You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1.**How can you start deploying DCsv2 series VMs?**
21
+
**How can I deploy DCsv2 series VMs on Azure?**
22
22
23
-
Here are some ways you can deploy a DCsv2 VM:
23
+
Here are some ways you can deploy a DCsv2 VM:
24
24
- Using an [Azure Resource Manager Template](../virtual-machines/windows/template-description.md)
25
25
- From the [Azure portal](https://portal.azure.com/#create/hub)
26
-
- In the [Azure confidential compute (Virtual Machine)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.acc-virtual-machine-v2?tab=overview) marketplace solution template. The marketplace solution template will help constrain a customer to the supported scenarios (regions, images, availability, disk encryption).
26
+
- In the [Azure Confidential Computing (Virtual Machine)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.acc-virtual-machine-v2?tab=overview) marketplace solution template. The marketplace solution template will help constrain a customer to the supported scenarios (regions, images, availability, disk encryption).
27
27
28
-
1.**Will all OS images work with Azure confidential computing?**
28
+
**Will all OS images work with Azure confidential computing?**
29
29
30
-
No. The virtual machines can only be deployed on Generation 2 virtual machines. We offer Generation 2 support for Ubuntu Server 18.04, Ubuntu Server 16.04, and Windows Server 2016 Datacenter. Read more about Gen 2 VMs on [Linux](../virtual-machines/linux/generation-2.md) and [Windows](../virtual-machines/windows/generation-2.md)
30
+
No. The virtual machines can only be deployed on Generation 2 operating machines with Ubuntu Server 18.04, Ubuntu Server 16.04, Windows Server 2019 Datacenter, and Windows Server 2016 Datacenter. Read more about Gen 2 VMs on [Linux](../virtual-machines/linux/generation-2.md) and [Windows](../virtual-machines/windows/generation-2.md)
31
31
32
-
1.**DCsv2 virtual machines are grayed out in the portal and I can't select one**
32
+
**DCsv2 virtual machines are grayed out in the portal and I can't select one**
33
33
34
-
Based on the information bubble next to the VM, there are different actions to take:
35
-
-**UnsupportedGeneration**: Change the generation of the virtual machine image to “Gen2”.
36
-
-**NotAvailableForSubscription**: The region isn't yet available for your subscription. Select an available region.
37
-
-**InsufficientQuota**: [Create a support request to increase your quota](../azure-portal/supportability/per-vm-quota-requests.md). Free trial subscriptions don't have quota for confidential computing VMs.
34
+
Based on the information bubble next to the VM, there are different actions to take:
35
+
-**UnsupportedGeneration**: Change the generation of the virtual machine image to “Gen2”.
36
+
-**NotAvailableForSubscription**: The region isn't yet available for your subscription. Select an available region.
37
+
-**InsufficientQuota**: [Create a support request to increase your quota](../azure-portal/supportability/per-vm-quota-requests.md). Free trial subscriptions don't have quota for confidential computing VMs.
38
38
39
-
1.**DCsv2 virtual machines don't show up when I try to search for them in the portal size selector**
39
+
**DCsv2 virtual machines don't show up when I try to search for them in the portal size selector**
40
40
41
-
Make sure you've selected an available region. Also make sure you select “clear all filters” in the size selector.
41
+
Make sure you've selected an [available region](https://azure.microsoft.com/global-infrastructure/services/?products=virtual-machines). Also make sure you select “clear all filters” in the size selector.
42
42
43
-
1.**What’s the difference between DCsv2-Series and DC-Series VMs?**
43
+
**I get an Azure Resource Manager template deployment failure error: "Operation could not be completed as it results in exceeding approved standard DcsV2 Family Cores Quota"**
44
44
45
-
DC-Series VMs run on older 6-core Intel Processors with Intel SGX. These have less total memory, less EPC (Enclave Page Cage) memory, and are available in less regions. These VMs are only available in US East and Europe West are available in two sizes: Standard_DC2s and Standard_DC4s. They will not go GA and can only be deployed in the [Confidential Compute DC-Series VM [Preview]](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.confidentialcompute?tab=Overview) Marketplace instance
45
+
[Create a support request to increase your quota](../azure-portal/supportability/per-vm-quota-requests.md). Free trial subscriptions don't have quota for confidential computing VMs.
46
46
47
-
1.**Are DCsv2 virtual machines available globally?**
47
+
**What’s the difference between DCsv2-Series and DC-Series VMs?**
48
48
49
-
No, these virtual machines are only available in select regions. Check the [products by regions page](https://azure.microsoft.com/global-infrastructure/services/?products=virtual-machines) for the latest available regions.
49
+
DC-Series VMs run on older 6-core Intel Processors with Intel SGX and have less total memory, less Enclave Page Cache (EPC) memory, and are available in only two regions (US East and Europe West in Standard_DC2s and Standard_DC4s sizes). There are no plans to make these VMs Generally Available and they are not recommended for production use. To deploy these VMs, use the [Confidential Compute DC-Series VM [Preview]](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.confidentialcompute?tab=Overview) Marketplace instance.
