domains / families / security / implementing-aws-nitro-enclave-security

implementing-aws-nitro-enclave-security

separate

'Build AWS Nitro Enclave confidential computing environments using nitro-cli

When to use

• Processing sensitive data (PII, PHI, financial records, cryptographic secrets) that must be isolated from EC2 instance operators and administrators
• Building confidential computing pipelines where even root-level access on the parent instance cannot read enclave memory or state
• Implementing cryptographic attestation workflows that tie KMS decryption rights to a specific, verified enclave image hash
• Deploying multi-party computation environments where two or more enclaves authenticate each other via attestation before exchanging data
• Hardening existing workloads that currently decrypt secrets on the parent instance by migrating decryption into an enclave boundary

When not to use

• workloads that do not handle sensitive data requiring hardware-level isolation
• instance types that do not support Nitro Enclaves
• scenarios where latency constraints make vsock communication overhead unacceptable

Skill page

Source