AWS Nitro Enclaves
Isolated zone for sensitive data
Carves part of an EC2 instance's CPU and RAM into an isolated environment: no persistent storage, no networking, no interactive access, communicating with the parent instance only over a vsock channel; attestation lets KMS decrypt only for the right enclave.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Self-managed
- In examsSAA
Think of it asLike a windowless vault room in a bank: documents only pass through a small slot, and no outsider, not even a manager, can get in.
When to use it
✓ Use it when
Processing extremely sensitive data (private keys, PII, payment cards) where even the instance admin must not be able to read it.
✗ Avoid it when
You only need ordinary data encryption and key management → KMS; you need a dedicated HSM → CloudHSM.
Common uses
- Decrypting and processing card numbers, PII
- Signing transactions with private keys
- Secure computation on multi-party data
What does it cost?
- Pricing model: No additional charge; you pay only for the parent EC2 instance.
