Start a Confidential VM

Starting a Confidential VM powers on the instance and runs the full AMD SEV-SNP hardware-enforced startup sequence. A new memory encryption key is generated by the CPU on each start. If attestation is configured, the initrd contacts the attestation service during startup to obtain the disk-unlock key.

Note: Starting a Confidential VM takes slightly longer than a standard server start due to the hardware-enforced attestation flow.

To start a Confidential VM, follow these steps:

1. In the DCD, go to Menu > Virtual Data Centers.

2. Select the data center where the Confidential VM is configured.

3. Select the respective Confidential VM in the Workspace.

4. In the Inspector pane, select Power > Start. Optionally, you can also right-click on the VM and choose Power > Start.

Start a Confidential VM from the Workspace or the Inspector Pane

5. Select Apply START in the Power State dialog.

6. Select PROVISION CHANGES.

7. In the Provision Data Center dialog, select Confirm.

8. In the Confirm Starting and Stopping of Servers dialog, enter your Password, and select OK. The password prompt may not appear if you have already specified your password and selected the check box to not ask the password for the next 60 minutes.

9. Select Provision Now.

Result: The DCD displays a Provisioning Complete notification once the Confidential VM powers on. Memory encryption is active from startup. If you enabled a public IP address, the system assigns the address and resumes billing.