Amazon Plumbing Nitro Enclaves Support For Linux To Isolate Highly Sensitive Data

Amazon is working on upstreaming support into the Linux kernel for AWS Nitro Enclaves for additional isolation around highly sensitive data within the EC2 cloud.

As explained on the AWS page, "AWS Nitro Enclaves enables customers to create isolated compute environments to further protect and securely process highly sensitive data such as personally identifiable information (PII), healthcare, financial, and intellectual property data within their Amazon EC2 instances. Nitro Enclaves uses the same Nitro Hypervisor technology that provides CPU and memory isolation for EC2 instances."

Amazon engineers are trying to get the Nitro Enclaves capabilities into the upstream Linux kernel so it's easier to support this EC2 feature by the many Linux distributions running in the Elastic Compute Cloud.

This feature for dealing with highly sensitive data spins up an enclave that runs alongside the VM that spawned it. Resources for that enclave are carved out of the memory and vCPUs allocated to the existing VM. Communication between the NWS Nitro Enclaves and VM are done using VirtIO-Vsock while the enclave does not have disk or network access itself.

The Nitro Enclaves kernel support introduces new kernel ioctls and logic for dealing with enclave creation and allocating of resources in a KVM-focused manner. Those wanting to learn more about the proposed Nitro Enclaves support for the upstream Linux kernel can do so via this patch series.