AWS explains an approach and architecture for achieving zero-operator access (ZOA) for self-managed databases by combining EC2 instance attestation with an Attestable AMI. It outlines how EBS volumes encrypted with NitroTPM and LUKS are protected using PCR measurements.
This article explains the design and implementation approach for achieving zero-operator access for self-managed databases using EC2 instance attestation. Centered on an Attestable AMI, it combines NitroTPM, UKI and LUKS to present a framework that balances database confidentiality and operability.
In the boot-time chain of trust, the Nitro firmware measures the UKI and reflects the results in PCR4, PCR12 and PCR7. The system in the Attestable AMI creates and verifies an attestation at startup, using these measurements as conditions for access to AWS KMS. This allows encrypted resources to be decrypted only in the correct boot environment.
The reference implementation is described in 5 steps: building the UKI, associating the store using dm-verity, calculating PCR values with nitro-tpm-pcr-compute, outputting the reference measurements (tpm_pcr.json), and incorporating them into the KMS key policy. This links the AMI measurements to the conditions for decryption by KMS.
Operational considerations for achieving ZOA include disabling SSH and serial connections, restricting ports, controlling access to IMDS, deploying read-only file systems, and performing verification with dm-verity. Because changes to the AMI are reflected in the PCR values, careful policy management is required.