AWS First Steps
LanguageEnglish
Security

Confidential Computing - Isolating and Protecting Data in Use with AWS Nitro Enclaves

An explanation of isolated processing of sensitive data with AWS Nitro Enclaves. This article introduces cryptographic attestation, KMS integration, and use cases for PII processing / encryption key management.

About 7 min read

The Need for Confidential Computing

In traditional security models, data protection has been achieved through encryption at rest and in transit. However, when data is processed, it must be decrypted and loaded into memory, and this "data in use" becomes a target for attacks. Vulnerabilities in the OS or hypervisor, memory dumps, side-channel attacks, and similar threats create a risk of data in use being leaked. AWS Nitro Enclaves is an EC2 feature built on the AWS Nitro System that is available on many EC2 instance types based on Intel, AMD, and AWS Graviton. It creates an execution environment (Enclave) isolated from the EC2 instance and processes sensitive data inside it. The vCPUs and memory of an Enclave are isolated from the parent instance by the Nitro Hypervisor, and the Enclave has no persistent storage, no interactive access, and no external networking, and you cannot get in even with SSH. Processes, applications, and users (including root and administrators) on the parent instance also cannot access the data and applications inside the Enclave.

How Enclaves Work and Attestation

An Enclave is created by partitioning part of the vCPUs and memory of the parent EC2 instance. Communication with the parent instance is limited to vsock (virtual sockets) only, and TCP/IP networking cannot be used. Applications are deployed to the Enclave as Docker images and started with the Nitro CLI. Cryptographic attestation is a mechanism for verifying the integrity of an Enclave. When an Enclave starts, the Nitro Hypervisor generates an attestation document that contains hash values of the Enclave image (code, configuration). This document is signed by the AWS Nitro Attestation PKI and is used to confirm the identity of the Enclave and that only the code you authorized is running inside it. KMS can verify the attestation document and apply an encryption key policy that allows decryption only with a specific Enclave image.

Use Cases and KMS Integration

The main use case for Nitro Enclaves is processing PII (personal information). If you process medical data, financial data, and personally identifiable information inside an Enclave and return only aggregated results to the parent instance, you can reduce the situations in which raw data leaves the Enclave. For encryption key management, as an alternative to CloudHSM, you generate / use encryption keys inside an Enclave so that the keys do not leave the Enclave. For integration with KMS, you set the Enclave's image hash (PCR values) as a condition in the KMS key policy. As a result, KMS operations work only when the Enclave's measurements match the conditions in the key policy. For multi-party computation, it can be used in a pattern where multiple organizations each send their data to an Enclave, run a joint computation inside the Enclave, and return only the results. No additional charges are required, and you can use it for only the cost of the EC2 instance.

Nitro Enclaves Pricing

Nitro Enclaves itself incurs no additional charges. The cost is that the parent instance's resources decrease by the vCPUs and memory you allocate to the Enclave. For example, if you allocate 2 vCPUs and 8 GB to an Enclave on an m5.2xlarge (8 vCPUs, 32 GB), the parent instance runs with 6 vCPUs and 24 GB. If you need to choose a large instance for the Enclave, the difference in that instance's price is the effective cost. Charges for the KMS keys used in the KMS integration ($1 per key per month) also apply (as of August 2026).

The Domain of Protecting Data in Use

Data protection commonly relies on encryption at rest and encryption in transit, but data in use has a gap that is easy to overlook. When data is processed in memory, it is in plaintext and can be visible to anyone with broad privileges on that server. Confidential computing addresses this third domain of protecting data in use. Nitro Enclaves creates a dedicated area isolated from the normal processing environment and handles sensitive data there. Because the isolated area cannot be accessed even from the parent instance, you can keep data confidential even while it is being processed. It is an approach that protects the processing stage in addition to storage and communication.

Adoption Considerations and Constraints

Nitro Enclaves isolates data in use, but you need to understand the constraints that come from that isolation when using it. The isolated area has no persistent storage and does not connect directly to external networks. It exchanges data with the parent instance only through a limited, secure communication channel. For this reason, the design limits what it handles to processing where confidentiality is especially important and processes everything else in the normal environment. With the mechanism called attestation, you verify that it is the correct isolated environment before handing over keys, establishing a chain of trust. Taking the constraints as a premise and identifying the processing that truly needs protection before applying it leads to effective use.

