Microsoft now allows customers of its Azure cloud computing service to create hardware - isolated virtual machines , also known as confidential VMs, with Ephemeral OS disks
See also: Microsoft launches security defaults for Azure Active Directory (AD) users
With this new public preview feature, Azure customers can create ephemeral operating system disks only on local VM storage (on a VM cache or VM staging disk), ensuring that data remains 100% secure as it will never be sent to remote Azure storage.
“With Ephemeral OS disk, you get lower read/write latency to the OS disk and faster VM image replication.“
This allows customers to take advantage of Azure hardware-based trusted execution environments (TEEs) to protect their data during processing from external access.
Data in TEEs cannot be accessed or compromised by code outside of TEE environments because they are designed to enforce the execution of only authorized code.
See also: Microsoft: Patches for Azure flaw that allows RCE attacks
Microsoft says that ephemeral disks are supported by Marketplace, custom images, and Azure Compute Gallery.
Other key features include fast VM image restoration and scaling of definition instances to the original boot state, lower latency (similar to temporary disks), and stateless application support.
Ephemeral disks are free and, like persistent operating system, are also available in all Azure regions (in public preview for confidential virtual machines).
However, the operating system disk data will not be preserved when resizing, reorganizing, live migrating, or restarting virtual machines.
See also: New Phishing Uses Azure Static Websites to Impersonate Microsoft
Azure customers who decide to use confidential VMs with ephemeral OS disks should be aware that they also have a list of unsupported features, including VM image capture, disk snapshots, Azure disk encryption, Azure backup, Azure site recovery, and OS disk switching.
"As part of our commitment to delivering the best possible value for Azure confidential computing, we are announcing support for creating confidential VMs using Ephemeral OS disks," the Azure team announced Tuesday.
