CCSI

CCSI Officer course · Module 05 of 10

Google Cloud Confidential VMs, Confidential Space and Azure confidential computing

The confidential computing offerings of Google Cloud and Microsoft Azure: confidential VMs on AMD SEV, SEV-SNP and Intel TDX, Confidential Space for multi-party workloads, and Microsoft Azure Attestation with secure key release.

← Syllabus

Narrated module overview · captions available1:30 · 1.1 MB

Learning objectives

  • Create and verify a Google Cloud Confidential VM
  • Explain Confidential Space roles and how its attestation token is used with workload identity federation
  • Describe Azure confidential VM families, Microsoft Azure Attestation, and secure key release

Lessons

  1. Lesson 5.1 · 12 min

    Google Cloud Confidential VMs

    Choosing a confidential computing technology on Compute Engine, launching an instance, and checking its attestation.

  2. Lesson 5.2 · 15 min

    Confidential Space for multi-party workloads

    Workload authors, operators and data collaborators, the hardened image, and attestation-gated access via workload identity federation.

  3. Lesson 5.3 · 15 min

    Azure confidential computing, attestation and secure key release

    Confidential VM series, application enclaves, Microsoft Azure Attestation, and key release policies.

Start lesson 5.1

Check your understanding

Answer each question to see instant feedback. Pass mark 80%. Your best score is saved in this browser.

Module 5 quiz

6 questions · pass mark 80%

  1. 1.Which gcloud flag selects the confidential computing technology for a new Compute Engine instance?

  2. 2.In Confidential Space, which role runs the workload but should not be able to see the data?

  3. 3.What does the Confidential Space attestation service issue to the workload?

  4. 4.Why should a data collaborator pin the container image digest rather than a tag?

  5. 5.Microsoft Azure Attestation returns its result as:

  6. 6.Azure secure key release is an example of which RATS conveyance model?

Glossary

Confidential VM
A cloud VM whose memory is protected by a CPU TEE such as AMD SEV-SNP or Intel TDX.
Confidential Space
Google Cloud's hardened environment for running attested multi-party workloads on Confidential VMs.
Attribute condition
A CEL expression on a workload identity pool provider that filters which tokens may be exchanged for access.
MAA
Microsoft Azure Attestation, Azure's attestation verifier service.
SKR
Secure key release: releasing a key only to a TEE whose attestation satisfies a policy.

Official documentation