AWS Nitro Enclave (Hypervisor-based TEE・2019年)（エーダブリュエスナイトロエンクレーブ）
2019年AWS re:Invent発表のAWS Nitro Enclave・AWS Nitro System (2017年Hypervisor) base のCustom TEE Architecture・EC2 instance内に Isolated Enclave (CPU + Memory完全分離 + Network/Storage attached禁止) を作成・vsock (Virtual Socket) のみがParent EC2との通信路・KMS / Attestation API integration・PCI DSS / HIPAA / FedRAMP対応・Confidential VM技術不採用の独自Architecture (Intel TDX / AMD SEV-SNP / Arm CCAとは別Approach) ・AWS Hyperscaler Confidential Computing先駆者・Goldman Sachs / Pfizer / Aetna等 Fortune 100 deploys。
概要
AWS Nitro Enclave は、2019年12月AWS re:Invent 2019で発表されたAmazon Web Services のEnterprise Cloud Confidential Computing service。AWS Nitro System (2017年Hypervisor・Amazon EC2 underlying virtualization platform・Nitro Card DPU + Nitro Security Chip + Nitro Hypervisor構成) base のCustom Trusted Execution Environment Architecture。Intel TDX (2023年) / AMD SEV-SNP (2020年) / Arm CCA Realm (2023年) のHardware-based CPU TEE と異なる Hypervisor-based Architecture でAWS独自Approach・EC2 Instance内に Isolated Enclave (CPU + Memory完全分離 + Network attached禁止 + Block Storage / EBS attached禁止 + persistent storage禁止) を作成 + Parent EC2 instanceと vsock (Linux Kernel Virtual Socket・Hypervisor-level通信channel) のみが通信路 (Network / FileSystem経由通信全部Block) + AWS KMS (Key Management Service) Attestation API integration (Attestation document for KMS key release) + AWS Cryptographic Attestation document (PEM format・workload identity verification) ・PCI DSS Level 1 / HIPAA BAA / FedRAMP High / ISO 27001 / SOC 2 Type II Compliance対応。AWS Hyperscaler Confidential Computing先駆者 (Microsoft Azure Confidential VM 2020年 / Google Cloud Confidential VM 2020年 と同時期だがAWSはConcept発表は2019年で 業界初Hyperscaler) ・Goldman Sachs (Banking Confidential Compute) / Pfizer (Pharmaceutical Research Confidential) / Aetna (Healthcare PII Confidential) 等のFortune 100企業の Confidential workload主軸platform。
主な特徴・仕組み
- Architecture: Hypervisor-based Custom TEE (Intel TDX / AMD SEV-SNP / Arm CCA とは別 Approach)
- Enclave Isolation: CPU + Memory完全分離・Network attached禁止 (NIC無 + Internet access無)・Persistent Storage禁止 (EBS / S3 / EFS無)
- Parent EC2 Communication: vsock (Linux Kernel Virtual Socket・Hypervisor-level通信channel) のみ・TCP/IP / HTTP / FileSystem経由通信全Block
- Resource Reservation: Enclave起動時 Parent EC2のCPU + Memory reserve (1-100% range可能)
- Attestation: AWS Cryptographic Attestation document (PEM format) + AWS KMS Attestation API integration
- AWS KMS Integration: Attestation-based Key release (KMS key release只Attestation passed Enclaveに対し)
- Supported Instances: C5 / C5d / M5 / M5d / R5 / R5d / Z1d (2019年初期) → 2024年Q4全Major EC2 instance type対応
- Compliance: PCI DSS Level 1 / HIPAA BAA / FedRAMP High / ISO 27001 / SOC 2 Type II / GDPR
- Pricing: 追加料金無 (Parent EC2 instance pricing 内含・Enclave reservation の CPU/Memory分のCostのみ)
- OS Support: Amazon Linux 2 / RHEL 8 / Ubuntu 20.04+ Enclave SDK提供
スペック比較表
| Cloud Confidential Computing | Vendor | TEE Architecture | Communication | Compliance |
|---|---|---|---|---|
| AWS Nitro Enclave | AWS | Hypervisor-based (独自) | vsock only | PCI DSS / HIPAA / FedRAMP High |
| Azure Confidential VM | Microsoft | CPU TEE (TDX/SEV-SNP/CCA) | Standard Network | FedRAMP/HIPAA/PCI DSS |
| GCP Confidential VM | CPU TEE (SEV/SNP/TDX) | Standard Network | FedRAMP/HIPAA/PCI DSS | |
