You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Using an [Azure Resource Manager Template](../virtual-machines/windows/template-description.md)
25
25
- From the [Azure portal](https://portal.azure.com/#create/hub)
26
-
- In the [Azure confidential compute (Virtual Machine)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.acc-virtual-machine-v2?tab=overview) marketplace solution template. The marketplace solution template will help constrain a customer to the supported scenarios (regions, images, availability, disk encryption).
26
+
- In the [Azure Confidential Computing (Virtual Machine)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.acc-virtual-machine-v2?tab=overview) marketplace solution template. The marketplace solution template will help constrain a customer to the supported scenarios (regions, images, availability, disk encryption).
27
27
28
-
1.**Will all OS images work with Azure confidential computing?**
28
+
**Will all OS images work with Azure confidential computing?**
29
29
30
-
No. The virtual machines can only be deployed on Generation 2 virtual machines with Ubuntu Server 18.04, Ubuntu Server 16.04, Windows Server 2019 Datacenter, and Windows Server 2016 Datacenter. Read more about Gen 2 VMs on [Linux](../virtual-machines/linux/generation-2.md) and [Windows](../virtual-machines/windows/generation-2.md)
30
+
No. The virtual machines can only be deployed on Generation 2 operating machines with Ubuntu Server 18.04, Ubuntu Server 16.04, Windows Server 2019 Datacenter, and Windows Server 2016 Datacenter. Read more about Gen 2 VMs on [Linux](../virtual-machines/linux/generation-2.md) and [Windows](../virtual-machines/windows/generation-2.md)
31
31
32
-
1.**DCsv2 virtual machines are grayed out in the portal and I can't select one**
32
+
**DCsv2 virtual machines are grayed out in the portal and I can't select one**
33
33
34
34
Based on the information bubble next to the VM, there are different actions to take:
35
35
- **UnsupportedGeneration**: Change the generation of the virtual machine image to “Gen2”.
36
-
-**NotAvailableForSubscription**: The region isn't yet available for your subscription. Select an available region.
36
+
- **NotAvailableForSubscription**: The region isn't yet available for your subscription. Select an available region.
37
37
- **InsufficientQuota**: [Create a support request to increase your quota](../azure-portal/supportability/per-vm-quota-requests.md). Free trial subscriptions don't have quota for confidential computing VMs.
38
38
39
-
1.**DCsv2 virtual machines don't show up when I try to search for them in the portal size selector**
39
+
**DCsv2 virtual machines don't show up when I try to search for them in the portal size selector**
40
40
41
41
Make sure you've selected an available region. Also make sure you select “clear all filters” in the size selector.
42
42
43
-
1.**I get an ARM deployment failure error "Operation could not be completed as it results in exceeding approved standard DcsV2 Family Cores Quota"**
43
+
**I get an Azure Resource Manager template deployment failure error: "Operation could not be completed as it results in exceeding approved standard DcsV2 Family Cores Quota"**
44
+
44
45
[Create a support request to increase your quota](../azure-portal/supportability/per-vm-quota-requests.md). Free trial subscriptions don't have quota for confidential computing VMs.
45
46
46
-
1.**What’s the difference between DCsv2-Series and DC-Series VMs?**
47
+
**What’s the difference between DCsv2-Series and DC-Series VMs?**
47
48
48
-
DC-Series VMs run on older 6-core Intel Processors with Intel SGX and have less total memory, less EPC (Enclave Page Cage) memory, and are available in only two regions (US East and Europe West in Standard_DC2s and Standard_DC4s sizes). These VMs are not planned to be made Generally Available and are not recommended for production use. To deploy these VMs, use the [Confidential Compute DC-Series VM [Preview]](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.confidentialcompute?tab=Overview) Marketplace instance.
49
+
DC-Series VMs run on older 6-core Intel Processors with Intel SGX and have less total memory, less Enclave Page Cache (EPC) memory, and are available in only two regions (US East and Europe West in Standard_DC2s and Standard_DC4s sizes). There are no plans to make these VMs Generally Available and they are not recommended for production use. To deploy these VMs, use the [Confidential Compute DC-Series VM [Preview]](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-azure-compute.confidentialcompute?tab=Overview) Marketplace instance.
