GCP Confidential Computing Guide (2026)

Confidential Computing encrypts the memory of running VMs and containers, delivering "data-in-use" encryption. Together with data-at-rest and data-in-transit encryption, it completes the three-layer encryption story — a key building block for regulated industries and Multi-party Computation.

The 3 Encryption Layers

Layer	Traditional	Confidential Computing
Data at Rest	CMEK / HSM / EKM	Same
Data in Transit	TLS	Same
Data in Use	—	Confidential Computing

GCP Confidential Computing Products

Product	Target	Use case
Confidential VM	GCE	Per-VM workloads
Confidential GKE Nodes	GKE	Kubernetes clusters
Confidential Space	Multi-party	Federated learning, ad measurement
Confidential Spanner	Spanner (GA in 2024)	Finance and healthcare DBs
Confidential Dataflow	Dataflow	Confidential data pipelines

Underlying CPU Features

Feature	Vendor	GCP machine
AMD SEV	AMD	N2D / C2D (1st gen)
AMD SEV-SNP	AMD	N2D / C3D (extended)
Intel TDX	Intel	C3 (2024 onwards)
NVIDIA H100 TEE	NVIDIA	A3 (confidential GPU)

Creating a Confidential VM

gcloud compute instances create confidential-vm \
  --zone=asia-northeast1-a \
  --machine-type=n2d-standard-2 \
  --confidential-compute \
  --maintenance-policy=TERMINATE \
  --image-family=ubuntu-2204-lts \
  --image-project=ubuntu-os-cloud

# Confidential VM の確認
gcloud compute instances describe confidential-vm \
  --zone=asia-northeast1-a --format="value(confidentialInstanceConfig)"

Confidential GKE Nodes

gcloud container clusters create confidential-cluster \
  --region=asia-northeast1 \
  --enable-confidential-nodes \
  --machine-type=n2d-standard-2 \
  --release-channel=stable

Confidential Space (Multi-party Computation)

Multiple organizations contribute data and analyze it jointly without exposing raw data to each other
Example: Bank A + Bank B + government → unified fraud-detection dataset
Example: Pharma A + B + C + hospitals → federated learning for drug discovery
Example: Ads: publishers + advertisers → measurement and attribution
Attestation proves that the workload is truly running in a confidential environment

Attestation Flow

At Confidential VM startup, AMD / Intel generates a measurement
A signed report is submitted to the Attestation Service
External parties (data providers) verify the report
Only on successful verification is the decryption key released to access the encrypted data

Pricing

Item	Price
Confidential VM	Standard VM + ~6% (N2D)
Confidential GKE Nodes	Follows the VM pricing
Confidential Space	VM + Attestation Service (free / limited)
Confidential Spanner	Standard PU + premium

Comparison with Other Clouds

Item	GCP	AWS	Azure
Confidential VM	AMD/Intel	Nitro Enclaves	AMD/Intel/Nitro equivalents
Confidential Container	Confidential GKE Nodes	Nitro on EKS	Confidential Container Apps
Multi-party MPC	Confidential Space (leading)	Limited	Limited
Confidential DB	Confidential Spanner	—	Always Encrypted with Secure Enclave

Typical Use Cases

Finance: industry-wide consortium analytics for fraud detection
Healthcare: hospital-consortium disease research (federated learning)
Advertising: clean rooms between publishers and advertisers
Government: confidential data processing (defense / intelligence)
IP protection: protecting both AI models and data simultaneously

What is Confidential Computing?

A technology that encrypts the memory of running VMs / containers themselves. Hardware features like AMD SEV-SNP and Intel TDX prevent the hypervisor, other tenants, and even Google itself from peeking at the data.

How much does Confidential VM cost?

Standard GCE pricing plus roughly 6%. Available on N2D / C2D / C3D / A3 and similar machines. Performance overhead is typically just a few percent.

What are Confidential GKE Nodes used for?

Kubernetes workloads in regulated industries such as finance and healthcare. Encryption is applied at the node level, not per pod.

What is Confidential Space?

A secure execution environment for Multi-party Computation. Multiple organizations can jointly analyze their data without exposing raw data to each other. Used for ad measurement and federated learning in healthcare.

How do other clouds compare?

AWS offers Nitro Enclaves (successor to SGX), and Azure Confidential Computing covers equivalents of AMD SEV-SNP / Intel TDX / Nitro Enclaves. GCP led on AMD SEV and is also rolling out Intel TDX support.

Is Attestation supported?

Yes — natively supported in Confidential Space. You can cryptographically prove that a workload is actually running in a confidential environment, which is essential for establishing trust with third parties.

Are BigQuery and Spanner supported too?

BigQuery supports it via Confidential VM-based reservations (Confidential Compute Enabled). Spanner has native support (GA in 2024).

What are real-world examples in regulated industries?

Adopted in finance (HSBC, Fidelity), healthcare (HCA Healthcare), and confidential data processing at several government agencies. Combining FIPS 140-2 with Confidential Computing is a common pattern.

Check what you learned with practice questions

Practice with certification-focused question sets

View GCP exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

Confidential Computing Complete Guide: Data-in-Use Encryption with Confidential VM / GKE / Space