Skip to main content

Deploying on Microsoft Azure

Azure runs Polaris on AMD SEV-SNP confidential VMs today, with Intel TDX and NVIDIA H100 confidential GPUs on the platform roadmap. Read Deploying Polaris first for the choices common to every cloud; this page covers what is specific to Azure.

Before you start​

You deploy into your own Azure subscription. You provide the subscription ID and the location; the tenant, the resource group, and the container registry name are resolved or derived for you if you leave them out, so a minimal config is short. You also provide an SSH public key for operator access.

Pick a location that offers the AMD SEV-SNP confidential-VM sizes, and settle that together with the TEE choice.

TEE options​

ChoiceHardwareVM series
AMD SEV-SNPAMD GenoaDCadsv6 / ECadsv6

The confidential VMs run with vTPM and Secure Boot enabled. Intel TDX and confidential-GPU sizes are planned but not yet available through Polaris on Azure.

Verification path​

Azure uses what we call Pattern A1: AMD silicon is the attestation root, and Microsoft is not in the trust path for confidentiality. The AMD report is verified against AMD's keys. Because Azure's paravisor produces a per-VM launch measurement that never settles into a fixed value, Polaris anchors the platform gate in the chip-level evidence and records the per-VM measurement rather than gating on it.

Key management​

The Policy Manager gates a key in Azure Key Vault Premium, which is HSM-backed, with purge protection on and RBAC authorization. The Policy Manager holds a narrowly scoped role: it can manage access to that one key, not the whole vault, and only to grant the specific crypto role the workload needs. Each Policy Manager grant follows the attestation verdict. The identity that receives access is a managed identity whose signed token Polaris verifies against Microsoft's published keys before trusting it.

Sizing​

You set the VM size for the workload and for the Policy Manager. Both run on confidential DCadsv6-class sizes; the workload is sized to your application and the Policy Manager runs on a smaller size in the same series.

How you deploy​

  • Command line. Point the deploy script at an Azure config file with your subscription, location, and workload image. The workload is normally a prebuilt image in Azure Container Registry.
  • Azure Marketplace. Deploy from the listing and fill in the options through the Azure form. The marketplace image ships with the Polaris components baked in.

Notes​

  • The networking splits the workload and the Policy Manager into separate subnets, each with its own security group, and rejects an open 0.0.0.0/0 rule for SSH and public workload access, so you name the ranges you actually want to allow.
  • Tearing down the deployment removes the VMs, the network, and the vault resources it created.