How RN protects AI API keys with KMS and Nitro Enclaves

The provider key stays in the vault

Rota Nacional uses AWS Nitro Enclaves to separate AI credentials from the public application. The vault opens the credential and configures the provider transport inside that boundary. The application receives a scoped operation, with no operation to export the registered key.

Each credential has an encrypted envelope. AWS Key Management Service, or KMS, protects its data key. The authenticated context binds the product, organization, record, provider and destination. Moving ciphertext to another organization or destination does not grant access.

Authorization depends on measured code

KMS requires enclave attestation. This document identifies the code measurement that started inside the protected boundary. The policy permits the approved image and refuses operations without its measurement. The cryptographic root remains in KMS.

The application uses specific operations for inference, storage and authentication. It receives neither the legacy master key nor AWS administrative credentials. KMS calls have bounded concurrency and a cumulative allowance. Restarting the service does not reset that allowance.

Certificates and disk have separate controls

Certificates for the main domain and the platform API use AWS Certificate Manager with export disabled. Private-key operations occur in the TLS enclave. Nginx receives their results, without a PEM file containing a core private key.

Docker, databases, configuration and operational files reside on the LUKS-protected volume. Opening it requires the owner's action. A machine boot leaves the environment closed until that authorization. Transient operational material resides in memory.

The core DNS CAA record permits Amazon certificate issuance. Customer domains retain their own certificates and identities. A separate domain does not mean a dedicated machine. DNSSEC also requires the DS record at the registrar; signing a zone alone does not complete that chain.

A failed control closes access

The supervisor monitors the vault and critical processes. A persistent failure closes public admission and requires manual startup. The failure routine attempts to notify the owner through the alert channel. The external availability monitor remains separate.

Backups are encrypted before upload. Recovery uses a temporary owner authorization for the specific file. The server role cannot delete backups or historical object versions.

The limits of this design

The browser and application receive content needed for the task. Nginx terminates HTTPS. The database processes its data. Credential registration also passes through memory before it becomes an envelope. Protecting provider keys does not make these components immune to defects.

The privacy barrier and external-processing consent remain organization policies. Organization recording controls are available in Bots; other routes still use the global audit control and applicable retention period. An enclave does not replace these decisions or prevent a provider from receiving authorized content.

Frequently asked questions