Create a Linux AMI for NitroTPM support

You configure your Linux AMI for NitroTPM support when you register the AMI. You can’t configure NitroTPM support later.

For the list of Windows AMIs that are preconfigured for NitroTPM support, see Prerequisites for enabling at launch.

To register a Linux AMI for NitroTPM support

1. Launch a temporary instance with your required Linux AMI.

2. After the instance reaches the running state, create a snapshot of the instance's root volume.

3. Register the new AMI. Use the register-image command. For --tpm-support, specify v2.0. For --boot-mode, specify uefi. And specify a block device mapping for the root volume using the snapshot you created in the previous step.

   aws ec2 register-image \
       --name my-image \
       --boot-mode uefi \
       --architecture x86_64 \
       --root-device-name /dev/xvda \
       --block-device-mappings DeviceName=/dev/xvda,Ebs={SnapshotId=snapshot_id} \
       --tpm-support v2.0

   Expected output

   {
   "ImageId": "ami-0123456789example"
   }

4. Terminate the temporary instance you launched in step 1, if it is no longer needed.