Summary - Nitro Enclaves Usage Guidelines

AWS Nitro Enclaves is an EC2 confidential computing feature that handles data in use in an isolated environment. Its main strengths are isolation by the Nitro Hypervisor, cryptographic attestation, and protection of encryption keys through KMS integration. It is suited to use cases where regulations or security policies require protection of data in use, such as PII processing, encryption key management, and multi-party computation. It can be used at no additional charge, and you can adopt it by adding an Enclave to existing EC2 workloads.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Share

Related Services

AWS Nitro Enclaves SpecializedA service that creates isolated execution environments within EC2 instances for securely processing sensitive dataAmazon EC2 EssentialA compute service that provides virtual servers in the cloudAWS KMS EssentialA managed encryption key service for securely creating and managing keys used to encrypt data

Related Articles

Hardware Security Modules - Dedicated Management of Cryptographic Keys with AWS CloudHSMExplains dedicated management of cryptographic keys with AWS CloudHSM. Covers exclusive use of a single-tenant HSM, direct control through PKCS#11 and JCE, key custody, the selection criteria versus KMS, migration to the hsm2m.medium generation, and TLS offload and Oracle TDE integration.Data Privacy Protection - Automated Sensitive Data Discovery and Threat Defense with Amazon Macie and GuardDutyLearn practical data privacy protection techniques combining Amazon Macie's automated sensitive data discovery in S3 with Amazon GuardDuty's threat intelligence. This article covers comprehensive security measures from identifying personal information to real-time threat detection.Confidential Data Processing with AWS Nitro Enclaves - Encryption and Attestation in an Isolated EnvironmentLearn how to process sensitive data in the isolated environment of Nitro Enclaves, and control encryption key access through KMS integration and attestation.

More on This Topic

Detecting Excessive Access Permissions with IAM Access Analyzer - Analyzing External Access and Unused PermissionsDetect unused permissions on IAM roles based on CloudTrail and automatically generate least-privilege policies. This article explains external access detection and how to build custom policy checks into CI/CD.Automating SSL/TLS Certificate Management with AWS Certificate Manager - From Issuance to RotationThis article explains free issuance of public certificates with ACM, DNS validation, automatic renewal, and deployment to ALB / CloudFront.Retrieving Compliance Reports with AWS Artifact - Audit Response and Agreement ManagementLearn how to retrieve SOC, PCI DSS, and ISO audit reports on demand and apply BAA and GDPR DPA agreements across your entire AWS Organizations structure.Automating Audits - Continuously Collecting Compliance Evidence with AWS Audit ManagerLearn how to automate audit evidence collection with AWS Audit Manager. This guide covers automated assessments based on frameworks such as SOC 2, PCI DSS, and GDPR, centralized evidence management, and audit report generation.The Hidden Structure of AWS Account IDs' 12 Digits - Why 12 Digits, and What Can You Infer?A trivia-style exploration of why AWS account IDs are 12-digit numbers, the design intent embedded in the ARN structure, and the security considerations around what can be inferred from an account ID.Why the AWS Account Root User Is Dangerous - The Design Philosophy of Privilege Separation and Practical LockdownWe explain why the AWS root user holds privileges that cannot be restricted by IAM, list the operations only the root user can perform, cover MFA setup methods, and describe the lockdown strategy using Organizations' centralized root access management.Certificate Management and HTTPS - Automated TLS Certificate Operations with AWS Certificate ManagerLearn about TLS/SSL certificate issuance, automatic renewal, and deployment using AWS Certificate Manager (ACM). Covers integration with CloudFront, ALB, and API Gateway, DNS validation, and Private CA usage.Dedicated Key Management with AWS CloudHSM - FIPS 140-3 Level 3 Compliant EncryptionAchieve FIPS 140-3 Level 3 compliant key management with dedicated HSM instances. Learn when to choose CloudHSM over KMS and how to integrate both through KMS custom key stores.

Similar Articles and Services

Confidential Data Processing with AWS Nitro Enclaves - Encryption and Attestation in an Isolated EnvironmentLearn how to process sensitive data in the isolated environment of Nitro Enclaves, and control encryption key access through KMS integration and attestation.AWS Nitro EnclavesA feature that creates isolated virtual machines within EC2 instances, securely processing sensitive data through cryptographic attestation and KMS integrationAWS Encryption and Data Sovereignty - Hardware-Level Isolation from KMS to Nitro EnclavesWe explain hardware-level encryption and data sovereignty assurance through AWS KMS, CloudHSM, and Nitro Enclaves, and compare design differences with other cloud providers.How the Nitro System Transformed EC2 - From Xen to KVM, Eliminating Virtualization OverheadLearn about the technical background behind EC2's migration from the Xen hypervisor to the Nitro System, the three-layer architecture of Nitro Cards, Nitro Hypervisor, and Nitro Enclaves, and the design philosophy that achieved bare-metal-level performance.