| Oracle Cloud Confidential VM | Oracle | CPU TEE (SEV-SNP) | Standard Network | FedRAMP/HIPAA |
| Alibaba Cloud Confidential VM | Alibaba | CPU TEE (SGX/TDX) | Standard Network | China Compliance主軸 |
具体例・対応製品
- AWS Nitro Enclave (CLI + SDK): Open Source SDK・GitHub aws/aws-nitro-enclaves-cli・Python/Rust/C/Go対応
- Goldman Sachs Banking workload: Trading algorithm Confidential execution・$1B+ asset trading Confidential
- Pfizer Pharmaceutical Research: COVID-19 vaccine研究 Confidential AI model training
- Aetna Healthcare PII: HIPAA PHI (Protected Health Information) Confidential data processing
- 競合 Azure Confidential VM: Standard CPU TEE Architecture・Network attached可能 (Confidential Network )
自作PCでの選び方・注意点
AWS Nitro Enclave は「AWS Ecosystem 深い統合 (Existing AWS EC2 / KMS / IAM / S3 / VPC顧客)」「Custom TEE Architecture Trust model (Hypervisor-based・Hardware CPU TEE不要)」「PCI DSS Level 1 + HIPAA BAA + FedRAMP High 同時要件 (Hyperscaler 最初期Confidential Computing成熟度)」用途の本命Cloud Confidential Computing service。Goldman Sachs (Banking algo trading) / Pfizer (Pharmaceutical research) / Aetna (Healthcare PII) 等のFortune 100企業 main deployment実績で 2019年Concept発表以来 最長Track Record・AWS KMS Attestation Integration が深く・Cloud Native Application (AWS ecosystem deep depend) には最適。一方Network attached禁止 (Internet access無) + Persistent Storage禁止 (EBS / S3 access無) の strict isolation 制約はAzure Confidential VM / GCP Confidential VMの Standard CPU TEE Architecture (Network attached可能) に比べ Application architecture rewrite を要求・既存Network-dependent Application のLift & Shift Confidential化は不可能で Application Code rewrite + vsock-based Architecture 設計が必要。Architecture redesign tolerable な Net new Confidential Application で AWS Nitro Enclave優位・既存 application as-is移行 で Azure / GCP Confidential VM (Standard Network attached可能) 選択肢。
関連用語との違い
- vs Azure Confidential VM: AWS NitroはHypervisor-based + Network禁止・AzureはCPU TEE (TDX/SEV-SNP/CCA) + Network attached
- vs GCP Confidential VM: AWS NitroはHypervisor-based + Goldman Sachs等 Banking实绩・GCPはCPU TEE + Confidential Space (Multi-party)
- vs Intel TDX (CPU TEE): Nitro EnclaveはHypervisor-based Software-level isolation・TDXはHardware CPU-level Encryption + Memory protection
よくある質問（FAQ）
Q1: Network attached禁止は厳しい制約？ A: 厳しい制約だが Trust modelの根本設計・Network access可能ならExternal AttackerからのRemote attack vector残るため Strict isolation で Confidentiality最大化。Parent EC2が vsock経由Enclaveにdata送信・Result受信のpattern で workflow設計必要。
Q2: AWS Nitro Enclave vs Standard CPU TEE どちらを選ぶ？ A: AWS Ecosystem (EC2/KMS/IAM/S3/VPC全部AWS) + Net new Confidential application architecture rewrite tolerable な場合 AWS Nitro Enclave。Multi-cloud / Existing Application Lift-and-Shift Confidential化 / Network access必須Workload は Azure Confidential VM / GCP Confidential VM (Standard CPU TEE) 推奨。
Q3: Pricing structure は？ A: AWS Nitro Enclave 追加料金無・Parent EC2 instance hourly price内含・Enclave起動時にParent EC2 のCPU/Memory分のreservation cost のみ (例: 4 vCPU / 8GB RAM EC2の50% reservationでEnclaveを起動 = Parent EC2 50% remaining Capacityのみ通常workload使用可能)。
まとめ
AWS Nitro Enclave = 2019年AWS発表のHypervisor-based Custom TEE Architecture。EC2 Instance内Isolated Enclave (Network/Storage禁止) + vsock通信 + KMS Attestation統合・Hardware CPU TEE不要のHypervisor-based独自Approach・Goldman Sachs/Pfizer/Aetna等Fortune 100 deploy・PCI DSS/HIPAA/FedRAMP High対応Hyperscaler Confidential Computing先駆者。