AWS Nitro System
The AWS Nitro System is the underlying hardware and software platform that powers modern EC2 instances, offloading virtualization, networking, and storage functions to dedicated Nitro cards so nearly all of a host server's resources are…
Definition
The AWS Nitro System is the underlying hardware and software platform that powers modern EC2 instances, offloading virtualization, networking, and storage functions to dedicated Nitro cards so nearly all of a host server's resources are available to customer workloads, while also providing strong security isolation.
Overview
Traditional hypervisor-based virtualization runs a software layer on the host CPU that manages networking, storage I/O, and security for guest virtual machines, consuming host resources and creating a broad attack surface. The Nitro System re-architects this by moving those functions off the main host processor onto purpose-built Nitro Cards — dedicated hardware for networking (Nitro Card for VPC), storage (Nitro Card for EBS/instance storage), and a Nitro Security Chip — combined with a lightweight Nitro Hypervisor that handles only CPU and memory virtualization. Because I/O and security functions run on dedicated silicon rather than sharing the host CPU, Nitro-based instances can dedicate nearly all host hardware resources to customer workloads, delivering performance close to bare metal alongside the elasticity of virtual machines. This architecture also underpins AWS's security model: the Nitro Security Chip provides continuous integrity monitoring of the host's firmware and hardware root of trust, and — critically — AWS states that even AWS operators have no mechanism to access customer data on Nitro-based instances, since there is no interactive access to the underlying hardware in normal operation. The Nitro System is foundational to several other AWS capabilities: it enables EC2 Bare Metal instances (giving direct hardware access with none of the traditional hypervisor overhead), AWS Nitro Enclaves (isolated, hardened compute environments for processing highly sensitive data with no persistent storage or network access), and forms the security and performance basis referenced in AWS's compliance and confidential-computing claims. All current-generation EC2 instance types run on the Nitro System, which AWS has positioned as a core differentiator versus other cloud providers' virtualization stacks, particularly for security-sensitive and performance-sensitive workloads.
Key Features
- Offloads networking, storage, and security to dedicated Nitro Cards
- Lightweight Nitro Hypervisor virtualizes only CPU and memory
- Delivers near bare-metal performance for virtualized instances
- Nitro Security Chip provides hardware root of trust and integrity monitoring
- AWS states operators have no interactive access to customer data on Nitro instances
- Enables EC2 Bare Metal instances and AWS Nitro Enclaves
- Underpins all current-generation EC2 instance families
- Central to AWS's confidential computing and compliance posture