Is TPM available in rented servers?
Yes, Trusted Platform Module (TPM) 2.0 is available in OCI through a feature called Shielded Instances.
In OCI, a TPM isn't just an optional "add-on"; it is a core component of Oracle’s hardware-based security strategy to protect against low-level threats like rootkits and bootkits.
When you enable the TPM on a rented server, OCI provides a hardware-backed security chip (or a virtualized equivalent for VMs) that performs three main tasks:
Measured Boot: It records a "digital fingerprint" of every piece of software that loads during the boot process (firmware, bootloader, kernel).
Secure Storage: It stores sensitive artifacts like certificates, encryption keys, and signatures in a tamper-resistant location.
Attestation: It allows you to verify that the server has not been tampered with. If a single byte of the boot sequence changes, the TPM measurements won't match, and the "Shield" icon in your OCI console will turn red.
The implementation of TPM varies slightly depending on your "rental" type:
| Feature | Virtual Machines (VMs) | Bare Metal Servers |
| TPM Type | vTPM (Virtual TPM 2.0) | Physical TPM 2.0 Chip |
| Measured Boot | Supported natively | Often requires 3rd-party tools |
| Secure Boot | Supported | Supported |
| Main Use Case | Windows 11 compatibility, BitLocker | Secret storage, hardware attestation |
To use the TPM, you must select the Shielded Instance option during the server creation process.
Cost: Enabling the TPM/Shielded Instance feature is free (it is included in the standard price of the compute shape).
OS Support: It is supported on all modern versions of Windows Server (including Windows Server 2025) and major Linux distributions like Oracle Linux, Ubuntu, and CentOS.
In 2026, many modern operating systems and security tools require a TPM to function:
Windows 11 / Server 2025: These OS versions require a TPM 2.0 for standard installation and advanced security features like Credential Guard.
BitLocker: If you want to use full-disk encryption managed by the guest OS, the TPM provides the secure storage for the decryption keys.
Kubernetes (OKE): You can use TPM-enabled worker nodes to ensure that the nodes joining your cluster haven't been compromised at the hardware level.
| Security Feature | Standard Instance | Shielded (TPM) Instance |
| Boot Protection | Standard | Hardware-verified |
| Rootkit Protection | OS-level only | Firmware-level |
| Secret Storage | Software-based | Hardware-backed (TPM) |
| Visibility | Simple "Running" status | Integrity Health (Shield Icon) |