A computer implemented method, comprising: under the control of one or more computer systems configured with executable instructions, receiving a request to provision a virtual machine and a list of approved cryptographic measurements from a user (201, 301); selecting a host computing device (204, 304) for hosting the virtual machine, the host computing device including one or more resources for executing the virtual machine; obtaining a cryptographic measurement (209, 309) of the one or more resources on the selected host computing device, using a cryptographic module (205, 305) on the host computing device, wherein the provisioning of the virtual machine is suspended before the cryptographic measurement is obtained; and determining whether to provide the user with access to the virtual machine on the host computing device based at least in part on a comparison of the cryptographic measurement to one or more approved cryptographic measurements; wherein determining whether to provide the user with access to the virtual machine further comprises: receiving a selection of a configuration of the host computing device from the user; determining an approved cryptographic measurement associated with the selected configuration of the host computing device by retrieving the list of approved cryptographic measurements and comparing the cryptographic measurement to the list of approved cryptographic measurements to determine whether the one or more resources on the selected host computing device are acceptable for hosting the virtual machine; verifying that the obtained cryptographic measurement matches the approved cryptographic measurement associated with the selected configuration of the host computing device; and launching the virtual machine on the selected host computing device and adding the virtual machine to a virtual network of the user in response to determining that the one or more resources are acceptable. under the control of one or more computer systems configured with executable instructions, receiving a request to provision a virtual machine and a list of approved cryptographic measurements from a user (201, 301); selecting a host computing device (204, 304) for hosting the virtual machine, the host computing device including one or more resources for executing the virtual machine; obtaining a cryptographic measurement (209, 309) of the one or more resources on the selected host computing device, using a cryptographic module (205, 305) on the host computing device, wherein the provisioning of the virtual machine is suspended before the cryptographic measurement is obtained; and determining whether to provide the user with access to the virtual machine on the host computing device based at least in part on a comparison of the cryptographic measurement to one or more approved cryptographic measurements; wherein determining whether to provide the user with access to the virtual machine further comprises: receiving a selection of a configuration of the host computing device from the user; determining an approved cryptographic measurement associated with the selected configuration of the host computing device by retrieving the list of approved cryptographic measurements and comparing the cryptographic measurement to the list of approved cryptographic measurements to determine whether the one or more resources on the selected host computing device are acceptable for hosting the virtual machine; verifying that the obtained cryptographic measurement matches the approved cryptographic measurement associated with the selected configuration of the host computing device; and launching the virtual machine on the selected host computing device and adding the virtual machine to a virtual network of the user in response to determining that the one or more resources are acceptable. receiving a selection of a configuration of the host computing device from the user; determining an approved cryptographic measurement associated with the selected configuration of the host computing device by retrieving the list of approved cryptographic measurements and comparing the cryptographic measurement to the list of approved cryptographic measurements to determine whether the one or more resources on the selected host computing device are acceptable for hosting the virtual machine; verifying that the obtained cryptographic measurement matches the approved cryptographic measurement associated with the selected configuration of the host computing device; and launching the virtual machine on the selected host computing device and adding the virtual machine to a virtual network of the user in response to determining that the one or more resources are acceptable.