Microsoft has expanded its confidential computing offering and now allows Azure cloud computing service customers to create hardware isolated virtual machines (aka confidential VMs) with Ephemeral OS disks.
With this new public preview feature, Azure customers can create ephemeral OS disks only on the local VM storage (on VM cache or VM temp disk), thus ensuring that data remains 100% confidential since it will never be sent to remote Azure Storage.
“Ephemeral OS disks work well for stateless workloads, where applications are tolerant of individual VM failures but are more affected by VM deployment time or reimaging of individual VM instances,” Microsoft explains.
“With Ephemeral OS disk, you get lower read/write latency to the OS disk and faster VM reimage.”
This allows customers to benefit from Azure hardware-based trusted execution environments (TEEs) to protect their data while being processed from outside access.
Data in TEEs cannot be accessed or tampered with by code outside TEE environments because they’re designed to enforce the execution of only authorized code.
Available for free in all Azure regions
Microsoft says ephemeral disks are supported by Marketplace, custom images, and Azure Compute Gallery (formerly Shared Image Gallery).
Other key features include fast reset or reimage VMs and scale set instances to the original boot state, lower latency (similar to temporary disks), and stateless application support.
Ephemeral disks are free and, just as persistent OS disks, they’re also available in all Azure regions (in public preview for confidential virtual machines).
However, unlike persistent ones, the OS disk data will not be preserved when resizing, redeploying, healing, live migrating, or restarting the virtual machines.
Azure customers who decide to use confidential VMs with ephemeral OS disks should know that they also come with a list of unsupported features, including capturing VM images, disk snapshots, Azure Disk Encryption, Azure Backup, Azure Site Recovery, and OS Disk Swap.
“As part of our commitment to delivering the best possible value for Azure confidential computing, we’re announcing the support to create confidential VMs using Ephemeral OS disks,” the Azure team announced Tuesday.
“This enables customers using stateless workloads to benefit from the trusted execution environments (TEEs). Trusted execution environments protect data being processed from access outside the trusted execution environments.”
Source: www.bleepingcomputer.com