VM-Level Isolation Without Rewriting Code
Before covering AWS Nitro Enclaves, it's important to understand AMD SEV (Secure Encrypted Virtualization), because it represents a different point in the design space — and is the foundation for confidential VMs on Google Cloud and Azure.
AMD SEV encrypts the entire memory of a Virtual Machine using a key managed by the AMD Secure Processor (a dedicated security co-processor on the CPU die). The Hypervisor manages the VM but cannot read its memory contents.
Variants:
- SEV — Encrypts VM memory. The Hypervisor cannot read guest RAM.
- SEV-ES (Encrypted State) — Also encrypts CPU register state when the VM is paused or context-switched, preventing the Hypervisor from reading register values.
- SEV-SNP (Secure Nested Paging) — Adds integrity protection. Prevents the Hypervisor from remapping guest memory pages to trick the VM into reading attacker-controlled data.
Key advantage over SGX: No application rewrite required. You lift an entire existing VM into a confidential environment. This is why cloud providers like Google (Confidential VMs) and Azure (Confidential VMs) use AMD SEV-SNP as the underlying technology.
Key trade-off: The entire VM is the trust boundary, which is a larger attack surface than an SGX enclave. But the operational simplicity is a major practical advantage.