Microsoft has expanded its confidential computing offering and is now allowing Azure cloud computing service customers to create hardware isolated virtual machines (aka confidential VMs) with Ephemeral OS disks.
Earlier in the News Google fixes new zero-day bug in Chrome browser
Azure confidential computing was first announced at Microsoft Ignite conference in 2017. These confidential VMs are designed for organizations that handle highly sensitive workloads in the cloud. Confidential VMs use hardware-protected encryption keys to ensure that customer data remains encrypted in memory, in transit (over a network), and at rest (in storage).
Microsoft said; “Ephemeral OS disks work well for stateless workloads, where applications are tolerant of individual VM failures but are more affected by VM deployment time or reimaging of individual VM instances.
“With Ephemeral OS disk, you get lower read/write latency to the OS disk and faster VM reimage,” it said.
This allows customers to benefit from Azure hardware-based trusted execution environments (TEEs) to protect their data while being processed from outside access.
Data in TEEs cannot be accessed or tampered with by code outside TEE environments because they’re designed to enforce the execution of only authorized code.
Microsoft says ephemeral disks are supported by Marketplace, custom images, and Azure Computer Gallery (formerly Shared Image Gallery).
See also MBAM components: How to deploy Microsoft BitLocker Administration and Monitoring Tool and Enable Azure Single Sign-On: Sign-in issues, non-routable domain, invalid username, and password for SSO solved
Other key features include fast reset or reimage VMs and scale set instances to the original boot state, lower latency (similar to temporary disks), and stateless application support.
Ephemeral disks are free and, just as persistent OS disks, they’re also available in all Azure regions (in public preview for confidential virtual machines).
However, unlike persistent ones, the OS disk data will not be preserved when resizing, redeploying, healing, live migrating, or restarting the virtual machines.
Azure customers who decide to use confidential VMs with ephemeral OS disks should know that they also come with a list of unsupported features, including capturing VM images, disk snapshots, Azure Disk Encryption, Azure Backup, Azure Site Recovery, and OS Disk Swap.