intersight_confidential_compute

Confidential computing BIOS policy for Cisco Intersight

Collection: cisco.intersight

Full Name: cisco.intersight.intersight_confidential_compute

Synopsis

Confidential computing BIOS policy for Cisco Intersight

Parameters

Name	Type	Required	Default	Description
api_private_key	string			Filename (absolute path) or string of PEM formatted private key data to be used for Intersight API authentication. If a string is used, Ansible vault should be used to encrypt string data. Ex. ansible-vault encrypt_string –vault-id tme@/Users/dsoper/Documents/vault_password_file ‘—–BEGIN EC PRIVATE KEY—– —–END EC PRIVATE KEY—–’ If not set, the value of the INTERSIGHT_API_PRIVATE_KEY environment variable is used. Required if I(api_bearer_token) is not provided. Secret value; omitted from logs and results.
api_uri	string		`https://intersight.com/api/v1`	URI used to access the Intersight API. If not set, the value of the INTERSIGHT_API_URI environment variable is used.
api_key_id	string			Public API Key ID associated with the private key. If not set, the value of the INTERSIGHT_API_KEY_ID environment variable is used. Required if I(api_bearer_token) is not provided.
api_bearer_token	string			Bearer token for OAuth2 authentication with the Intersight API. When provided, I(api_key_id) and I(api_private_key) are not required and the C(cryptography) Python library is not needed. If not set, the value of the INTERSIGHT_API_BEARER_TOKEN environment variable is used. Secret value; omitted from logs and results.
validate_certs	bool		`true`	Boolean control for verifying the api_uri TLS certificate
use_proxy	bool		`true`	If C(no), it will not use a proxy, even if one is defined in an environment variable on the target hosts.
state	string		`present`	If C(present), will verify the resource is present and will create if needed. If C(absent), will verify the resource is absent and will delete if needed. Choices: `present`, `absent`
organization	string		`default`	The name of the Organization this resource is assigned to. Profiles and Policies that are created within a Custom Organization are applicable only to devices in the same Organization.
name	string	yes		The name assigned to the BIOS policy. The name must be between 1 and 64 alphanumeric characters, allowing special characters :-_.
description	string			The user-defined description of the BIOS policy.
tags	list			List of tags in Key: Value: format.
security_profile	string			The confidential computing security profile to apply. C(amd_sev) enables AMD Secure Encrypted Virtualization with memory encryption for VMs. Encrypts VM memory with per-VM keys so the hypervisor cannot read guest data. Requires AMD EPYC processors (Milan/Genoa or later). C(amd_sev_snp) enables AMD SEV with Secure Nested Paging for stronger isolation. Adds integrity protection on top of SEV memory encryption, preventing hypervisor tampering with guest memory mappings. Requires AMD EPYC Genoa or later. C(intel_sgx) enables Intel Software Guard Extensions for application-level enclaves. Creates hardware-encrypted memory enclaves that protect specific application data even from the OS and hypervisor. Requires Intel Xeon Scalable (Ice Lake or later). C(intel_sgx_with_auto_reg) enables Intel SGX with automatic registration agent. Includes all intel_sgx settings plus enables the SGX auto-registration agent for simplified attestation service enrollment. Choices: `amd_sev`, `amd_sev_snp`, `intel_sgx`, `intel_sgx_with_auto_reg`
sev_asid_count	string			Number of AMD SEV Address Space Identifiers (ASIDs) to allocate. Higher ASID counts allow more concurrent encrypted VMs but may reduce available ASIDs for SEV-SNP. Only applicable for amd_sev and amd_sev_snp security profiles. Choices: `platform-default`, `253 ASIDs`, `509 ASIDs`
sgx_epoch0	string			Intel SGX Epoch 0 value. Changing this invalidates all existing SGX sealed data. Only applicable for intel_sgx and intel_sgx_with_auto_reg profiles. Use with caution in production environments.
sgx_epoch1	string			Intel SGX Epoch 1 value. Changing this invalidates all existing SGX sealed data. Only applicable for intel_sgx and intel_sgx_with_auto_reg profiles. Use with caution in production environments.
enable_tme	string			Override for Intel Total Memory Encryption (TME). TME is a prerequisite for SGX and encrypts all system memory with a platform key. Automatically enabled by intel_sgx profiles; set explicitly only to override. Choices: `platform-default`, `enabled`, `disabled`
numa_optimized	string			Override for NUMA optimization. All confidential compute profiles enable NUMA optimization by default. Choices: `platform-default`, `enabled`, `disabled`

Example

yaml

- cisco.intersight.intersight_confidential_compute:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    description: AMD SEV for secure AI inference VMs
    name: bios-amd-sev-ai
    organization: AI-Factory
    security_profile: amd_sev
    sev_asid_count: 509 ASIDs
  name: Create AMD SEV policy for encrypted AI VMs

- cisco.intersight.intersight_confidential_compute:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    description: SEV-SNP for secure model training
    name: bios-sev-snp-training
    security_profile: amd_sev_snp
  name: Create AMD SEV-SNP policy for maximum VM isolation

- cisco.intersight.intersight_confidential_compute:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    description: SGX enclaves for confidential inference
    name: bios-sgx-inference
    security_profile: intel_sgx_with_auto_reg
  name: Create Intel SGX policy for enclave-based inference

- cisco.intersight.intersight_confidential_compute:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    name: bios-amd-sev-ai
    security_profile: amd_sev
    state: absent
  name: Delete confidential compute policy