VM security & operations
NitroTPM & UEFI Secure Boot vs Trusted Launch for Azure VMs
EC2 UEFI Secure Boot plus NitroTPM maps to Azure Trusted Launch (Secure Boot, vTPM, and boot integrity monitoring).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | NitroTPM & UEFI Secure Boot | Trusted Launch for Azure VMs |
| Lifecycle | Generally available | Generally available |
| What it is | A virtual TPM 2.0 plus UEFI Secure Boot for EC2 instances launched from AMIs configured for them. Enables measured boot and BitLocker-style key sealing. | Secure Boot, vTPM 2.0, and boot integrity monitoring for Gen2 VMs and scale sets. It's the default for new Gen2 VMs, and existing Gen1 VMs can be upgraded. |
| Pricing model | No extra charge. | No extra charge for Trusted Launch. Defender for Cloud features are billed separately. |
| Docs | NitroTPM & UEFI Secure Boot docs | Trusted Launch for Azure VMs docs |
| Pricing page | NitroTPM & UEFI Secure Boot pricing | Trusted Launch for Azure VMs pricing |
| Exams | SCS-C03 | AZ-104 SC-500 |
Key differences
- Defaults. Trusted Launch is the default for new Azure Gen2 VMs and scale sets, and existing Gen1 VMs can be upgraded. On EC2, NitroTPM and Secure Boot must be enabled in the AMI (boot mode UEFI, TPM support).
- Monitoring. Azure adds guest attestation and boot integrity monitoring surfaced in Defender for Cloud. AWS exposes NitroTPM attestation documents for your own checks.
- Driver gotchas. On Azure, installing CUDA on Secure Boot Linux VMs other than Ubuntu needs Secure Boot disabled. Check GPU driver signing on both sides.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- No extra charge. NitroTPM & UEFI Secure Boot pricing →
- Azure
- No extra charge for Trusted Launch. Defender for Cloud features are billed separately. Trusted Launch for Azure VMs pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of NitroTPM & UEFI Secure Boot?
EC2 UEFI Secure Boot plus NitroTPM maps to Azure Trusted Launch (Secure Boot, vTPM, and boot integrity monitoring).
How does pricing compare between NitroTPM & UEFI Secure Boot and Trusted Launch for Azure VMs?
AWS: No extra charge. Azure: No extra charge for Trusted Launch. Defender for Cloud features are billed separately. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).