Machine identity

1.How aws EC2 generate instance identity documents?

2.How to leavage the instance identity for SSH?

3.How to limit ssh access via group policy? how ssh-agent works?

4.Except spire identity, what are the solutions for node attestation? and worklad attestation?

5.Could software launch and verify itself?

6.how could k8s service account jwt token assoicate with host identity?