Create a Confidential VM instance

Console

To create an AMD SEV Confidential VM with the Google Cloud console, complete the following steps.

1. In the Google Cloud console, go to the VM instances page.

   Go to VM instances

2. Click Create instance.

3. In the Confidential VM service section, click Enable.

4. In the Enable Confidential Computing dialog, review the list of settings that are updated when you enable the service. They can include the following fields, if they were set to incompatible values.

   • Series and Machine type. For more information, see Machine types, CPUs, and zones.

   • Region and zone. For more information, see Machine types, CPUs, and zones.

   • Boot disk image. For more information, see Operating systems.

   • On-host maintenance. For more information, see Set host maintenance policy of a VM.

   • Network interface card. For more information, see Using Google Virtual NIC.

5. Click Enable.

6. In the Machine configuration section, expand Advanced configurations.

7. For the CPU platform, choose AMD Milan or later.

8. Verify that you are satisfied with these settings, and then click Create.

After you click Create, the VM instances page opens. On this page you can view the status and details for your new instance. When an Available icon appears in the Status column for your Confidential VM instance, it's ready to use.

gcloud

To create a Confidential VM instance with the gcloud CLI, use the instances create sub-command with the --confidential-compute-type flag.

gcloud compute instances create INSTANCE_NAME \
    --confidential-compute-type=CONFIDENTIAL_COMPUTING_TECHNOLOGY \
    --machine-type=MACHINE_TYPE_NAME \
    --min-cpu-platform="CPU_PLATFORM" \
    --maintenance-policy="MAINTENANCE_POLICY" \
    --zone=ZONE_NAME \
    --image-family=IMAGE_FAMILY_NAME \
    --image-project=IMAGE_PROJECT \
    --project=PROJECT_ID

Provide the following values:

• INSTANCE_NAME: The name of the new VM instance.

• CONFIDENTIAL_COMPUTING_TECHNOLOGY: The type of Confidential Computing technology to use. Choose one of the following values:

  • SEV

  • SEV_SNP

  • TDX

• MACHINE_TYPE_NAME: The VM machine type, for example, n2d-standard-2. Valid machine types for Confidential VM instances are determined by the Confidential Computing technology you've chosen. See Machine types, CPUs, and zones.

• CPU_PLATFORM: Choose one of the following values:

  • For AMD SEV: Either AMD Milan (C2D or N2D machine types) or AMD Genoa (C3D machine types).

  • For AMD SEV-SNP: AMD Milan (N2D machine types).

  • For Intel TDX: Remove this flag.

• MAINTENANCE_POLICY: For N2D machine types that use SEV, set this to MIGRATE for live migration support. For all other machine types, set this value to TERMINATE, as they don't support live migration.

• ZONE_NAME: The Confidential VM-supported zone in which to create the instance.

• IMAGE_FAMILY_NAME: The family for the Confidential VM-supported operating system image. When you don't additionally specify --image, the latest image version is selected.

• IMAGE_PROJECT: The project containing the supported operating system image.

• PROJECT_ID: Optional. The ID of the project to create the VM in.

Example

Run the following command to create an n2d-standard-2 instance called my-instance in the us-central1-a zone, using AMD SEV-SNP:

gcloud compute instances create my-instance \
    --machine-type=n2d-standard-2 \
    --min-cpu-platform="AMD Milan" \
    --zone=us-central1-a \
    --confidential-compute-type=SEV_SNP \
    --maintenance-policy=TERMINATE \
    --image-family=ubuntu-2404-lts-amd64 \
    --image-project=ubuntu-os-cloud

Response

A response to a creation request looks similar to the following example:

Created [https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/my-instance].
NAME: my-instance
ZONE: us-central1-a
MACHINE_TYPE: n2d-standard-2
PREEMPTIBLE:
INTERNAL_IP: 0.0.0.0
EXTERNAL_IP: 0.0.0.0
STATUS: RUNNING

REST

To create a Confidential VM instance, you need to send a POST request with the appropriate body content.

The HTTP method and URL:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE_NAME/instances

Request JSON body:

{
  "name": "INSTANCE_NAME",
  "confidentialInstanceConfig": {
    "confidentialInstanceType": "CONFIDENTIAL_COMPUTING_TECHNOLOGY"
  },
  "machineType": "zones/ZONE_NAME/machineTypes/MACHINE_TYPE_NAME",
  "minCpuPlatform": "CPU_PLATFORM",
  "disks": [
    {
      "boot": true,
      "initializeParams": {
        "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY_NAME"
      }
    }
  ],
  "networkInterfaces": [
    {
      "nicType": "gVNIC"
    }
  ],
  "scheduling": {
    "automaticRestart": true,
    "nodeAffinities": [],
    "preemptible": false,
    "onHostMaintenance": MAINTENANCE_POLICY
  }
}

Provide the following values:

• PROJECT_ID: The ID of the project to create the VM in.

