API How-Tos

This topic contains step-by-step guides for provisioning and managing IONOS CLOUD Confidential VM resources.

Prerequisites:

Confirm the following before starting:

• You have an active IONOS CLOUD account in the Frankfurt-East de/fra/2 data center.
• You have confirmed Confidential VM-capable location availability with IONOS CLOUD.
• You are experienced with Linux image building, LUKS2 disk encryption, and API-based infrastructure management.
• (Optional) You have a deployment plan for your attestation service, including network reachability from the Confidential VM at startup.

Note:

• To prepare a Confidential VM image, create a Confidential VM, and attest a Confidential VM, use the IONOS Cloud API v6 or the ionosctl CLI.
• Attestation is optional: You do not need an attestation service to run a Confidential VM. If you want to verify your VM's integrity and use attestation-based key release, set up an attestation service before preparing your image. For more information about the IONOS CLOUD reference toolchain, refer to SNPGuard.

Pre-upload validation

Before uploading your image to IONOS CLOUD, verify that it meets all requirements. For a complete checklist covering partition structure, required files, firmware validation, and measurement registration, see Step 4: Verify your image.

The upload handler validates these same requirements and rejects images that fail any checks.

Quick Links

Prepare a Confidential VM Image

Build a bootable image with the required firmware, attestation client, and LAUNCH_ARTIFACTS partition.

Create a Confidential VM

Create a startup volume and provision a Confidential VM with AMD SEV-SNP hardware encryption enabled.

Attest a Confidential VM (Optional)

Cryptographically verify that your Confidential VM runs an unmodified software stack on genuine AMD SEV-SNP hardware.