AWS Nitro Enclaves

AWS Nitro Enclaves are isolated compute environments created from an Amazon EC2 parent instance. An enclave has no persistent storage, interactive access, or external networking of its own; communication goes through a constrained local channel to the parent instance.

Attestation documents

An enclave can produce a signed attestation document containing measurements of the enclave image, platform configuration registers, and optional caller-provided data such as a nonce or public key. A verifier checks the document and compares its measurements with an approved release.

Nitro Enclaves are useful for key handling, signing, build isolation, and other workloads that benefit from reducing access by the host application. Automata provides an open-source AWS Nitro Enclave attestation library and uses Nitro-backed isolation in TEE Compile.