Core concept
Enclave has no network, no persistent storage, no interactive access. Only communicates with parent via vsock.
Advertisement
How it works
Attestation doc signed by AWS proves running specific enclave measurement. Send secrets only after verifying.
Advertisement
Trade-offs + gotchas
Key management. Handling regulated data. Multi-party computation. Blockchain signing. Anywhere untrusted-host protection matters.