Two products share the word "confidential" and protect different things. A Nitro Enclave isolates a slice of vCPUs and memory from its parent EC2 instance. A confidential GPU puts the accelerator itself inside a hardware trust boundary. Neither claim about the other is fair unless the boundary is drawn first, so this page draws it from AWS’s own documentation.
AWS describes Nitro Enclaves as "separate, hardened, and highly-constrained virtual machines" created from an EC2 instance. They "provide only secure local socket connectivity with their parent instance" and "have no persistent storage, interactive access, or external networking". The Nitro Hypervisor isolates the enclave’s vCPUs and memory from the parent, the feature is processor agnostic (Intel, AMD, Graviton), attestation produces an AWS-signed document that AWS KMS can require in a key policy, and there is no extra charge beyond the parent instance.
What is not in that description is a device. An enclave receives vCPUs and memory; the GPU of a p5 instance stays with the parent, so the tensors that cross PCIe into GPU memory are outside the enclave. That is not a flaw in Nitro Enclaves; it is what they are. And on 12 September 2026 we found no NVIDIA Confidential Computing SKU in AWS documentation. If that changes, this page changes.
On a confidential GPU setup, a CPU trust domain (Intel TDX at VoltageGPU and Google Cloud, AMD SEV-SNP on Azure’s GPU series) encrypts the VM’s memory against the host, and NVIDIA Confidential Computing on a Hopper GPU protects the accelerator and its link to the VM, with the GPU producing its own attestation report on a nonce the tenant chooses. Two proofs, two roots (Intel or AMD, and NVIDIA), and the cloud in neither trust path.
VoltageGPU’s own limits, since we ask AWS to be precise: both proofs are verified on our single-GPU H200 VM (CC State ON, 4 September 2026) and per GPU on the 8x H100 node in Protected PCIe mode (10 September 2026, NVSwitch not attested); the 8x H200 node has not been attested yet, the RTX 6000B VM runs with GPU CC off, and containers have no tenant-side GPU attestation.
| Criterion | VoltageGPU | AWS Nitro Enclaves |
|---|---|---|
| Trusted execution environment | Intel TDX trust domain on every tier | Nitro Enclave: an isolated VM carved from a parent EC2 instance (vCPUs and memory only), no persistent storage, no networking, no interactive access; processor agnostic |
| GPU inside the trust boundary | Single-GPU H200 VM; 8x H100 and 8x H200 nodes; RTX 6000B VM; H100, H200 and B200 containers | No GPU inside an enclave. GPU instances such as p5 exist, but the GPU sits outside the enclave boundary |
| NVIDIA Confidential Computing | CC State ON on the single-GPU H200 VM (NVIDIA attestation verified by us on 4 Sept 2026). 8-GPU nodes run NVIDIA Protected PCIe mode: all eight H100 attested on 10 Sept 2026, NVSwitch not attested, 8x H200 not yet run. RTX 6000B VM: GPU CC off. Containers: no tenant-side GPU attestation. | No NVIDIA Confidential Computing SKU found in AWS documentation on 12 September 2026 |
| PCIe protection | CPU to GPU path protected by NVIDIA Confidential Computing on the H200 VM; per-GPU protection in Protected PCIe mode on 8-GPU nodes | Not applicable: the accelerator is not part of the enclave |
| Attestation root | Intel SGX Root CA (DCAP) for the TDX quote, NVIDIA NRAS for the GPU report | AWS-signed Nitro attestation document, integrated with AWS KMS key policies |
| Tenant-side verification | Yes, from inside your VM: /dev/tdx_guest and configfs TSM, your own report_data and nonce, offline DCAP check, NVIDIA report on your nonce. voltage-verify (open source) binds both proofs to a workload manifest. | For the enclave, yes (attestation document). For a GPU, there is no GPU TEE to verify. |
| H100 | $5.00/hr container; $6.95/hr single-GPU VM (attestation not yet verified on that VM) | Not applicable for confidential GPU; p5 H100 instances run the GPU outside any enclave |
| H200 | $8.08/hr single-GPU VM (both proofs verified); $6.58/hr container; 8x H200 VM $64.62/hr | Not applicable |
| Operator and jurisdiction | EU (French company, EU law); sub-processors listed on /trust/subprocessors | US company; EU regions available under Standard Contractual Clauses |
| Billing | One hour prepaid at deploy, then per second; the unused remainder is refunded when you stop | Per-second EC2 billing on the parent instance |
| Compliance paperwork | GDPR Art. 28 DPA; HIPAA technical safeguards by architecture, no BAA yet (planned after SOC 2 Type I); SOC 2 not yet held | AWS signs HIPAA BAAs and holds SOC 2 and ISO certifications at the platform level |
Sources, AWS: AWS docs, what is Nitro Enclaves. VoltageGPU: the two proofs, with the raw outputs, live prices on /pricing.
Keep Nitro Enclaves for what they were built for: holding keys, signing, decrypting a payload next to an AWS workload, running a small deterministic verifier whose measurements a KMS key policy can pin. If your model runs on a GPU and the requirement is that the operator cannot read the weights or the prompts, that requirement is not met by an enclave next to the GPU, on AWS or anywhere else. It is met by a confidential GPU, and today that means Azure, Google Cloud or VoltageGPU, each with the limits stated on the four-cloud matrix.
No. AWS describes a Nitro Enclave as a separate, hardened, highly constrained virtual machine created from a parent EC2 instance, with vCPUs and memory isolated by the Nitro Hypervisor, no persistent storage, no interactive access and no external networking, only a local socket to the parent. A GPU attached to a p5 instance belongs to the parent, outside the enclave boundary.
We found no NVIDIA Confidential Computing SKU in AWS documentation on 12 September 2026. Azure (NCC H100 v5, AMD SEV-SNP) and Google Cloud (A3 High, Intel TDX) both do, and VoltageGPU runs it on its single-GPU H200 VM and its 8x H100 node. If AWS publishes one, this page will be updated with the date.
Key custody, signing, decrypting a payload next to an AWS workload, small deterministic verifiers: anything that fits in CPU memory and benefits from an attestation document that AWS KMS can enforce in a key policy. That is a real and useful product. It is not a way to run a language model on a GPU without the host seeing the tensors.
They serve the same purpose for different boundaries and different roots. The Nitro attestation document is signed by AWS and describes the enclave; an Intel TDX quote is signed through Intel-provisioned keys and describes a trust domain, and can be re-verified offline against Intel's collateral without asking the cloud. A policy that requires Intel- or AMD-rooted evidence, plus NVIDIA-signed GPU claims, cannot be satisfied with a Nitro document alone.
Deploy a Confidential VM, read the GPU’s confidential-computing state with nvidia-smi, generate both proofs on your own nonce, and verify them offline with the open-source CLI.