Lessons learned from production confidential computing customer deployments
summary
Bank migration case shows MongoDB data encrypted with AWS KMS keys and processed only inside Nitro Enclaves, using attestation so only ODS nodes with the right measurements can decrypt. Operational lessons: implement attested boot-time secrets for TLS/API/db credentials, push logs to remote observability (Prometheus/Splunk/Datadog) and redact sensitive fields, automate performance tests to avoid VPC/network skew and repeated-result artifacts, and expect enclave overhead to be minimal once network topography and code fixes are applied.
AI-written summary · about
chapters (6)
related talks
09mAn introduction to Confidential Computing
45mConfidential Computing: Protecting Customer Data in the Cloud
40mProtecting Sensitive Data and Models for Machine Learning
24mSafeguarding Sensitive Data Access At Scale with Privacy-Enhancing Technologies
01h 00mBehind the scenes: AWS investments in security innovation
39mExplorations of cryptography research
24mConfidential Compute Architecture
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!