class InstanceAWSProvider implements InstanceProvider {

    @Override
    public InstanceConfirmation confirmInstance(InstanceConfirmation confirmation) {
        
        AWSAttestationData info = JSON.fromString(confirmation.getAttestationData(),
                AWSAttestationData.class);
        
        final Map<String, String> instanceAttributes = confirmation.getAttributes();
        final String instanceDomain = confirmation.getDomain();
        final String instanceService = confirmation.getService();
        
        // before doing anything else we want to make sure our
        // object has an associated aws account id
        
        final String awsAccount = InstanceUtils.getInstanceProperty(instanceAttributes, ZTS_INSTANCE_AWS_ACCOUNT);
        if (awsAccount == null) {
            throw error("Unable to extract AWS Account id");
        }
        
        // validate that the domain/service given in the confirmation
        // request match the attestation data
        
        final String serviceName = instanceDomain + "." + instanceService;
        if (!serviceName.equals(info.getRole())) {
            throw error("Service name mismatch: " + info.getRole() + " vs. " + serviceName);
        }
        
        // validate the certificate host names
        
        StringBuilder instanceId = new StringBuilder(256);
        if (!InstanceUtils.validateCertRequestSanDnsNames(instanceAttributes, instanceDomain,
                instanceService, dnsSuffix, instanceId)) {
            throw error("Unable to validate certificate request hostnames");
        }
        
        // validate our document against given signature if one is provided
        // if there is no instance document then we're going to ask ZTS not
        // to issue SSH host certificates and request a certificate for
        // a default of 7 days only

        boolean instanceDocumentCreds = info.getDocument() != null;
        StringBuilder privateIp = new StringBuilder(64);
        if (instanceDocumentCreds) {
            StringBuilder errMsg = new StringBuilder(256);
            if (!validateAWSDocument(confirmation.getProvider(), info, awsAccount,
                    instanceId.toString(), true, privateIp, errMsg)) {
                LOGGER.error("validateAWSDocument: {}", errMsg.toString());
                throw error("Unable to validate AWS document: " + errMsg.toString());
            }
        }
            
        // set the attributes to be returned to the ZTS server

        setConfirmationAttributes(confirmation, instanceDocumentCreds, privateIp.toString());

        // verify that the temporary credentials specified in the request
        // can be used to assume the given role thus verifying the
        // instance identity
        
        if (!verifyInstanceIdentity(info, awsAccount)) {
            throw error("Unable to verify instance identity credentials");
        }
        
        return confirmation;
    }

}