50
50
51
-
1.**How do I install the Open Enclave SDK?**
51
+
**Are DCsv2 virtual machines available globally?**
52
+
53
+
No. At this time, these virtual machines are only available in select regions. Check the [products by regions page](https://azure.microsoft.com/global-infrastructure/services/?products=virtual-machines) for the latest available regions.
54
+
55
+
**How do I install the Open Enclave SDK on the DCsv2 virtual machines?**
52
56
53
-
For instruction on how to install the OE SDK on a machine whether in Azure or on-premise, follow the instructions on the [Open Enclave SDK GitHub](https://github.com/openenclave/openenclave).
57
+
For instructions on how to install the OE SDK on an Azure or on-premise Machine, follow the instructions on the [Open Enclave SDK GitHub](https://github.com/openenclave/openenclave).
54
58
55
-
You can also head to the Open Enclave SDK GitHub for OS-specific installation instructions:
56
-
-[Install the OE SDK on Windows](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Windows.md)
57
-
-[Install the OE SDK on Ubuntu 18.04](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Ubuntu_18.04.md)
58
-
-[Install the OE SDK on Ubuntu 16.04](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Ubuntu_16.04.md)
59
+
You can also look into the Open Enclave SDK GitHub for OS-specific installation instructions:
60
+
-[Install the OE SDK on Windows](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Windows.md)
61
+
-[Install the OE SDK on Ubuntu 18.04](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Ubuntu_18.04.md)
62
+
-[Install the OE SDK on Ubuntu 16.04](https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Ubuntu_16.04.md)
Copy file name to clipboardExpand all lines: articles/confidential-computing/overview.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,13 +37,13 @@ Microsoft Azure helps you minimize your attack surface to gain stronger data pro
37
37
38
38
## Introduction to confidential computing <aid="intro to acc"></a>
39
39
40
-
Confidential computing is an industry term defined by the [Confidential Computing Consortium](https://confidentialcomputing.io/) (CCC), a foundation dedicated to defining and accelerating the adoption of confidential computing. Confidential computing is the protection of data in use when performing computations. The computations occur in a hardware-based Trusted Execution Environment (TEE).
40
+
Confidential computing is an industry term defined by the [Confidential Computing Consortium](https://confidentialcomputing.io/) (CCC) - a foundation dedicated to defining and accelerating the adoption of confidential computing. The CCC defines Confidential computing as the protection of data in use by performing computations in a hardware-based Trusted Execution Environment (TEE).
41
41
42
42
A TEE is an environment that enforces execution of only authorized code. Any data in the TEE can't be read or tampered with by any code outside that environment.
43
43
44
-
### Enclaves and Trusted Execution Environments
44
+
### Enclaves
45
45
46
-
In the context of confidential computing, TEEs are commonly referred to as *enclaves* or *secure enclaves*. Enclaves are secured portions of a hardware’s processor and memory. There's no way to view data or code inside the enclave, even with a debugger. If untrusted code attempts modify the content in enclave memory, the environment gets disabled and the operations are denied.
46
+
Enclaves are secured portions of a hardware’s processor and memory. There's no way to view data or code inside the enclave, even with a debugger. If untrusted code attempts modify the content in enclave memory, the environment gets disabled and the operations are denied.
47
47
48
48
When developing applications, you can use [software tools](#oe-sdk) to shield portions of your code and data inside the enclave. These tools will ensure your code and data can't be viewed or modified by anyone outside the trusted environment.
49
49
@@ -91,11 +91,11 @@ An application built with enclaves is partitioned in two ways:
91
91
1. An "untrusted" component (the host)
92
92
1. A "trusted" component (the enclave)
93
93
94
-
**The host** is your enclave application running on an untrusted environment. The code in the host can't access the code loaded into the enclave.
94
+
**The host** is where your enclave application is running on top of and is an untrusted environment. The enclave code deployed on the host can't be accessed by the host.
95
95
96
-
**The enclave** is where code and data run inside the TEE implementation. Secure computations should occur in the enclave to assure secrets and sensitive data stay protected.
96
+
**The enclave** is where the application code and its cached data/memory runs. Secure computations should occur in the enclaves to ensure secrets and sensitive data, stay protected.
97
97
98
-
When you start developing an enclave application, you need to determine what code and data need protection. The code that you choose to put into the trusted component is isolated from the rest of your application. Once the enclave is initialized and the code is loaded to memory, that code can't be read or changed from outside protected environment.
98
+
During application design, it's important to identify and determine what part of the application needs to run in the enclaves. The code that you choose to put into the trusted component is isolated from the rest of your application. Once the enclave is initialized and the code is loaded to memory, that code can't be read or changed from the untrusted components.
