Microsoft Azure now has confidential VMs with ephemeral storage
Microsoft has expanded its confidential computing offering and now allows Azure cloud computing service customers to create hardware isolated virtual machines (aka confidential VMs) with Ephemeral OS disks.
With this new public preview feature, Azure customers can create ephemeral OS disks only on the local VM storage (on VM cache or VM temp disk), thus ensuring that data remains 100% confidential since it will never be sent to remote Azure Storage.
"Ephemeral OS disks work well for stateless workloads, where applications are tolerant of individual VM failures but are more affected by VM deployment time or reimaging of individual VM instances," Microsoft explains.
"With Ephemeral OS disk, you get lower read/write latency to the OS disk and faster VM reimage."
This allows customers to benefit from Azure hardware-based trusted execution environments (TEEs) to protect their data while being processed from outside access.
Data in TEEs cannot be accessed or tampered with by code outside TEE environments because they're designed to enforce the execution of only authorized code.