class InstanceAWSProvider implements InstanceProvider {

    boolean validateAWSDocument(final String provider, AWSAttestationData info,
            final String awsAccount, final String instanceId, boolean checkTime,
            StringBuilder privateIp, StringBuilder errMsg) {
        
        final String document = info.getDocument();
        if (!validateAWSSignature(document, info.getSignature(), errMsg)) {
            return false;
        }
        
        // convert our document into a struct that we can extract data
        
        Struct instanceDocument = JSON.fromString(document, Struct.class);
        if (instanceDocument == null) {
            errMsg.append("Unable to parse identity document");
            LOGGER.error("Identity Document: {}", document);
            return false;
        }
        
        if (!validateAWSProvider(provider, instanceDocument.getString(ATTR_REGION), errMsg)) {
            return false;
        }
        
        // verify that the account lookup and the account in the document match
        
        if (!validateAWSAccount(awsAccount, instanceDocument.getString(ATTR_ACCOUNT_ID), errMsg)) {
            return false;
        }
        
        // verify the request has the expected account id
        
        final String infoInstanceId = getInstanceId(info, instanceDocument);
        if (!validateAWSInstanceId(instanceId, infoInstanceId, errMsg)) {
            return false;
        }

        // save the private ip

        final String ip = instanceDocument.getString(ATTR_PRIVATE_IP);
        if (ip != null) {
            privateIp.append(ip);
        }

        // verify that the boot up time for the instance is now

        return !checkTime || validateInstanceBootTime(instanceDocument, errMsg);
    }

}