Verify software supply chain security using AWS Nitro cryptographic verification

This article explains how to use Amazon EC2 instance attestation with NitroTPM to cryptographically verify that CI/CD platforms and container workloads boot from trusted, unmodified infrastructure, closing the trust gap in software supply chain security.

• NitroTPM captures cryptographic measurements (PCRs) of firmware, bootloader, kernel, and filesystem during boot
• Attestable AMIs generate reference PCR measurements as known-good baselines for verification
• Compare runtime PCR values against stored reference measurements to detect tampering or unauthorized changes
• Enforce attestation through AWS KMS key policies that restrict cryptographic operations to verified instances
• Apply attestation to CI/CD build hosts to verify pipeline infrastructure integrity before execution
• Extend attestation to self-managed Amazon EKS worker nodes to ensure cluster nodes boot from verified state
• Integrate verification into bootstrap scripts to prevent untrusted nodes from joining clusters

EC2 instance attestation establishes an unbroken chain of trust from hardware root through the operating system into workload execution, enabling organizations to meet Executive Order 14028 and SLSA framework requirements for verifiable software supply chain security.