Security design of the AWS Nitro System
summary
Nitro is a purpose-built EC2 platform that splits I/O into Annapurna-designed Nitro cards, a Nitro controller, a minimized KVM-based hypervisor and a Nitro security chip that sits on the bus. Encryption keys for EBS, instance store and VPC are kept only in Nitro card protected memory; EBS uses KMS grants and a per-server public key; SR-IOV gives direct VM device access; formal verification and an NCC review support the hardware root of trust and zero operator access claims, while signed binaries and rolling deploys enable live update.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:33The Ship of Theseus
- 1:36Show of Hands
- 3:12Journey of the Nitro System
- 9:10Components of the Nitro System
- 11:33Nitro Cards
- 12:11Nitro Chips
- 12:28Nitro Card
- 12:49Core Functions
- 15:21Nitro IO
- 17:22SrIOV
- 18:14Encryption
- 19:04Key Management
- 21:31Hypervisor
- 23:08Primary Functions
- 24:24The Hypervisor
- 26:01Performance Comparison
- 26:43Nitro Security Chip
- 30:22Proofable Security
- 31:27Demo
- 34:16EBS Volume Encryption
- 39:42Recent developments
- 41:40Live update
- 42:42Change management
- 43:49Passive Communications
- 45:08EC2 Side Channels
- 47:31Confidential Computing
- 49:56Nitro Enclave
- 50:52Nitro EC2
- 51:27Nitro firecracker
- 52:24Nitro UEFI
- 53:43Key takeaways
related talks
46mEnhance security with the AWS Nitro System
25mOverview of the AWS Nitro System: Building Trust Through Secure Cloud Infrastructure
24mNitro System Innovation
24mConfidential Compute Architecture
23mMore Secure and Confidential Computing on Linux with Nitro Enclaves
09mAn introduction to Confidential Computing
03mCustomer Spotlight
28mAWS security at scale