User's Guide: Enroll a Compute Node Using AWS Nitro on Amazon Linux

1.0 Enroll a Compute Node Using Nitro on Amazon Linux

Welcome to the Fortanix Confidential Computing Manager (CCM) User Guide. This article describes how to enroll a compute node using AWS Nitro on Amazon Linux.

1.1 Setting up the Environment

  1. Create a new VM:
    1. Select Amazon Linux 2 Machine Image (AMI): NitroEnroll.pngFigure 1: Select AMI
    2. Select Instance Type: Choose an adequate instance. The c5a.xlarge type is the minimum option that supports Nitro enclaves (see NitroEnroll_ChooseInstance.pngFigure 2: Instance Type
    3. Click Configure Instance and enable enclave support (Advanced Details: Enclave). NitroEnrollEnableEnclave.pngFigure 3: Configure Instance
    4. Click Add Storage: The default storage is 8GiB. Increase the storage to a reasonable value.
    5. Optional: Add Inbound ports under Security Group to connect to the VM to install the node agent and launch the Nitro containers. You can use port 22 (for SSH) or any out-of-band mechanism to connect to the VM. You can also add any additional port required by the application.
    6. Configure the rest of the parameters as needed and launch the enclave.
  2. Install Nitro Driver and Utilities: Follow the instructions in 

1.2 Install Nitro Node Agent

  1. Obtain the join token from Fortanix CCM. To generate your Join Token, log in to
  2. Click the Infrastructure → Compute Nodes menu item, and click +ENROLL NODE on the Compute Nodes page. 
  3. In the ENROLL NODE window, a Join Token will be generated in the text box for "Get a join token to register a compute node". This Join Token is used by the compute node to authenticate itself. NitroJoinToken.pngFigure 4: Copy Join Token
  4. Click Copy to copy the Join Token (Figure 4). 
  5. Download the Amazon Nitro node agent installer.
  6. Extract the contents of the package and open the folder.
  7. Open the readme file which contains the steps to enroll the compute node in Fortanix CCM.
  8. To enroll the compute node:
    1. Copy the file to your VM.
    2. Run the with the join token copied in Step 3 . This will enroll the compute node in Fortanix CCM.
      sudo bash ./ <join-token>
  9. After the compute node is enrolled in Fortanix CCM, you will see it under the Compute Nodes overview table. Enroll-Nitro-node.pngFigure 5: Node enrolled
  10. Debug:
    1. To view the logs, run the following command:
      journalctl -xe | grep em-agent
    2. To view the status, run the following command:
      systemctl status em-agent-nitro


Please sign in to leave a comment.

Was this article helpful?
0 out of 0 found this helpful