CanaryBit Inspector#️

Audit & Certify Trusted Execution Environments (TEE)

CanaryBit Inspector is a Confidential Computing Remote Attestation service with extended functionalites, helping end-users to fully verify the security of their processing environments before any sensitive data analysis.

CanaryBit Inspector validates that the underlying platform has support for and uses Confidential Computing capabilties enabled by the platform's instruction set architecture and firmware. CanaryBit Inspector performs the validation based on an Attestation Report provided by a software client deployed in the TEE. The client software collects information on the hardware, firmware, and software level to attest its trustworthiness. CanaryBit Inspector monitors the infrastructure security and enforces customer-defined deployment policies by destroying infrastructure components that fail to meet custom needs.

Architecture#️

CanaryBit Inspector service is built on microservices that wholetogether provide an holistic view on the underlying insfrastructure and technology stack.

Core: the core logic of CanaryBit's Inspector Remote Attestations (RA) service. It verifies the integrity of a processing environment running on hardware with Confidential Computing capabilities.
https://api.inspector.confidentialcloud.io
Dashboard: it offers multiple services and functionalities to fine-tune the expected processing environments and collect the final results through a single, unified interface.
https://dashboard.inspector.confidentialcloud.io
Vulnerabilities Search: it structures and exposes CVE vulnerabilities to the Inspector dashboard, highlighting security vulnerabilities of the target setup.
Cache: it optimises the retrieval of hardware certificates (leaf, intermediate and root) and relevant assets needed for cryptographic verification of the attestation reports generated by Confidential Computing-capable processing units.
Database: a data store used by all the microservices;

The client#️

The cb-inspector-client is the client implementation for the CanaryBit Inspector Attestation service. Written in Rust, it is responsible to collect the attestation data and call the CanaryBit Inspector API to verify the execution environments, either Confidential VMs or containers.

Inspector Workflow

Requirements#️

A CanaryBit account;
A CanaryBit Inspector licence;
A target environment with a supported technology stack.

Attest a Confidential VM#️

CanaryBit Inspector verifies Confidential VMs (cVM) deployed:

CanaryBit Tower#️

A Confidential VM is automatically deployed by the end-user using CanaryBit Tower on the target infrastructure provider and attested by CanaryBit Inspector via the CanaryBit cloud-init configuration injected at creation time.

Custom deployment#️

A Confidential VM is deployed by the end-user on the target infrastructure provider and attested by CanaryBit Inspector via a custom cloud-init configuration injected at creation time containing the steps required by CanaryBit Inspector.

Manually#️

A Confidential VM is deployed by the end-user on the target infrastructure provider and manually attested by CanaryBit Inspector following the steps below:

From outside a Confidential VM:

Download the CanaryBit Command-Line Interface (CLI)

Source your CanaryBit credentials:

export CB_USERNAME=***
export CB_PASSWORD=***

Download the CanaryBit Inspector client (cb-inspector-client)
```
./cb download cb-inspector-client [CB_INSPECTOR_CLIENT_V]/cb-inspector-client
```
where [CB_INSPECTOR_CLIENT_V] is the required client version (e.g. 0.1.0).
Get a Token
```
./cb login inspector
```
The command returns a fresh token for the user. The token will be used by cb-inspector-client to authenticate the user towards the CanaryBit Inspector service.

From inside a Confidential VM:

Access the Confidential VM and run the cb-inspector-client using the fresh token retrieved in the previous step:

export CB_INSPECTOR_CLIENT_TOKEN=***

./cb-inspector-client --environments [TARGET_ENV] --inspector-url https://api.inspector.confidentialcloud.io

where TARGET_ENV is currently, one of the following:

snp for AMD SEV-SNP
tdx for Intel TDX

Note

Currently, cb-inspector-client requires the libtss2 library to be installed on the machine. If not available, simply install the package with:

sudo apt install libtss2-dev

Example: AMD SEV-SNP attestation

# Attest the Confidential VM
$ export CB_INSPECTOR_CLIENT_LOG_LEVEL="info"
$ ./cb-inspector-client --environments snp --inspector-url https://inspector.confidentialcloud.io
2026-02-22T22:14:55Z info: starting attestation
2026-02-22T22:14:55Z info: generating attestation reports for enclave c2fdb0228f9e3edb1c5999f2401e76929fd79d7ec9e0d08cd914dfb5347aeb28
2026-02-22T22:14:55Z info: requesting nonce from: https://inspector.confidentialcloud.io
2026-02-22T22:14:56Z info: generating attestation reports
2026-02-22T22:14:56Z info: generating attestation report for SEV-SNP
2026-02-22T22:14:56Z info: collecting claims
2026-02-22T22:14:56Z info: preparing composite attestation report
2026-02-22T22:14:56Z info: validating generated reports
2026-02-22T22:14:56Z info: requesting verification from: https://inspector.confidentialcloud.io
2026-02-22T22:14:58Z info: verification report: {"claims":{"attestations":[{<ATTESTATION_REPORT>}]}} 
2026-02-22T22:14:58Z info: attestation successful

Attest a Container/Pod#️

In addition to Confidential VMs, CanaryBit Inspector can attest confidential containers/pods, no matter if they are managed by an orchestration service (e.g. Azure AKS or AWS EKS) or a specific container platform.

CanaryBit Surveyor helps to correctly configure the containerisation platform and enforces CanaryBit Inspector Remote Attestation before containers/pods execution.

Add custom policies#️

CanaryBit Inspector allows end-users to apply custom policies at different levels in the technology stack:

Application
Operating System
Virtualization
Hardware

Custom policies are enforced in addition to the verifier policies, and together they assess the security level and prove the correctness of each TEE.

The Policy Generator and Policy Playground in the CanaryBit Inspector dashboard help you define custom policies according to the exposed CanaryBit Inspector report object schema.

Create a policy file#️

Create a file with a custom Rego policy expression.

Example

Custom policy to enforce a specific OS kernel version, hypervisor, and region for the deployed TEE.

mypolicy.rego

package mypolicy

default allow := false

allow if {
    input.claims.attestations.canarybit.kernel_version == "6.17.0-14-generic"
    input.claims.metadata.hypervisor.cpuid_hypervisor == "HyperV"
    input.claims.metadata.instance.region = "northeurope"
}

Apply the policy#️

Follow the related documentation to apply custom policy with CanaryBit Tower or CanaryBit Surveyor.

For manual verification, simply add the policy file as argument to the cb-inspector-client.

Example: Manual verification with custom policy

./cb-inspector-client ... --policy mypolicy.rego

Download the reports#️

The final report and additional insights are available for download on the CanaryBit Inspector dashboard.

Licences#️

CanaryBit Inspector can be deployed on-prem, for internal use or offered as a service.

Trial

Try CanaryBit Inspector and related products for FREE with our "Not For Resale (NFR)" licence.

Contact us!
Private

Choose between Basic, Standard or Enterprise licence and get up to speed in minutes.

Contact us!
Reseller

If you are interested in offering CanaryBit Inspector as a Service (SaaS).

Contact us!