AZ-BOOT-01: Secure Boot and vTPM are on¶
This check runs in more than one place, with a different framing in each:
- Azure confidential VMs: Secure Boot and vTPM are on (high)
- Hardware fleets (collector): Secure Boot and vTPM are on (attested runtime claims) (high)
| Property | Value |
|---|---|
| Severity | high |
| Platform | Azure confidential VMs, Hardware fleets (collector) |
| Lifecycle stage | deploy |
| Trust boundary | vmm |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- The SNP-signed runtime claims show Secure Boot and the vTPM on.
How to fix¶
- Redeploy the confidential VM with Secure Boot and vTPM enabled.
After the fix, scan again: the check should report PASS.
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--azure-resource-group |
Resource group of the VM. |
--azure-subscription |
Subscription ID. |
--azure-vm |
Confidential VM name. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Azure | arm.vm (GET virtual machine) |
Microsoft.Compute/virtualMachines/read |
read |
See Required permissions for every check on this platform.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).