azure-confidential-computing

Name: azure-confidential-computing
Author: vinayaklatthe

161stars34forks

How to install azure-confidential-computing?

vinayaklatthe/microsoft-security-skills/azure-confidential-computing

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-confidential-computing

Installs into the current project.

Summary

Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs). Covers Confidential VMs (AMD SEV-SNP, Intel TDX), Confidential containers on AKS (Kata + AMD SEV-SNP), confidential GPU VMs (NVIDIA H100 with TDX), Azu

Files · 1

View on GitHub

SKILL.md

1	# Azure Confidential Computing
2
3	Confidential computing is the third pillar of data protection — data in use —
4	complementing encryption at rest and in transit. Azure Confidential Computing uses
5	hardware-based Trusted Execution Environments (TEEs) so workloads run on encrypted
6	memory the host (and Microsoft) cannot inspect, with cryptographic attestation to
7	prove the TEE state to a remote relying party before secrets are released.
8
9	## When to use
10	- Multi-party data collaboration where parties must compute on each other's data
11	without seeing it (clean rooms, fraud consortia, joint analytics).
12	- Regulated workloads requiring isolation from cloud operator access (defense, certain
13	financial / healthcare scenarios).
14	- Sensitive AI training/inference where model weights or training data are crown
15	jewels.
16	- Cryptographic operations that must be hardware-rooted with attestation evidence.
17
18	Do not use this skill for ordinary data-at-rest CMK (`azure-key-vault`), generic app
19	encryption, or non-Azure TEE / Intel SGX-only designs.
20
21	## Form factors
22
23	\| Form factor \| Hardware \| Best for \|
24	\|---\|---\|---\|
25	\| Confidential VMs (DCasv5/ECasv5) \| AMD SEV-SNP \| Lift-and-shift Linux/Windows workloads with whole-VM TEE \|
26	\| Confidential VMs (DCesv5/ECesv5) \| Intel TDX \| Trust-domain isolation for VMs \|
27	\| Confidential containers on AKS \| Kata Containers + AMD SEV-SNP \| Container workloads, per-pod TEE \|
28	\| Confidential GPU VMs (NCC H100 v5) \| NVIDIA H100 + Intel TDX \| Confidential AI training/inference \|
29	\| App-enclave (Intel SGX, DCsv2/3) \| Intel SGX \| Targeted enclaves; legacy pattern, less common in new builds \|
30	\| Azure Confidential Ledger \| Hardware-backed append-only ledger \| Tamper-evident audit logs \|
31
32	## Approach
33
34	1. Validate the threat model. Confidential computing protects against:
35	- Cloud operator (host admin) memory inspection.
36	- Co-tenant side-channel reads (within hardware mitigation limits).
37	- Snapshot/disk-image exfiltration combined with memory dump.
38	It does not protect against application bugs, supply-chain compromise of your
39	own code, or insider access at the customer.
40
41	2. Pick the right form factor.
42	- Existing VM workload moving sensitive without code changes → **Confidential VM
43	(SEV-SNP)** is the easiest lift.
44	- K8s cluster with mixed sensitivity → Confidential containers on AKS, scoping
45	pods that need TEE.
46	- Confidential GPU (LLM training/inference on sensitive data) → NCC H100 v5.
47	- Multi-party computation with secret protocol → enclave-aware code with SGX (only
48	where you need finer-grained TEE than whole-VM).
49
50	3. Stand up Microsoft Azure Attestation. The MAA service issues signed attestation
51	tokens describing the TEE state (CPU model, firmware version, security version).
52	Relying parties (your apps, Key Vault) verify these tokens before trusting the
53	workload.
54
55	4. Wire secure key release (SKR). Azure Key Vault Premium / Managed HSM supports
56	key-release policies that gate `release` operations on a verified MAA token. The
57	workflow:
58	1. Confidential workload requests an attestation from MAA.
59	2. Workload presents the token to Key Vault.
60	3. Key Vault validates against the configured policy (allowed TEE type, firmware
61	version, owner identity).
62	4. Key is released into the TEE memory.
63	This is the foundation for "even Microsoft cannot read this key — only the right
64	workload running on the right hardware can use it."
65
66	5. Confidential containers on AKS — use the Confidential Container add-on.
67	Configure pod security with attestation-aware init containers; sensitive secrets
68	pulled via SKR after pod attestation.
69
70	6. Confidential AI patterns. Two common shapes:
71	- Confidential inference: model weights remain encrypted on disk; loaded into

