# AWS Metadata Service trust provider

> This page describes the steps required to configure an AWS Metadata Service Trust Provider.

#

The AWS Metadata Service Trust Provider supports attestation of Client Workloads and Agent Controller identities in [AWS](https://aws.amazon.com/) environments (running either directly on EC2 instances or on managed [AWS EKS](https://aws.amazon.com/eks/)).

The AWS Metadata Service Trust Provider relies on the [AWS Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) for instance identity document.

## Match rules

The following match rules are available for this Trust Provider type:

* accountId
* architecture
* availabilityZone
* billingProducts
* imageId
* instanceId
* instanceType
* kernelId
* marketplaceProductCodes
* pendingTime
* privateIp
* ramdiskId
* region
* version

Please refer to the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) for a detailed description of match rule fields available in the identity document.

## Additional configurations

Aembit requires one of AWS’s public certificates to verify the identity document signature. Please download the certificate from the [AWS public certificate page](https://docs.aws.amazon.com/es_en/AWSEC2/latest/UserGuide/regions-certs.html) for the region that hosts your Client Workloads. Please use certificates under the RSA tabs on the AWS documentation page and paste the appropriate certificate into **Certificate** field on the **Trust Provider** page.