Enable confidential computing¶
Ubuntu images on Oracle Cloud Infrastructure support confidential computing on AMD EPYC™ processors. Confidential computing encrypts and isolates in-use data and the applications processing that data, preventing unauthorized access or modification.
Oracle Cloud offers two confidential computing technologies:
AMD SEV (Secure Encrypted Virtualization) — used on virtual machine (VM) shapes. SEV isolates VM guests from the hypervisor through encrypted memory with a unique key per VM.
AMD TSME (Transparent Secure Memory Encryption) — used on bare metal shapes. TSME encrypts all system memory transparently without requiring application changes.
See AMD documentation for more information about these technologies.
Supported shapes¶
The following shapes support confidential computing on Oracle Cloud:
Shape |
Type |
Technology |
Processor |
|---|---|---|---|
VM.Standard.E3.Flex |
VM |
AMD SEV |
AMD EPYC Gen 2 |
VM.Standard.E4.Flex |
VM |
AMD SEV |
AMD EPYC Gen 3 |
BM.Standard.E3.128 |
Bare Metal |
AMD TSME |
AMD EPYC Gen 2 |
BM.Standard.E4.128 |
Bare Metal |
AMD TSME |
AMD EPYC Gen 3 |
BM.DenseIO.E4.128 |
Bare Metal |
AMD TSME |
AMD EPYC Gen 3 |
BM.Standard.E5.192 |
Bare Metal |
AMD TSME |
AMD EPYC Gen 4 |
BM.DenseIO.E5.128 |
Bare Metal |
AMD TSME |
AMD EPYC Gen 4 |
For the latest list, refer to Shapes that support confidential computing.
Supported regions¶
Confidential computing is available in the following Oracle Cloud regions:
Germany Central (Frankfurt)
India South (Hyderabad)
India West (Mumbai)
Switzerland North (Zurich)
UK Gov West (Newport)
UK South (London)
US East (Ashburn)
US West (Phoenix)
For the latest region availability, refer to Oracle CC documentation.
Limitations¶
After enabling confidential computing on an instance, you cannot change its shape.
The following features are not available with confidential computing:
Preemptible capacity
Capacity reservation
Shielded instances
Prerequisites¶
You’ll need:
A compartment to create the instance in
(Optional) A Virtual Cloud Network (VCN) to create the instance in. If you don’t have one already, you can create a new VCN when you create the instance
A region that supports confidential computing (see Supported regions above)
A shape that supports confidential computing (see Supported shapes above)
Create a VM instance with confidential computing¶
While creating a new instance using Compute > Instances > Create instance, under Image and shape select Change image > Ubuntu. Then choose the desired Ubuntu release and image build that is marked to support the security feature Confidential computing.
Example Ubuntu 24.04 LTS images that support confidential computing:
Additionally, under Image and shape, select Change shape and select a shape that is marked to support Confidential computing. If there are no shapes listed that support confidential computing, verify that the region selected has support for confidential computing (refer to Supported regions above).
For example, the VM.Standard.E4.Flex shape supports confidential computing in the US West (Phoenix) region:
Finally, under Security enable Confidential computing.
Create a bare metal instance with confidential computing¶
Bare metal instances use AMD TSME, which encrypts all system memory transparently. To create a bare metal instance with confidential computing:
Navigate to Compute > Instances > Create instance.
Under Image and shape, select Change image > Ubuntu and choose the desired Ubuntu release.
Select Change shape, choose Bare metal machine, and select one of the supported bare metal shapes (e.g., BM.Standard.E5.192).
Under Security, enable Confidential computing.
Complete the remaining instance configuration and launch the instance.
Further references¶
For more information about creating confidential computing enabled instances, refer to the Oracle Cloud documentation:
For a general overview of confidential computing technologies, see Confidential computing.