Setting up the AWS Nitro-based instance
In this section, you must be logged into an AWS Nitro-based instance (see the previous section).
Installing necessary packages on the AWS Nitro-based EC2 instance
The AWS Nitro-based EC2 instance requires a few packages to create AWS Nitro Enclaves.
Installing jq is included in the required dependencies in the install command below and is
recommended since many example commands throughout this document use jq. jq is a command-line
tool that formats JSON output so that it is more easily readable.
| Only the building of enclave images is supported on Red Hat Enterprise Linux 8 and 9. |
Run the following commands to install the required dependencies:
-
Amazon Linux 2023
-
Amazon Linux 2
-
Red Hat Enterprise Linux 8/9
$ sudo yum install -y aws-nitro-enclaves-cli aws-nitro-enclaves-cli-devel jq
$ sudo usermod -aG ne ec2-user
# Give the ne group access to /dev/vsock
$ echo 'KERNEL=="vsock", MODE="660", GROUP="ne"' | sudo tee /etc/udev/rules.d/51-vsock.rules
$ sudo udevadm control --reload
$ sudo udevadm triggerSince changes were made to the permissions of the default user, exit the SSH session and log in to the AWS Nitro-based EC2 instance again for the permissions to become active. This is needed only the first time you run the commands above.
$ sudo amazon-linux-extras install -y aws-nitro-enclaves-cli
$ sudo yum install -y aws-nitro-enclaves-cli-devel jq openssl11-libs
$ sudo usermod -aG ne ec2-user
# Give the ne group access to /dev/vsock
$ echo 'KERNEL=="vsock", MODE="660", GROUP="ne"' | sudo tee /etc/udev/rules.d/51-vsock.rules
$ sudo udevadm control --reload
$ sudo udevadm triggerSince changes were made to the permissions of the default user, exit the SSH session and log in to the AWS Nitro-based EC2 instance again for the permissions to become active. This is needed only the first time you run the commands above.
# Install common prerequisites
$ sudo dnf install -y jqConfigure AWS Nitro Enclave resource allocation
The default configuration of AWS Nitro Enclaves only allocates 512 MiB of memory and 2 vCPUs for use by a single enclave. To create enclaves that are bigger, or to create multiple enclaves, you must change these default values.
Edit the file /etc/nitro_enclaves/allocator.yaml to set values for memory (memory_mib) and vCPU (cpu_count).
It is necessary to allocate a minimum of 2 vCPUs per enclave you intend to run.
2GB-4GB of memory per enclave is recommended as a good starting point,
but requirements will vary depending on what will be run inside the enclaves.
In the following tutorials, you will need at least 4096 MiB of memory.
In the following example, 16 GB of memory and 8 vCPUs are available for use by enclaves.
$ cat /etc/nitro_enclaves/allocator.yamlThis command prints output similar to the following:
---
# Enclave configuration file.
#
# How much memory to allocate for enclaves (in MiB).
memory_mib: 16384
#
# How many CPUs to reserve for enclaves.
cpu_count: 8The AWS Nitro allocator service will reserve 1 GiB huge memory pages
based on the value specified for memory_mib above.
This memory will be available for all enclaves created on the host.