AMD SEV-SNP on shared tenancy @@ -22 +159 @@ AWS CLI -Use the [run-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html) command with the `--cpu-options` option. For additional requirements, see [AMD SEV-SNP requirements](./sev-snp.html#snp-requirements). +Use the [run-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html) command with the `--cpu-options` option. @@ -24,0 +162,3 @@ Use the [run-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/run + aws ec2 run-instances \ + --instance-type m6a.xlarge \ + --image-id ami-0123456789example \ @@ -30 +170 @@ PowerShell -###### To launch an instance with AMD SEV-SNP enabled +###### To launch an instance with AMD SEV-SNP on shared tenancy @@ -34,0 +175,3 @@ Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/referenc + New-EC2Instance ` + -InstanceType m6a.xlarge ` + -ImageId ami-0123456789example `