Install AWS Nitro Enclaves CLI Uninstall AWS Nitro Enclaves CLI

Installing the Nitro Enclaves CLI on Linux

The following instructions are for installing or uninstalling the AWS Nitro Enclaves CLI on or from a parent instance running Amazon Linux 2023 or Amazon Linux 2. For instructions for installing the Nitro CLI on different Linux distributions, see the Nitro CLI github repository.

Install AWS Nitro Enclaves CLI

Amazon Linux 2023

To install the Nitro CLI on an instance running AL2023

Install the Nitro CLI.


$ sudo dnf install aws-nitro-enclaves-cli -y

Install the Nitro Enclaves development tools needed to build enclave images. The development tools also includes some sample applications.
```
$ sudo dnf install aws-nitro-enclaves-cli-devel -y
```
Add your user to the ne user group.
```
$ sudo usermod -aG ne username
```
Add your user to the docker user group.
```
$ sudo usermod -aG docker username
```
For the changes to take effect, log out of the instance and then reconnect to it.
Verify that the Nitro CLI installed correctly.
```
$ nitro-cli --version
```
The command should return version information about the Nitro CLI.
Preallocate the memory and the vCPUs that you intend to use for the enclaves.
Important
Nitro Enclaves uses an allocator service to preallocate vCPUs and memory to the enclaves. The amount of vCPUs and memory to preallocate are defined in the allocator service configuration file (/etc/nitro_enclaves/allocator.yaml). By default, the configuration file is set up to preallocate 512 MiB of memory and 2 vCPUs for use by the enclaves. In some cases, you might need to manually update the configuration file to preallocate a different number vCPUs or amount of memory. For example:
- If you launched an AWS Graviton-based instance with 2 vCPUs, you must configure the allocate service to preallocate only 1 vCPU.
- If you launched an instance with 4 or more vCPUs, you can configure the allocator service to preallocate more vCPUs to the enclave.
- If you are going to run multiple enclaves, you must configure the allocator service to preallocate enough vCPUs and memory for all of the enclaves. For example, to run 3 enclaves with 4 vCPUs and 2 GiB memory each, you must configure the allocator service to preallocate 12 vCPUs and 6 GiB of memory.
If you need to change the configuration file, use your preferred text editor to open /etc/nitro_enclaves/allocator.yaml. Then, for memory_mib and cpu_count, specify the overall amount of memory (in MiB) and the number of vCPUs that you want to preallocate. Save and close the file and then run the command below.
If you want to preallocate the default 512 MiB of memory and 2 vCPUs, you do not need to make any changes to the configuration file.
Run the following command to allocate the resource specified in the configuration file and to ensure that they are automatically allocated every time the instance starts.
```
$ sudo systemctl enable --now nitro-enclaves-allocator.service
```
Note
When you create an enclave, the requested memory and vCPUs must be less than or equal to the values that you specified here. If you need to create an enclave with more memory or vCPUs in the future, you must update the values in this file and restart the service.
Start the Docker service and ensure that it starts every time the instance starts.
```
$ sudo systemctl enable --now docker
```

Amazon Linux 2

To install the Nitro CLI on an instance running AL2

Install the Nitro CLI.


$ sudo amazon-linux-extras install aws-nitro-enclaves-cli -y

Install the Nitro Enclaves development tools needed to build enclave images. The development tools also includes some sample applications.
```
$ sudo yum install aws-nitro-enclaves-cli-devel -y
```
Add your user to the ne user group.
```
$ sudo usermod -aG ne username
```
Add your user to the docker user group.
```
$ sudo usermod -aG docker username
```
For the changes to take effect, log out of the instance and then reconnect to it.
Verify that the Nitro CLI installed correctly.
```
$ nitro-cli --version
```
The command should return version information about the Nitro CLI.
Preallocate the memory and the vCPUs that you intend to use for the enclaves.
Important
Nitro Enclaves uses an allocator service to preallocate vCPUs and memory to the enclaves. The amount of vCPUs and memory to preallocate are defined in the allocator service configuration file (/etc/nitro_enclaves/allocator.yaml). By default, the configuration file is set up to preallocate 512 MiB of memory and 2 vCPUs for use by the enclaves. In some cases, you might need to manually update the configuration file to preallocate a different number vCPUs or amount of memory. For example:
- If you launched an AWS Graviton-based instance with 2 vCPUs, you must configure the allocate service to preallocate only 1 vCPU.
- If you launched an instance with 4 or more vCPUs, you can configure the allocator service to preallocate more vCPUs to the enclave.
- If you are going to run multiple enclaves, you must configure the allocator service to preallocate enough vCPUs and memory for all of the enclaves. For example, to run 3 enclaves with 4 vCPUs and 2 GiB memory each, you must configure the allocator service to preallocate 12 vCPUs and 6 GiB of memory.
If you need to change the configuration file, use your preferred text editor to open /etc/nitro_enclaves/allocator.yaml. Then, for memory_mib and cpu_count, specify the overall amount of memory (in MiB) and the number of vCPUs that you want to preallocate. Save and close the file and then run the command below.
If you want to preallocate the default 512 MiB of memory and 2 vCPUs, you do not need to make any changes to the configuration file.
Run the following command to allocate the resource specified in the configuration file and to ensure that they are automatically allocated every time the instance starts.
```
$ sudo systemctl enable --now nitro-enclaves-allocator.service
```
Note
When you create an enclave, the requested memory and vCPUs must be less than or equal to the values that you specified here. If you need to create an enclave with more memory or vCPUs in the future, you must update the values in this file and restart the service.
Start the Docker service and ensure that it starts every time the instance starts.
```
$ sudo systemctl enable --now docker
```

Uninstall AWS Nitro Enclaves CLI

If you no longer want to use AWS Nitro Enclaves, use the following command to uninstall the AWS Nitro Enclaves CLI.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Nitro Enclaves CLI

Installing the CLI on Windows