AWS enclaves documentation change
Summary
Added user data script example for Amazon Linux 2023 to install AWS Nitro Enclaves CLI and configure resource allocation
Security assessment
The change provides configuration guidance for securely allocating resources to Nitro Enclaves, which are security-focused isolated environments. While it improves documentation for security features, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/enclaves/latest/user/kubernetes.md b/enclaves/latest/user/kubernetes.md index 5981f3233..3dff58860 100644 --- a//enclaves/latest/user/kubernetes.md +++ b//enclaves/latest/user/kubernetes.md @@ -3 +3 @@ -[Documentation](/index.html)[Amazon EC2](/ec2/index.html)[AWS Nitro Enclaves User Guide](nitro-enclave.html) +[Documentation](/index.html)[Amazon EC2](/ec2/index.html)[User Guide](nitro-enclave.html) @@ -91,0 +92,36 @@ You can also include any other instructions in the user data that are required f +Amazon Linux 2023 + + + MIME-Version: 1.0 + Content-Type: multipart/mixed; boundary="==MYBOUNDARY==" + + --==MYBOUNDARY== + Content-Type: text/cloud-config; charset="us-ascii" + MIME-Version: 1.0 + Content-Transfer-Encoding: 7bit + Content-Disposition: attachment; filename="cloud-config.txt" + + #cloud-config + bootcmd: + - dnf install aws-nitro-enclaves-cli -y + + --==MYBOUNDARY== + Content-Type: text/x-shellscript; charset="us-ascii" + + #!/bin/bash -e + readonly NE_ALLOCATOR_SPEC_PATH="/etc/nitro_enclaves/allocator.yaml" + # Node resources that will be allocated for Nitro Enclaves + readonly CPU_COUNT=$CONFIG_NODE_ENCLAVE_CPU_LIMIT + readonly MEMORY_MIB=$CONFIG_NODE_ENCLAVE_MEMORY_LIMIT_MIB + + # Update enclave's allocator specification: allocator.yaml + sed -i "s/cpu_count:.*/cpu_count: \$CPU_COUNT/g" \$NE_ALLOCATOR_SPEC_PATH + sed -i "s/memory_mib:.*/memory_mib: \$MEMORY_MIB/g" \$NE_ALLOCATOR_SPEC_PATH + # Restart the nitro-enclaves-allocator service to take changes effect. + systemctl enable --now nitro-enclaves-allocator.service + echo "NE user data script has finished successfully." + --==MYBOUNDARY==-- + +Amazon Linux 2 + +