CCSI

Lesson 4.1 · 12 min read

The Nitro Enclaves isolation model

Enclaves are hardened VMs carved from a parent instance, with only a vsock channel to the outside.

What an enclave is

An AWS Nitro Enclave is an isolated virtual machine created from the CPU and memory of a parent EC2 instance. The Nitro Hypervisor enforces the isolation. An enclave has no persistent storage, no interactive access and no external networking. Its only channel is a local vsock socket to the parent instance. Even a root user on the parent instance cannot read enclave memory or log in to it.

Nitro Enclave architectureEC2 PARENT INSTANCE (untrusted by the enclave)vsockget attestationvia parent proxyParent appnetwork, storage, proxyEnclaveown kernel + app, no networkNitro Secure Moduleattestation, randomnessNitro Hypervisorenforces isolationAWS KMSchecks attestation
The enclave reaches AWS KMS only through a proxy on the parent instance. The proxy forwards bytes; it cannot read the KMS response, which is encrypted to the enclave's key.
ConstraintConsequence for design
No networkAll external calls go over vsock to a parent-side proxy. Treat the proxy as untrusted and use end-to-end encryption.
No persistent storageState must be sealed (encrypted) and stored by the parent, or re-derived after restart.
No interactive accessOperators cannot SSH in. Plan logging and diagnostics carefully, without leaking secrets.
Fixed CPU and memoryResources are taken from the parent and set at launch (configured via the Nitro Enclaves allocator).

Key takeaways

  • An enclave is a separate VM with only a vsock to its parent; the parent is untrusted.
  • No network, storage or shell: design proxies, sealing and logging explicitly.
  • KMS responses for an attested enclave are encrypted to the enclave's public key, so the parent cannot read them.