• ZONE_NAME: The Confidential VM-supported zone in which to create the instance.

• INSTANCE_NAME: The name of the new VM instance.

• CONFIDENTIAL_COMPUTING_TECHNOLOGY: The type of Confidential Computing technology to use. Choose one of the following values:

  • SEV

  • SEV_SNP

  • TDX

• MACHINE_TYPE_NAME: The VM machine type, for example, n2d-standard-2. Valid machine types for Confidential VM instances are determined by the Confidential Computing technology you've chosen. See Machine types, CPUs, and zones.

• CPU_PLATFORM: Choose one of the following values:

  • For AMD SEV: Either AMD Milan (C2D or N2D machine types) or AMD Genoa (C3D machine types).

  • For AMD SEV-SNP: AMD Milan (N2D machine types).

  • For Intel TDX: Remove this key-value pair.

• IMAGE_PROJECT: The project containing the supported operating system image.

• IMAGE_FAMILY_NAME: The family for the Confidential VM-supported operating system image. When you don't additionally specify --image, the latest image version is selected.

• MAINTENANCE_POLICY: For N2D machine types that use SEV, set this to MIGRATE for live migration support. For all other machine types, set this value to TERMINATE, as they don't support live migration.

Example

Run one of the following commands to create an n2d-standard-2 instance called my-instance in the us-central1-a zone, in the my-project project, using AMD SEV-SNP:

curl -X POST \
      -H "Authorization: Bearer $(gcloud auth print-access-token)" \
      -H "Content-Type: application/json" \
      -d '{
            "machineType": "zones/us-central1-a/machineTypes/n2d-standard-2",
            "name": "my-instance",
            "minCpuPlatform": "AMD Milan",
            "confidentialInstanceConfig": {
              "confidentialInstanceType": "SEV_SNP"
            },
            "disks": [
              {
                "boot": true,
                "initializeParams": {
                  "sourceImage": "projects/ubuntu-os-cloud/global/images/family/ubuntu-2404-lts-amd64"
                }
              }
            ],
            "networkInterfaces": [
              {
                "nicType": "gVNIC"
              }
            ],
            "scheduling": {
              "automaticRestart": true,
              "nodeAffinities": [],
              "preemptible": false,
              "onHostMaintenance": "TERMINATE"
            }
          }' \
      https://compute.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
$body = @"
{
  "machineType": "zones/us-central1-a/machineTypes/n2d-standard-2",
  "name": "my-instance",
  "minCpuPlatform": "AMD Milan",
  "confidentialInstanceConfig": {
    "confidentialInstanceType": "SEV_SNP"
  },
  "disks": [
    {
      "boot": true,
      "initializeParams": {
        "sourceImage": "projects/ubuntu-os-cloud/global/images/family/ubuntu-2404-lts-amd64"
      }
    }
  ],
  "networkInterfaces": [
    {
      "nicType": "gVNIC"
    }
  ],
  "scheduling": {
    "automaticRestart": true,
    "nodeAffinities": [],
    "preemptible": false,
    "onHostMaintenance": "TERMINATE"
  }
}
"@
Invoke-WebRequest `
  -Method POST `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body $body `
  -Uri "https://compute.googleapis.com/compute/projects/my-project/zones/us-central1-a/instances" | Select-Object -Expand Content

Response

A response to a creation request looks similar to the following example:

{
  "kind": "compute#operation",
  "id": "0000000000000000000",
  "name": "operation-0000000000000-0000000000000-00000000-00000000",
  "zone": "https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a",
  "operationType": "insert",
  "targetLink": "https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/my-instance",
  "targetId": "0000000000000000000",
  "status": "RUNNING",
  "user": "[email protected]",
  "progress": 0,
  "insertTime": "2024-09-29T18:06:52.174-07:00",
  "startTime": "2024-09-29T18:06:52.175-07:00",
  "selfLink": "https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/operations/operation-0000000000000-0000000000000-00000000-00000000"
}

You can check the VM creation progress by making a GET request to the selfLink:

GET https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE_NAME/operations/OPERATION_ID