> ## Documentation Index
> Fetch the complete documentation index at: https://usenaive.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Tutorial — deploy a Tower to AWS (NitroTPM)

> Publish the same raw image to EC2: S3 → import-snapshot → register-image with a real TPM 2.0 (NitroTPM), launch, claim, and run the demo. Doubles as the VPC self-host story.

The **same** `naive-tower.raw` you booted locally becomes an AMI. AWS NitroTPM
gives a real TPM 2.0, so the firstboot `cryptenroll` PCR-7 seal and the vault
unlock run **unmodified** on Nitro UEFI instances. This is the recommended
no-hardware demo and the VPC self-hosting path.

## Prerequisites (one-time, account admin)

* The **`vmimport` service role** with a trust policy for `vmie.amazonaws.com`
  and S3/EBS permissions (AWS's documented VM Import/Export role). Without it,
  `import-snapshot` fails with a role error.
* An S3 bucket you own, in your target region.
* IAM permissions for `ec2:ImportSnapshot`, `ec2:RegisterImage`, `s3:PutObject`.

## 1. Publish the AMI

```sh theme={"theme":"css-variables"}
AWS_REGION=us-east-1 S3_BUCKET=my-tower-images image/publish-ami.sh image/output/naive-tower.raw
```

`publish-ami.sh` uploads the raw to S3, runs `ec2 import-snapshot` (RAW), waits
for completion, then:

```sh theme={"theme":"css-variables"}
aws ec2 register-image --boot-mode uefi --tpm-support v2.0 \
  --architecture x86_64 --ena-support --virtualization-type hvm ...
```

`--tpm-support v2.0` is what wires NitroTPM to the instance.

## 2. Launch

Launch the AMI on a NitroTPM-capable UEFI instance (m5 / c5 / m6i). **No inbound
security-group rules** are required for the region itself (the human plane is
Tailscale, optional). The instance boots → firstboot seals `/data` to NitroTPM →
region comes up → claim QR appears in the **system log / SSM console**.

## 3. Claim + prove

Claim via the console/SSM output against your control plane (or `pnpm cp:dev`
over Tailscale), then:

```sh theme={"theme":"css-variables"}
scripts/demo.sh     # against the instance's api/gateway
```

## 4. Teardown + cost

Terminate the instance, deregister the AMI, delete the snapshot and the S3
object. A short-lived m5.large demo costs cents.

***

<Warning>
  **Status in this PoC:** the AWS publish is scripted and ready
  (`image/publish-ami.sh`) and account access is verified (`register-image`
  supports `--tpm-support v2.0`; `import-snapshot` is available). The end-to-end
  run is **BLOCKED** until (1) the `vmimport` service role is created by an account
  admin and (2) a `naive-tower.raw` is produced by the CI Packer job (local macOS
  is TCG-only).
</Warning>