49
50
50
-
1.**Are DCsv2 virtual machines available globally?**
51
+
**Are DCsv2 virtual machines available globally?**
51
52
52
53
No. At this time, these virtual machines are only available in select regions. Check the [products by regions page](https://azure.microsoft.com/global-infrastructure/services/?products=virtual-machines) for the latest available regions.
53
54
54
-
1.**How do I install the Open Enclave SDK on the DCsv2 virtual machines?**
55
+
**How do I install the Open Enclave SDK on the DCsv2 virtual machines?**
55
56
56
57
For instructions on how to install the OE SDK on an Azure or on-premise Machine, follow the instructions on the [Open Enclave SDK GitHub](https://github.com/openenclave/openenclave).
Copy file name to clipboardExpand all lines: articles/confidential-computing/overview.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Microsoft Azure helps you minimize your attack surface to gain stronger data pro
37
37
38
38
## Introduction to confidential computing <aid="intro to acc"></a>
39
39
40
-
Confidential computing is an industry term defined by the [Confidential Computing Consortium](https://confidentialcomputing.io/) (CCC), a foundation dedicated to defining and accelerating the adoption of confidential computing. Confidential computing is the protection of data in use by performing computations in a hardware-based Trusted Execution Environment (TEE).
40
+
Confidential computing is an industry term defined by the [Confidential Computing Consortium](https://confidentialcomputing.io/) (CCC) - a foundation dedicated to defining and accelerating the adoption of confidential computing. The CCC defines Confidential computing as the protection of data in use by performing computations in a hardware-based Trusted Execution Environment (TEE).
41
41
42
42
A TEE is an environment that enforces execution of only authorized code. Any data in the TEE can't be read or tampered with by any code outside that environment.
43
43
@@ -93,9 +93,9 @@ An application built with enclaves is partitioned in two ways:
93
93
94
94
**The host** is where your enclave application is running on top of and is an untrusted environment. The enclave code deployed on the host can't be accessed by the host.
95
95
96
-
**The enclave** is where the application code and its cached data/memory is run. Secure computations should occur in the enclaves to ensure secrets and sensitive data, stay protected.
96
+
**The enclave** is where the application code and its cached data/memory runs. Secure computations should occur in the enclaves to ensure secrets and sensitive data, stay protected.
97
97
98
-
During application design, it is important to identify and determine what part of the application needs to run in the enclaves. The code that you choose to put into the trusted component is isolated from the rest of your application. Once the enclave is initialized and the code is loaded to memory, that code can't be read or changed from the untrusted components.
98
+
During application design, it's important to identify and determine what part of the application needs to run in the enclaves. The code that you choose to put into the trusted component is isolated from the rest of your application. Once the enclave is initialized and the code is loaded to memory, that code can't be read or changed from the untrusted components.
99
99
100
100
### Open Enclave Software Development Kit (OE SDK) <aid="oe-sdk"></a>
Copy file name to clipboardExpand all lines: articles/confidential-computing/virtual-machine-solutions.md
+13-7Lines changed: 13 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ This article covers information about deploying Azure confidential computing vir
16
16
17
17
## Azure confidential computing VM Sizes
18
18
19
-
Azure confidential computing virtual machines are designed to protect the confidentially and integrity of your data and code while it's processed in the cloud
19
+
Azure confidential computing virtual machines are designed to protect the confidentiality and the integrity of your data and code while it's processed in the cloud
20
20
21
21
[DCsv2-Series](../virtual-machines/dcv2-series.md) VMs are the latest and most recent confidential computing size family. These VMs support a larger range of deployment capabilities, have 2x the Enclave Page Cache (EPC) and a larger selection of sizes compared to our DC-Series VMs. The [DC-Series](../virtual-machines/sizes-previous-gen.md#preview-dc-series) VMs are currently in preview and will be deprecated and not included in general availability.
22
22
@@ -34,7 +34,7 @@ az vm list-skus
34
34
--output table
35
35
```
36
36
37
-
As of April 2020, these SKUs are available in the following regions and availability zones:
37
+
As of May 2020, these SKUs are available in the following regions and availability zones:
38
38
39
39
```output
40
40
Name Locations AZ_a
@@ -81,7 +81,7 @@ Follow a quickstart tutorial to deploy a DCsv2-Series virtual machine in less th
81
81
82
82
-**Resizing** – Because of their specialized hardware, you can only resize confidential computing instances within the same size family. For example, you can only resize a DCsv2-series VM from one DCsv2-series size to another. Resizing from a non-confidential computing size to a confidential computing size isn't supported.
