The same naive-tower.raw you booted locally becomes an AMI. AWS NitroTPM
gives a real TPM 2.0, so the firstboot cryptenroll PCR-7 seal and the vault
unlock run unmodified on Nitro UEFI instances. This is the recommended
no-hardware demo and the VPC self-hosting path.
Prerequisites (one-time, account admin)
- The
vmimport service role with a trust policy for vmie.amazonaws.com
and S3/EBS permissions (AWS’s documented VM Import/Export role). Without it,
import-snapshot fails with a role error.
- An S3 bucket you own, in your target region.
- IAM permissions for
ec2:ImportSnapshot, ec2:RegisterImage, s3:PutObject.
1. Publish the AMI
publish-ami.sh uploads the raw to S3, runs ec2 import-snapshot (RAW), waits
for completion, then:
--tpm-support v2.0 is what wires NitroTPM to the instance.
2. Launch
Launch the AMI on a NitroTPM-capable UEFI instance (m5 / c5 / m6i). No inbound
security-group rules are required for the region itself (the human plane is
Tailscale, optional). The instance boots → firstboot seals /data to NitroTPM →
region comes up → claim QR appears in the system log / SSM console.
3. Claim + prove
Claim via the console/SSM output against your control plane (or pnpm cp:dev
over Tailscale), then:
4. Teardown + cost
Terminate the instance, deregister the AMI, delete the snapshot and the S3
object. A short-lived m5.large demo costs cents.
Status in this PoC: the AWS publish is scripted and ready
(image/publish-ami.sh) and account access is verified (register-image
supports --tpm-support v2.0; import-snapshot is available). The end-to-end
run is BLOCKED until (1) the vmimport service role is created by an account
admin and (2) a naive-tower.raw is produced by the CI Packer job (local macOS
is TCG-only).
