Azure Confidential VMs
Hardware boundaries for high-security workloads
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: Azure Security | Cloud Security Architecture
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AWS was the frontrunner for many of the innovative cloud security features we use today. However, Azure was the first cloud provider to advertise use of a trusted execution environment (TEE) and confidential computing. Perhaps AWS use or Google used something like it under the hood for some operations but it was not advertised as a feature or service when I searched for those terms when I originally wrote my own cloud security class.
I already wrote a lengthy post on TPMs, TEEs, and Enclaves in cloud environments and why you might want to use these features in the following post, and many of these concepts are applicable to any cloud environment (whether they have the feature or not):
I explained in prior posts how I was trying to create and store credentials, and how I wanted to keep them private. The prior posts show some bad ideas and solutions, how data is kept around in memory on Linux systems. Then I explain how a trusted enclave, TEE, or confidential computing environment (pick your favorite term) can help you protect your sensitive data while in use.
The challenge is that while data is in use it must be unencrypted at some point in order to be useful — otherwise your application cannot process it. While it is in use, an attacker might be able to get into system memory to get encryption keys or access the unencrypted data at that point.
Azure is now offering something they call Confidential VMs. In order to use a confidential VM, you’ll need to choose:
- A confidential VM instance type
- An operating system supported by Azure Confidential VMs
- A region where Azure Confidential VMs are currently available.
Hardware Segregation: Confidential VMs offer hardware isolation between virtual machines, host operating systems, and host management code. That presumably means that the code for each architectural component resides on a specific piece of hardware that the other components cannot access.
This sounds like the hardware isolation provided by AWS Nitro System in my above post on this topic but maybe takes it a step further. The AWS Nitro System provides hardware segregation between customer VMs. AWS has had that functionality for a while now, if it is really the same thing. Note that I am talking about the AWS Nitro System, not AWS Nitro Enclaves in comparison to Azure Confidential VMs. I am also not sure without doing more research whether the OS and hypervisor isolation exists on AWS.
If it is an apples to apples comparison, AWS has a lot more instance type options (see the section on Nitro):
AWS Nitro has supported Windows since 2021:
I’m sure Microsoft is working diligently to catch up and more will be available soon.
Other features offered by Azure Confidential VMs:
Attestation: Azure Confidential VMs offer some of the same functionality I covered for AWS Nitro VMS including attestation. This functionality will check to make sure your machine is legitimate and configured correctly, though you should explore this more in detail if you are counting on it.
Disk Encryption: Azure confidential VMs also offer cloud-based confidential disk encryption before the first boot, so presumably the entire operating system and boot disk is encrypted.
Dedicated TPM: With an Azure confidential VM it looks like you get a dedicated TPM. I guess without an Azure confidential VM your secrets in a TPM are shared with other VMs on the same host managed by the same hypervisor but it doesn’t really say in the link I provided. I explained what a TPM is in my prior post.
Secure Boot: You can also get the secure boot feature similar to what you get with trusted launch azure VMs.
Immutable Activity Logs: According to the video on confidential computing options below activity logs in a confidential computing environment are immutable and auditable.
Caveats and Considerations
VMs with Azure confidential disk encryption will cost more because the data cannot be compressed when encrypted. As I explain in class, encrypted data takes up more space.
https://azure.microsoft.com/en-us/pricing/details/managed-disks/
It will also likely take longer to create a Confidential VM, so test and make sure the timing meets your use case, or consider alternate architectures for high-availability with confidential VMs.
At the time of this writing Azure Confidential VMs do not work with the following services, but check the documentation if reading at a later date.
- Azure Batch
- Azure Backup
- Azure Site Recovery
- Azure Dedicated Host
- Microsoft Azure Virtual Machine Scale Sets with Confidential OS disk encryption enabled
- Limited Azure Compute Gallery support
- Shared disks
- Ultra disks
- Accelerated Networking
- Live migration
You can also learn more about Azure Confidential VMs in this video: