Enable AMD SEV-SNP for an EC2 instance - Amazon Elastic Compute Cloud
Allocate a Dedicated Host with AMD SEV-SNPLaunch instances on a AMD SEV-SNP Dedicated HostUpdate firmware on a AMD SEV-SNP Dedicated HostLaunch an instance with AMD SEV-SNP on shared tenancyCheck if an EC2 instance is enabled for AMD SEV-SNP
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Enable AMD SEV-SNP for an EC2 instance

You can launch an instance with AMD SEV-SNP enabled. You can't enable AMD SEV-SNP after launch.

Allocate a Dedicated Host with AMD SEV-SNP

Before you can launch instances with AMD SEV-SNP on a Dedicated Host, you must allocate a Dedicated Host with AMD SEV-SNP support enabled. You allocate a Dedicated Host by instance family (for example, m6a, r6a, or c6a), and then you can run any supported instance type from that family on the host. You can allocate a Dedicated Host with AMD SEV-SNP in any commercial AWS Region.

Console
To allocate a Dedicated Host with AMD SEV-SNP enabled

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Dedicated Hosts.

  3. Choose Allocate Dedicated Host.

  4. For AMD SEV-SNP, choose Enable.

  5. Configure the remaining host settings as needed, and then choose Allocate.

AWS CLI
To allocate a Dedicated Host with AMD SEV-SNP enabled

Use the allocate-hosts command with the --instance-type and --cpu-options parameters.

aws ec2 allocate-hosts \
    --instance-type "m6a.large" \
    --availability-zone "us-east-1a" \
    --auto-placement "off" \
    --cpu-options AmdSevSnp=enabled \
    --quantity 1

The following is example output.

{
    "HostIds": [
        "h-0123456789abcdef0"
    ]
}
Note

When you allocate a Dedicated Host with AMD SEV-SNP enabled, the host enters a configuring state while AWS applies the latest firmware. This can take from a few minutes up to 2 hours. You are charged during the configuring state.

Launch instances on a AMD SEV-SNP Dedicated Host

You can launch an instance with AMD SEV-SNP enabled once the Dedicated Host is configured.

Note

You can also launch instances without AMD SEV-SNP enabled on a Dedicated Host that was allocated with AMD SEV-SNP. Both AMD SEV-SNP and non-AMD SEV-SNP instances can run alongside each other on the same host.

AWS CLI
To launch an instance with AMD SEV-SNP on a Dedicated Host

Use the run-instances command with the --cpu-options and --placement options. Replace h-0123456789abcdef0 with the ID of your allocated Dedicated Host.

aws ec2 run-instances \
    --instance-type m6a.xlarge \
    --image-id ami-0123456789example \
    --cpu-options AmdSevSnp=enabled \
    --placement HostId=h-0123456789abcdef0
PowerShell
To launch an instance with AMD SEV-SNP on a Dedicated Host

Use the New-EC2Instance cmdlet with the -CpuOption and -Placement_HostId parameters.

New-EC2Instance `
    -InstanceType m6a.xlarge `
    -ImageId ami-0123456789example `
    -CpuOption @{AmdSevSnp="enabled"} `
    -Placement_HostId h-0123456789abcdef0

Update firmware on a AMD SEV-SNP Dedicated Host

When you allocate a Dedicated Host with AMD SEV-SNP enabled, AWS applies the latest available firmware to the host. Firmware updates can include security patches and feature improvements from AMD.

To apply firmware updates, allocate a new host (which receives the latest firmware), move your instances to the new host, and then release the old host.

  1. Allocate a new Dedicated Host with AMD SEV-SNP enabled. The new host receives the latest available firmware. For more information, see Allocate a Dedicated Host with AMD SEV-SNP.

  2. Stop the running instances on the old Dedicated Host.

    aws ec2 stop-instances \
    --instance-ids i-0123456789example

  3. Modify the instance placement to target the new Dedicated Host. Use the modify-instance-placement command.

    aws ec2 modify-instance-placement \
    --instance-id i-0123456789example \
    --host-id h-09876543210abcdef

  4. Start the instances on the new Dedicated Host.

    aws ec2 start-instances \
    --instance-ids i-0123456789example

  5. Release the old Dedicated Host. Use the release-hosts command.

    aws ec2 release-hosts \
    --host-ids h-0123456789abcdef0
Note

You receive maintenance notifications for your Dedicated Hosts the same way you receive them for other Dedicated Host maintenance events. When you receive a notification, follow the preceding steps to move to a new host with updated firmware.

Launch an instance with AMD SEV-SNP on shared tenancy

You can launch an instance with AMD SEV-SNP on shared tenancy in US East (Ohio) and Europe (Ireland).

AWS CLI
To launch an instance with AMD SEV-SNP on shared tenancy

Use the run-instances command with the --cpu-options option.

aws ec2 run-instances \
    --instance-type m6a.xlarge \
    --image-id ami-0123456789example \
    --cpu-options AmdSevSnp=enabled
PowerShell
To launch an instance with AMD SEV-SNP on shared tenancy

Use the New-EC2Instance cmdlet with the -CpuOption parameter.

New-EC2Instance `
    -InstanceType m6a.xlarge `
    -ImageId ami-0123456789example `
    -CpuOption @{AmdSevSnp="enabled"}

Check if an EC2 instance is enabled for AMD SEV-SNP

You can find instances that are enabled for AMD SEV-SNP. The Amazon EC2 console does not display this information.

AWS CLI
To check whether AMD SEV-SNP is enabled for an instance

Use the describe-instances command.

aws ec2 describe-instances \
    --instance-ids i-1234567890abcdef0 \
    --query Reservations[].Instances[].CpuOptions

The following is example output. If AmdSevSnp is not present in CpuOptions, then AMD SEV-SNP is disabled.

[
    {
        "AmdSevSnp": "enabled",
        "CoreCount": 1,
        "ThreadsPerCore": 2
    }
]
PowerShell
To check whether AMD SEV-SNP is enabled for an instance

Use the Get-EC2Instance cmdlet.

(Get-EC2Instance `
    -InstanceId i-1234567890abcdef0).Instances.CpuOptions

The following is example output. If the value of AmdSevSnp is not present, then AMD SEV-SNP is disabled.

AmdSevSnp CoreCount ThreadsPerCore
--------- --------- --------------
enabled   1         2
AWS CloudTrail

In the AWS CloudTrail event for the instance launch request, the following property indicates that AMD SEV-SNP is enabled for the instance.

"cpuOptions": {"AmdSevSnp": "enabled"}