Comment by otterley

> It's not actually in their interest to look too closely. They know they are selling snake oil, and they do not care if it works.

I can tell you from direct experience on the inside at AWS that they care tremendously about virtualization security.

It's why they never let two tenants share a physical core simultaneously; they were prepared against side-channel attacks before Spectre and Meltdown were discovered.

It's why they never supported Intel SGX, preferring instead to sequester processors for confidential workloads (Nitro Enclaves), and why modern EC2 instances support memory encryption (Graviton + AMD SEV-SNP).

It's why, when you improperly remove a chassis from its cabinet, a mechanism destroys a key component containing the machine's attestation and encryption keys, rendering it useless.

It's why they delegated a large amount of security surface, including practically all I/O functions, to their off-CPU Nitro card.