feat(cloud): use EBS Direct for AWS snapshots

Author: kvinwang

docs/aws-ec2-production-verifier-runbook.md

@@ -70,11 +70,16 @@ os/yocto/tools/aws/audit-aws-ec2-image-hardening.sh \
 
 ## 2. Register the AMI and deploy with `dstack-cloud`
 
+Apply the EC2 and EBS Direct IAM policy in the AWS prerequisites of
+[`quickstart.md`](quickstart.md). `iam:PassRole` is needed only when
+`aws_config.iam_instance_profile` is configured.
+
 After the release artifact hashes and AWS PCR references match the published
 release evidence, deploy with **`dstack-cloud`** (`platform: aws`). The CLI
-imports the local UKI `disk.raw` as an Attestable AMI (UEFI + NitroTPM v2.0) when
-`aws_config.ami_id` is empty, builds the shared config disk with
-`aws_measurement` from `measurement.aws.cbor`, imports a minimal GPT data-disk
+uploads the local UKI `disk.raw` directly to an EBS snapshot and registers an
+Attestable AMI (UEFI + NitroTPM v2.0) when `aws_config.ami_id` is empty, builds
+the shared config disk with
+`aws_measurement` from `measurement.aws.cbor`, writes a minimal GPT data-disk
 template whose partition is labeled `dstack-data`, and launches the instance.
 
 ```bash
@@ -84,12 +89,12 @@ export PATH="$PATH:$(pwd)/dstack/scripts/bin"
 # project for AWS
 dstack-cloud new my-aws-app --platform aws --region us-west-2
 cd my-aws-app
-# edit app.json: aws_config.s3_bucket (vmimport), subnet/security groups as needed
+# configure subnet/security groups; no S3 bucket or vmimport role is required
 # pull or place the UKI package (must include measurement.aws.cbor) under image_search_paths
 
 dstack-cloud pull dstack-0.6.0   # UKI package must include assemble-time measurement.aws.cbor
 dstack-cloud prepare             # embeds fixed os_image_hash + aws_measurement (no PCR recompute)
-dstack-cloud deploy              # import AMI/shared/labeled-data snapshots, run-instances
+dstack-cloud deploy              # create EBS snapshots directly, register AMI, run-instances
 
 dstack-cloud status
 dstack-cloud logs --follow

docs/quickstart.md

@@ -10,9 +10,51 @@ Deploy your first confidential workload on GCP (or AWS EC2 NitroTPM) in under
 - `gcloud` CLI installed and authenticated
 
 **AWS** (optional)
-- AWS account with EC2 + VM Import permissions
+- AWS account with EC2 and EBS Direct snapshot permissions
 - `aws` CLI installed and authenticated
-- S3 bucket for AMI import (or a prebuilt Attestable AMI id)
+
+The following IAM policy covers image creation, deployment, status/log access,
+start/stop, replacement, and removal performed by `dstack-cloud`:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ebs:StartSnapshot",
+        "ebs:PutSnapshotBlock",
+        "ebs:CompleteSnapshot"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:CreateTags",
+        "ec2:DeleteSnapshot",
+        "ec2:DescribeImages",
+        "ec2:DescribeInstances",
+        "ec2:DescribeSnapshots",
+        "ec2:GetConsoleOutput",
+        "ec2:RegisterImage",
+        "ec2:RunInstances",
+        "ec2:StartInstances",
+        "ec2:StopInstances",
+        "ec2:TerminateInstances"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+If `aws_config.iam_instance_profile` is set, also grant `iam:PassRole` for that
+specific role. `iam:PassRole` is not required for EBS Direct or for instances
+launched without an instance profile. Creating a VPC, subnet, or security group
+is outside `dstack-cloud`; supply existing IDs in `aws_config` and grant their
+management permissions separately only when needed.
 
 ## Install the CLI
 
@@ -47,12 +89,15 @@ This opens an editor with the global configuration file. For GCP, configure:
     "zone": "us-central1-a"
   },
   "aws": {
-    "region": "us-east-1",
-    "s3_bucket": "your-vmimport-bucket"
+    "region": "us-east-1"
   }
 }
 ```
 
+For AWS, `dstack-cloud` writes the local boot, shared, and labeled-data RAW disks
+directly to EBS snapshots in 512-KiB checksummed blocks. It does not require an
+S3 bucket, a `vmimport` service role, or `iam:PassRole`.
+
 ## Create a Project
 
 ```bash