Verifying Rust Code with Verus: Amazon Highlights 'Proven Correctness'

Rust prevents memory errors through its type system but cannot stop logical errors or information leaks. Verus is an open-source automated program verification tool for Rust that mechanically checks whether code satisfies mathematical specifications for all inputs.

Verification Method and Features

Developers write specifications directly within Rust source code using the requires (preconditions) and ensures (postconditions) keywords. For example, in a binary search function, one specifies the precondition that the array must be sorted and the postcondition that the value at the returned index matches. Verus proves that these specifications hold for all possible inputs, catching edge cases that tests often miss.

Amazon's Use Cases

Amazon extensively uses Rust in core infrastructure projects such as Firecracker and the Nitro Isolation Engine. By adopting Verus, Amazon has proven the correctness of key primitives in the Nitro Isolation Engine and internal infrastructure, enhancing the security of AWS serverless and virtual machine isolation. Since Verus annotations are ignored by the standard Rust compiler, compatibility is maintained between verified code and unverified projects.