AWS AWSEC2 documentation change
Summary
Expanded NitroTPM verification documentation with PowerShell examples, CLI command restructuring, and clarification about console limitations
Security assessment
The changes enhance documentation about verifying NitroTPM (a security feature for cryptographic operations) but do not address a specific vulnerability. The additions provide clearer guidance on security feature validation.
Diff
diff --git a/AWSEC2/latest/UserGuide/verify-nitrotpm-support-on-ami.md b/AWSEC2/latest/UserGuide/verify-nitrotpm-support-on-ami.md index 1ce59beea..5ac4b1fbd 100644 --- a//AWSEC2/latest/UserGuide/verify-nitrotpm-support-on-ami.md +++ b//AWSEC2/latest/UserGuide/verify-nitrotpm-support-on-ami.md @@ -7 +7 @@ -To enable NitroTPM for an instance, you must launch the instance using an AMI with NitroTPM enabled. You can use either `describe-images` or `describe-image-attributes` to verify that an AMI is enabled for NitroTPM. If NitroTPM is enabled for the AMI, the value for `TpmSupport` is `"v2.0"`. +To enable NitroTPM for an instance, you must launch the instance using an AMI with NitroTPM enabled. You can describe an image to verify that it is enabled for NitroTPM. If you are the AMI owner, you can describe the `tpmSupport` image attribute. @@ -9 +9 @@ To enable NitroTPM for an instance, you must launch the instance using an AMI wi -###### To describe the image +The Amazon EC2 console does not display `TpmSupport`. @@ -11 +11 @@ To enable NitroTPM for an instance, you must launch the instance using an AMI wi -You can use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command as follows. +AWS CLI @@ -14 +14 @@ You can use the [describe-images](https://awscli.amazonaws.com/v2/documentation/ - aws ec2 describe-images --image-ids ami-0abcdef1234567890 --query Images[*].TpmSupport +###### To verify that NitroTPM is enabled @@ -16 +16 @@ You can use the [describe-images](https://awscli.amazonaws.com/v2/documentation/ -If NitroTPM is enabled for the AMI, the output is as follows. +Use the [describe-images](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html) command. @@ -19,3 +19,3 @@ If NitroTPM is enabled for the AMI, the output is as follows. - [ - "v2.0" - ] + aws ec2 describe-images \ + --image-ids ami-0abcdef1234567890 \ + --query Images[*].TpmSupport @@ -23 +23 @@ If NitroTPM is enabled for the AMI, the output is as follows. -If TPM is not enabled, the output is empty. +If NitroTPM is enabled for the AMI, the output is as follows. If TPM is not enabled, the output is empty. @@ -26,0 +27 @@ If TPM is not enabled, the output is empty. + "v2.0" @@ -29,3 +30 @@ If TPM is not enabled, the output is empty. -###### To describe the image attribute - -Alternatively, if you are the AMI owner, you can use the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command as follows, specifying `tpmSupport` as the `attribute`. +Alternatively, if you are the AMI owner, you can use the [describe-image-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-image-attribute.html) command with the `tpmSupport` attribute. @@ -35 +33,0 @@ Alternatively, if you are the AMI owner, you can use the [describe-image-attribu - --region us-east-1 \ @@ -48,0 +47,44 @@ The following is example output. +###### To find AMIs with NitroTPM enabled + +The following example lists the IDs of the AMIs that you own with NitroTPM enabled. + + + aws ec2 describe-images \ + --owners self \ + --filters Name=tpm-support,Values=v2.0 \ + --query Images[].ImageId + +PowerShell + + +###### To verify that NitroTPM is enabled + +Use the [Get-EC2Image](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Image.html) cmdlet. + + + Get-EC2Image ` + -ImageId ami-0abcdef1234567890 | Select TpmSupport + +If NitroTPM is enabled for the AMI, the output is as follows. If TPM is not enabled, the output is empty. + + + TpmSupport + ---------- + v2.0 + +Alternatively, if you are the AMI owner, you can use the [Get-EC2ImageAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2ImageAttribute.html) cmdlet with the `tpmSupport` attribute. + + + Get-EC2ImageAttribute ` + -ImageId ami-0abcdef1234567890 ` + -Attribute tpmSupport + +###### To find AMIs with NitroTPM enabled + +The following example lists the IDs of the AMIs that you own with NitroTPM enabled. + + + Get-EC2Image ` + -Owner self ` + -Filter @{Name="tpm-support; Values="v2.0"} | Select ImageId +