83
83
84
-
-**Image** – To provide Intel Software Guard Extension (Intel SGX) support on confidential compute instances, all deployments need to be run on Generation 2 images. Azure confidential computing supports workloads running on Ubuntu 18.04 Gen 2, Ubuntu 16.04 Gen 2, and Windows Server 2016 Gen 2. Read about [support for generation 2 VMs on Azure](../virtual-machines/linux/generation-2.md) to learn more about supported and unsupported scenarios.
84
+
-**Image** – To provide Intel Software Guard Extension (Intel SGX) support on confidential compute instances, all deployments need to be run on Generation 2 images. Azure confidential computing supports workloads running on Ubuntu 18.04 Gen 2, Ubuntu 16.04 Gen 2, Windows Server 2019 gen2, and Windows Server 2016 Gen 2. Read about [support for generation 2 VMs on Azure](../virtual-machines/linux/generation-2.md) to learn more about supported and unsupported scenarios.
85
85
86
86
-**Storage** – Azure confidential computing virtual machine data disks and our ephemeral OS disks are on NVMe disks. Instances support only Premium SSD and Standard SSD disks, not Ultra SSD, or Standard HDD. Virtual machine size **DC8_v2** doesn't support Premium storage.
87
87
@@ -95,15 +95,15 @@ Azure confidential computing doesn't support zone-redundancy via Availability Zo
95
95
96
96
## Deploying via an Azure Resource Manager Template
97
97
98
-
Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure subscription. You use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
98
+
Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure subscription. You can use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
99
99
100
100
To learn about Azure Resource Manager templates, see [Template deployment overview](../azure-resource-manager/templates/overview.md).
101
101
102
-
To deploy a DCsv2-Series VM in an ARM template you will utilize the [Virtual Machine resource](../virtual-machines/windows/template-description.md). You need to ensure you specify the correct properties for **vmSize** and for your **imageReference**.
102
+
To deploy a DCsv2-Series VM in an Azure Resource Manager template, you will utilize the [Virtual Machine resource](../virtual-machines/windows/template-description.md). Ensure you specify the correct properties for **vmSize** and for your **imageReference**.
103
103
104
104
### VM Size
105
105
106
-
Specify one of the following sizes in your ARM template in the Virtual Machine resource. This string is put as **vmSize** in **properties**.
106
+
Specify one of the following sizes in your Azure Resource Manager template in the Virtual Machine resource. This string is put as **vmSize** in **properties**.
107
107
108
108
```json
109
109
[
@@ -119,6 +119,12 @@ Specify one of the following sizes in your ARM template in the Virtual Machine r
119
119
Under **properties**, you will also have to reference an image under **storageProfile**. Use *only one* of the following images for your **imageReference**.
120
120
121
121
```json
122
+
"2019-datacenter-gensecond": {
123
+
"offer": "WindowsServer",
124
+
"publisher": "MicrosoftWindowsServer",
125
+
"sku": "2019-datacenter-gensecond",
126
+
"version": "latest"
127
+
},
122
128
"2016-datacenter-gensecond": {
123
129
"offer": "WindowsServer",
124
130
"publisher": "MicrosoftWindowsServer",
@@ -141,7 +147,7 @@ Under **properties**, you will also have to reference an image under **storagePr
141
147
142
148
## Next Steps
143
149
144
-
In this article you learned about the qualifications and configurations needed when creating confidential computing virtual machine. You can now head to the Azure Marketplace to deploy a DCsv2-Series VM.
150
+
In this article, you learned about the qualifications and configurations needed when creating confidential computing virtual machine. You can now head to the Microsoft Azure Marketplace to deploy a DCsv2-Series VM.
145
151
146
152
> [!div class="nextstepaction"]
147
153
> [Deploy a DCsv2-Series Virtual Machine in the Azure Marketplace](quick-create-marketplace.md)
0 commit comments