AWS发布Nitro Enclave，可独立于EC2环境处理保密数据

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"AWS最近发布可以独立于EC2环境处理保密数据的Nitro Enclave。基于轻量级Linux操作系统的Nitro Enclave是一种经过强化和验证的高度受限的虚拟机。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"新的服务没有使用持久存储，没有使用管理员访问权限，并创建了一个额外的隔离，以进一步保护EC2实例中的高敏感数据，并减少敏感数据的受攻击面积。AWS首席布道官Jeff Barr描述了主要的用例："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"text","text":"金融服务、国防、媒体和娱乐以及生命科学等各业的AWS客户通常会在AWS上处理高敏感数据，他们需要保护它们免受来自内部和外部的威胁，需要处理复杂的情况，包括多个相互不信任的合作伙伴、供应商、客户和员工。如今，他们使用VPC创建高度隔离的环境，这些环境具有受控的有限连接，只能由一组受限制的用户访问。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"客户可以使用这个新功能将数据从更大的通用操作系统环境中分离到独立的执行环境中。AWS并不是唯一提供受保护虚拟机的云供应商：Azure也提供了基于硬件的"},{"type":"link","attrs":{"href":"https:\/\/azure.microsoft.com\/en-us\/solutions\/confidential-compute\/","title":"","type":null},"content":[{"type":"text","text":"可信任执行环境"}]},{"type":"text","text":"(TEE)，而谷歌云最近也宣布了其"},{"type":"link","attrs":{"href":"https:\/\/cloud.google.com\/blog\/products\/identity-security\/introducing-google-cloud-confidential-computing-with-confidential-vms","title":"","type":null},"content":[{"type":"text","text":"保密虚拟机特性"}]},{"type":"text","text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"GrowthOps云工程师及AWS社区开发者Richard Fan写了一篇关于如何在AWS Nitro Enclaves上运行Python应用程序的文章，并总结了这个新特性是如何工作的："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"text","text":"AWS Nitro Enclave是和EC2实例一起运行的独立环境。它使用来自EC2实例的CPU和内存资源，但与Hypervisor级别的实例是隔离的，因此你的实例即使在操作系统级别也不能访问Enclave。与Enclave通信的唯一方式是通过vsock通道。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"他在"},{"type":"link","attrs":{"href":"https:\/\/github.com\/richardfan1126\/nitro-enclave-python-demo","title":"","type":null},"content":[{"type":"text","text":"GitHub"}]},{"type":"text","text":"上创建了一个项目，演示如何使用Python套接字包在EC2实例和Nitro Enclave之间建立通信，并使用代理从Enclave内部进行HTTPS调用。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.infoq.cn\/resource\/image\/8c\/71\/8c85f1196e5a712ca3e5625a85022371.png","alt":null,"title":"","style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":"","fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图片来源："},{"type":"link","attrs":{"href":"https:\/\/aws.amazon.com\/blogs\/aws\/aws-nitro-enclaves-isolated-ec2-environments-to-process-confidential-data\/","title":"","type":null},"content":[{"type":"text","text":"https:\/\/aws.amazon.com\/blogs\/aws\/aws-nitro-enclaves-isolated-ec2-environments-to-process-confidential-data\/"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"CoinText首席技术官Vin Armani认为可能可以在数字货币采用这种新功能："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"text","text":"这些新的AWS Nitro Enclave很有趣。我猜想它们在加密货币交易方面将变得非常流行。这似乎是服务器提供简单分类帐邮资协议（Simple Ledger Postage Protocol）和SWaP协议服务的一个完美的工具。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"另一份"},{"type":"link","attrs":{"href":"https:\/\/aws.amazon.com\/about-aws\/whats-new\/2020\/10\/announcing-aws-certificate-manager-for-nitro-enclaves\/","title":"","type":null},"content":[{"type":"text","text":"公告"}]},{"type":"text","text":"表示，AWS证书管理器可以通过Nitro Enclave支持EC2的TLS主机终止连接。这样就可以对运行在EC2实例上的Web应用程序和Web服务器使用免费的公有和私有SSL\/TLS证书。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"一些限制：用于Nitro Enclave的ACM目前只支持与NGINX集成的证书安装和证书过期替换。"},{"type":"link","attrs":{"href":"https:\/\/aws.amazon.com\/ec2\/nitro\/nitro-enclaves\/","title":"","type":null},"content":[{"type":"text","text":"Nitro Enclave"}]},{"type":"text","text":"目前只支持英特尔和AMD的处理器，最小的可用实例是m5a.xlarge。每个EC2实例只支持单独的加固环境。新服务不需要额外的费用，但父实例需要付费。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"原文链接"},{"type":"text","text":"："},{"type":"link","attrs":{"href":"https:\/\/www.infoq.com\/news\/2020\/11\/aws-nitro-enclaves\/","title":"","type":null},"content":[{"type":"text","text":"AWS Introduces Nitro Enclaves, Isolated EC2 Environments for Confidential Computing"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}