AWS Nitro Architecture

Question 1

What are the components of the Nitro Architecture?

Answer 1

Nitro Architecture is a system with three main components:

a) Nitro Cards (a family of cards for different functions).
b) Nitro Security Chip
c) Nitro Hypervisor

Question 2

What are the different types of Nitro Cards?

Answer 2

Four different types of cards:

a) VPC Data Plane - ENA PCIe controller
b) NVMe PCIe Contoller -EBS Data Plane
c) NVMe PCIe Contoller - Transparent Encryption; instance storage
d) Nitro Controller - Root of Trust

Question 3

What is NVMe?

Answer 3

NVMe = Non-Volatile Memory Express

Question 4

What does the Nitro VPC Card do?

Answer 4

Key components are:

1. ENA Driver (support for multiple OSs and network speeds).
2. Responsible for the VPC Data Plane
   - Encapsulation
   - Security Groups implemented in the card.

Question 5

What does the Nitro EBS Card do?

Answer 5

• NVMe storage device
• Network attached storage (receives requests from VMs on the host and turns them into requests on the network)
• Supports encryption in HW (hence no tradeoff for performance vs security).
• Remote storage protocol (e.g. over fabric - appears that AWS uses proprietary protocols under the hood).

Question 6

What does the Nitro Instance Store Card do?

Answer 6

• Provides access to local storage at very high data rates
• Does drive monitoring - i.e. the NVMe storage tends to wear out with time and performance tends to drop.
• Physical SSDs are on the same platform as the VMs.

Question 7

What does the Nitro Controller Card do?

Answer 7

System Control

• Talks to the EC2 Control Plane (when a customer runs a “LaunchInstance” API call, that call eventually makes its way to a Nitro Controller card.
• Provides passive API endpoint
• Coordinates all other nitro cards
• Coordinates with the hypervisor and security chip
• Hardware root of trust (measurements and attestations).

Question 8

What does the Nitro Security Chip do?

Answer 8

• Custom micro-controller; sits in front of all the buses to non-volatile memory; traps I/O; ensures that it is in a state that is deired.
• Controlled by Nitro Controller
• Provides HW-based root of trust.
• Because it sits in front of every bus on the motherboard, it is able to trap writes to devices - even on bare metal instances.

Question 9

What is the Nitro Hypervisor?

Answer 9

• KVM-based hypervisor; no SSH capability is supported.

- Quiescent - does nothing by itself, acts only when requested by instance.

Question 10

How are updates to Nitro done?

Answer 10

Updates to the Nitro Cards and Hypervisors are done safely.

No impact to customer instances.