Architecture: The Isolated Sibling

What an Enclave Is (and Is Not)

An enclave is not a Docker container, not a Lambda function, and not a VM you can log into. It is a separate virtual machine that the Nitro Hypervisor creates alongside your EC2 instance, sharing the same physical host but with a hardware-enforced memory boundary between them. Think of it as a sibling process that your OS can talk to but never inspect.

The Hard Constraints

To guarantee security, the enclave is intentionally stripped of capabilities that would create attack surfaces:

1. No Persistent Storage: The enclave has no disk, no EBS volume, no EFS mount. All data lives in RAM only. If the enclave crashes or is terminated, all data is gone. This prevents data remnants — an attacker cannot forensically recover secrets from a disk image.
2. No Interactive Access: There is no SSH, no RDP, no shell, no console login of any kind. You cannot attach a debugger. You cannot exec into it. Once it boots, the code runs in complete isolation from human operators.
3. No External Networking: The enclave has no IP address, no network interface card (NIC), and no route to the VPC or the internet. It is network-dark by design.

These constraints are not configuration options — they are architectural guarantees enforced by the hypervisor. You cannot accidentally misconfigure your way out of them.

The Vsock Channel

With no network and no shell, the only way to communicate with an enclave is through Vsock (Virtual Socket) — a local, hypervisor-mediated communication channel between the parent EC2 instance and the enclave. Vsock is similar in concept to a Unix domain socket, but it operates at the hypervisor level, meaning it never touches the network stack.

Each enclave is assigned a Context ID (CID), which is the Vsock equivalent of an IP address. Your parent application opens a Vsock connection to that CID and communicates using a simple request/response protocol you define.

The canonical data flow:

The parent receives encrypted data from the outside world, forwards it to the enclave via Vsock, the enclave decrypts and processes it, and returns only the result (never the raw secret). The sensitive data — the decryption key, the private key, the PII — never exists in the parent's memory space.