You're probably launching the wrong Windows Server 2025 AMI on AWS
Recently I ran into this on a fresh Windows Server 2025 instance on EC2:
“The Secure Boot update failed to update KEK 2023 with error Secure Boot is not enabled on this machine.”
The instance was UEFI, it was Windows Server 2025, and it came from an official Amazon AMI. So why wasn’t Secure Boot on?