> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/api-how-tos/create-confidential-vm.md).

# Create a Confidential VM

Create an IONOS CLOUD Confidential VM using the Cloud API with AMD SEV-SNP hardware enforcement.

Once your image is uploaded, creating a Confidential VM is a standard server-create call with two Confidential VM-specific rules. This topic describes how to create a Confidential VM using the [<mark style="color:blue;">IONOS CLOUD API</mark>](https://api.ionos.com/docs/cloud/v6/), understand immutable properties after creation, and learn how restart behavior differs from standard VMs.

{% hint style="warning" %}
**Important:**

* The Confidential VM must be an `ENTERPRISE` server.
* You must not specify `cpuFamily` or `cores`.
  {% endhint %}

Both the mentioned parameters are derived from the image's `launch-config.json`. After creation, the platform begins a hardware-enforced startup and encrypts VM memory from the start. Key properties, such as `cores`, `ram`, `cpuFamily`, and `availabilityZone`, are immutable after creation. Restart behaviour also differs from standard VMs: an in-guest restart terminates the VM rather than restarts it. You can use the API to restart it.

{% hint style="info" %}
**Prerequisites:**

* Ensure your Confidential VM image is uploaded.
* You must have access to the [<mark style="color:blue;">IONOS CLOUD API</mark>](https://api.ionos.com/docs/cloud/v6/).
  {% endhint %}

## How to create a Confidential VM

{% stepper %}
{% step %}

### Create a Confidential VM using the Cloud API

Create an `ENTERPRISE`-type server with a volume that uses your uploaded Confidential VM image. An image is confidential if SEV-SNP appears in its `requiredFeatures`, which is set automatically at upload; that is what routes the server to Confidential VM-capable hardware.

```bash
POST /cloudapi/v6/datacenters/{datacenterId}/servers
{
  "properties": {
    "name": "my-cc-vm",
    "type": "ENTERPRISE",
    "ram": 8192
  },
  "entities": {
    "volumes": {
      "items": [
        { "properties": { "image": "YOUR_UPLOADED_IMAGE_ID", "size": 20 } }
      ]
    }
  }
}
```

{% hint style="warning" %}
**Important:**

* **Do not set `cpuFamily`:** The CPU family (example: `EPYC-Turin`) is selected automatically from the `vcpu-model` field of the `launch-config.json` configuration located in the `LAUNCH_ARTIFACTS` partition.
* **Do not set `cores`:** The number of vCPU cores is selected automatically from the `vcpu-count` field of the same file.
  {% endhint %}

After creation, `cores`, `ram`, `cpuFamily`, and `availabilityZone` are immutable, preventing configuration changes after the initial start. You can change the startup volume.

However, you can update these artifacts if your attestation stack supports re-attestation or if you use SNPGuard. For more information, see [<mark style="color:blue;">IONOS CLOUD API documentation</mark>](https://api.ionos.com/docs/cloud/v6/).
{% endstep %}

{% step %}

### Understand Confidential VM startup behavior

The platform reads the `LAUNCH_ARTIFACTS` and begins the hardware-enforced startup. Your VM's memory is encrypted by the CPU from the start, with or without attestation. If you configured an attestation service, the `initrd` contacts it during startup to obtain the disk-unlock key. If you did not, your `initrd` is responsible for unlocking the root filesystem on its own. For more information about what attestation does and does not cover, see [<mark style="color:blue;">Attest a Confidential VM</mark>](/cloud/compute-services/compute-engine/confidential-computing-vm/api-how-tos/attest-confidential-vm.md).

{% hint style="warning" %}
**Important:** Restarting using the API performs a full cold stop and start; memory is cleared and the full startup sequence, including attestation if configured, runs again. Restarting or shutting down from within the VM terminates it and does not restart it automatically. To restart, use the [<mark style="color:blue;">IONOS CLOUD API</mark>](https://api.ionos.com/docs/cloud/v6/).
{% endhint %}
{% endstep %}
{% endstepper %}

{% hint style="success" %}
**Result:** Your Confidential VM is now created with hardware-enforced memory encryption and a secure startup configured from the `LAUNCH_ARTIFACTS`.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/api-how-tos/create-confidential-vm.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.