People who liked this also viewed

6 picks

Type

azure-confidential-computing

161stars34forks

View on GitHub

How to install azure-confidential-computing?

vinayaklatthe/microsoft-security-skills/azure-confidential-computing

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-confidential-computing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Confidential Computing
2
3	Confidential computing is the third pillar of data protection — data in use —
4	complementing encryption at rest and in transit. Azure Confidential Computing uses
5	hardware-based Trusted Execution Environments (TEEs) so workloads run on encrypted
6	memory the host (and Microsoft) cannot inspect, with cryptographic attestation to
7	prove the TEE state to a remote relying party before secrets are released.
8
9	## When to use
10	- Multi-party data collaboration where parties must compute on each other's data
11	without seeing it (clean rooms, fraud consortia, joint analytics).
12	- Regulated workloads requiring isolation from cloud operator access (defense, certain
13	financial / healthcare scenarios).
14	- Sensitive AI training/inference where model weights or training data are crown
15	jewels.
16	- Cryptographic operations that must be hardware-rooted with attestation evidence.
17
18	Do not use this skill for ordinary data-at-rest CMK (`azure-key-vault`), generic app
19	encryption, or non-Azure TEE / Intel SGX-only designs.
20
21	## Form factors
22
23	\| Form factor \| Hardware \| Best for \|
24	\|---\|---\|---\|
25	\| Confidential VMs (DCasv5/ECasv5) \| AMD SEV-SNP \| Lift-and-shift Linux/Windows workloads with whole-VM TEE \|
26	\| Confidential VMs (DCesv5/ECesv5) \| Intel TDX \| Trust-domain isolation for VMs \|
27	\| Confidential containers on AKS \| Kata Containers + AMD SEV-SNP \| Container workloads, per-pod TEE \|
28	\| Confidential GPU VMs (NCC H100 v5) \| NVIDIA H100 + Intel TDX \| Confidential AI training/inference \|
29	\| App-enclave (Intel SGX, DCsv2/3) \| Intel SGX \| Targeted enclaves; legacy pattern, less common in new builds \|
30	\| Azure Confidential Ledger \| Hardware-backed append-only ledger \| Tamper-evident audit logs \|
31
32	## Approach
33
34	1. Validate the threat model. Confidential computing protects against:
35	- Cloud operator (host admin) memory inspection.
36	- Co-tenant side-channel reads (within hardware mitigation limits).
37	- Snapshot/disk-image exfiltration combined with memory dump.
38	It does not protect against application bugs, supply-chain compromise of your
39	own code, or insider access at the customer.
40
41	2. Pick the right form factor.
42	- Existing VM workload moving sensitive without code changes → **Confidential VM
43	(SEV-SNP)** is the easiest lift.
44	- K8s cluster with mixed sensitivity → Confidential containers on AKS, scoping
45	pods that need TEE.
46	- Confidential GPU (LLM training/inference on sensitive data) → NCC H100 v5.
47	- Multi-party computation with secret protocol → enclave-aware code with SGX (only
48	where you need finer-grained TEE than whole-VM).
49
50	3. Stand up Microsoft Azure Attestation. The MAA service issues signed attestation
51	tokens describing the TEE state (CPU model, firmware version, security version).
52	Relying parties (your apps, Key Vault) verify these tokens before trusting the
53	workload.
54
55	4. Wire secure key release (SKR). Azure Key Vault Premium / Managed HSM supports
56	key-release policies that gate `release` operations on a verified MAA token. The
57	workflow:
58	1. Confidential workload requests an attestation from MAA.
59	2. Workload presents the token to Key Vault.
60	3. Key Vault validates against the configured policy (allowed TEE type, firmware
61	version, owner identity).
62	4. Key is released into the TEE memory.
63	This is the foundation for "even Microsoft cannot read this key — only the right
64	workload running on the right hardware can use it."
65
66	5. Confidential containers on AKS — use the Confidential Container add-on.
67	Configure pod security with attestation-aware init containers; sensitive secrets
68	pulled via SKR after pod attestation.
69
70	6. Confidential AI patterns. Two common shapes:
71	- Confidential inference: model weights remain encrypted on disk; loaded into

People who liked this also viewed

6 picks

Type