99
99
100
100
### Open Enclave Software Development Kit (OE SDK) <aid="oe-sdk"></a>
Copy file name to clipboardExpand all lines: articles/confidential-computing/virtual-machine-solutions.md
+13-7Lines changed: 13 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ This article covers information about deploying Azure confidential computing vir
16
16
17
17
## Azure confidential computing VM Sizes
18
18
19
-
Azure confidential computing virtual machines are designed to protect the confidentially and integrity of your data and code while it's processed in the cloud
19
+
Azure confidential computing virtual machines are designed to protect the confidentiality and the integrity of your data and code while it's processed in the cloud
20
20
21
21
[DCsv2-Series](../virtual-machines/dcv2-series.md) VMs are the latest and most recent confidential computing size family. These VMs support a larger range of deployment capabilities, have 2x the Enclave Page Cache (EPC) and a larger selection of sizes compared to our DC-Series VMs. The [DC-Series](../virtual-machines/sizes-previous-gen.md#preview-dc-series) VMs are currently in preview and will be deprecated and not included in general availability.
22
22
@@ -34,7 +34,7 @@ az vm list-skus
34
34
--output table
35
35
```
36
36
37
-
As of April 2020, these SKUs are available in the following regions and availability zones:
37
+
As of May 2020, these SKUs are available in the following regions and availability zones:
38
38
39
39
```output
40
40
Name Locations AZ_a
@@ -81,7 +81,7 @@ Follow a quickstart tutorial to deploy a DCsv2-Series virtual machine in less th
81
81
82
82
-**Resizing** – Because of their specialized hardware, you can only resize confidential computing instances within the same size family. For example, you can only resize a DCsv2-series VM from one DCsv2-series size to another. Resizing from a non-confidential computing size to a confidential computing size isn't supported.
83
83
84
-
-**Image** – To provide Intel Software Guard Extension (Intel SGX) support on confidential compute instances, all deployments need to be run on Generation 2 images. Azure confidential computing supports workloads running on Ubuntu 18.04 Gen 2, Ubuntu 16.04 Gen 2, and Windows Server 2016 Gen 2. Read about [support for generation 2 VMs on Azure](../virtual-machines/linux/generation-2.md) to learn more about supported and unsupported scenarios.
84
+
-**Image** – To provide Intel Software Guard Extension (Intel SGX) support on confidential compute instances, all deployments need to be run on Generation 2 images. Azure confidential computing supports workloads running on Ubuntu 18.04 Gen 2, Ubuntu 16.04 Gen 2, Windows Server 2019 gen2, and Windows Server 2016 Gen 2. Read about [support for generation 2 VMs on Azure](../virtual-machines/linux/generation-2.md) to learn more about supported and unsupported scenarios.
85
85
86
86
-**Storage** – Azure confidential computing virtual machine data disks and our ephemeral OS disks are on NVMe disks. Instances support only Premium SSD and Standard SSD disks, not Ultra SSD, or Standard HDD. Virtual machine size **DC8_v2** doesn't support Premium storage.
87
87
@@ -95,15 +95,15 @@ Azure confidential computing doesn't support zone-redundancy via Availability Zo
95
95
96
96
## Deploying via an Azure Resource Manager Template
97
97
98
-
Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure subscription. You use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
98
+
Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure subscription. You can use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
99
99
100
100
To learn about Azure Resource Manager templates, see [Template deployment overview](../azure-resource-manager/templates/overview.md).
101
101
102
-
To deploy a DCsv2-Series VM in an ARM template you will utilize the [Virtual Machine resource](../virtual-machines/windows/template-description.md). You need to ensure you specify the correct properties for **vmSize** and for your **imageReference**.
102
+
To deploy a DCsv2-Series VM in an Azure Resource Manager template, you will utilize the [Virtual Machine resource](../virtual-machines/windows/template-description.md). Ensure you specify the correct properties for **vmSize** and for your **imageReference**.
103
103
104
104
### VM Size
105
105
106
-
Specify one of the following sizes in your ARM template in the Virtual Machine resource. This string is put as **vmSize** in **properties**.
106
+
Specify one of the following sizes in your Azure Resource Manager template in the Virtual Machine resource. This string is put as **vmSize** in **properties**.
107
107
108
108
```json
109
109
[
@@ -119,6 +119,12 @@ Specify one of the following sizes in your ARM template in the Virtual Machine r
119
119
Under **properties**, you will also have to reference an image under **storageProfile**. Use *only one* of the following images for your **imageReference**.
120
120
121
121
```json
122
+
"2019-datacenter-gensecond": {
123
+
"offer": "WindowsServer",
124
+
"publisher": "MicrosoftWindowsServer",
125
+
"sku": "2019-datacenter-gensecond",
126
+
"version": "latest"
127
+
},
122
128
"2016-datacenter-gensecond": {
123
129
"offer": "WindowsServer",
124
130
"publisher": "MicrosoftWindowsServer",
@@ -141,7 +147,7 @@ Under **properties**, you will also have to reference an image under **storagePr
141
147
142
148
## Next Steps
143
149
144
-
In this article you learned about the qualifications and configurations needed when creating confidential computing virtual machine. You can now head to the Azure Marketplace to deploy a DCsv2-Series VM.
150
+
In this article, you learned about the qualifications and configurations needed when creating confidential computing virtual machine. You can now head to the Microsoft Azure Marketplace to deploy a DCsv2-Series VM.
145
151
146
152
> [!div class="nextstepaction"]
147
153
> [Deploy a DCsv2-Series Virtual Machine in the Azure Marketplace](quick-create-marketplace.md)
0 commit comments