AWS Nitro Enclaves

AWS Nitro Enclaves creates isolated, hardened virtual machines (enclaves) within an EC2 instance to securely process highly sensitive data.

Nitro Enclaves provides a Trusted Execution Environment (TEE) on EC2, partitioning dedicated vCPUs and memory from the parent instance using the Nitro Hypervisor. This isolated VM is highly constrained: it has no persistent storage, no external networking, and zero interactive access (no SSH). Even the parent instance's root user cannot access the enclave's data or processes. The core security feature is cryptographic attestation, which verifies the enclave's identity and confirms only authorized code is running. This attestation integrates directly with AWS KMS, ensuring only a validated enclave can decrypt and process sensitive material (e.g., PII, financial data, or encryption keys).

https://aws.amazon.com/ec2/nitro/nitro-enclaves/