Multi-tenant secrets manager

A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:

• receiving, by a confidential container service from each tenant among a plurality of tenants, a request to provision a respective confidential container, which is tenant-specific;
• provisioning the respective confidential container using a multi-tenant trusted execution environment (TEE) attested resource provisioning process;
• receiving, from the tenant, tenant-specific security information comprising security procedures and cryptographic policies associated with the respective confidential container;
• storing the tenant-specific security information in a tenant-specific catalog;
• implementing, within the respective confidential container, the security procedures based on the tenant-specific catalog, such that the security procedures control access to tenant-specific confidential resources within the TEE during execution of a tenant workload, wherein the security procedures are implemented within the confidential container as part of the TEE attested resource provisioning process;
• upon successful authentication of the tenant, permitting access to the tenant-specific confidential resources in accordance with the security procedures specified in the tenant-specific catalog;
• wherein the security procedures implemented within the trusted execution environment are controlled by the tenant-specific catalog and isolated from other tenants and a service provider;
• and
• wherein the tenant-specific catalog comprises TEE resource discovery, provisioning and subscription licenses and resource shared policies, crypto algorithms, and crypto key policies that dynamically control a runtime behavior of the security procedures within the confidential container,
• wherein the tenant-specific security information comprises any one or more of:
• tenant id;
• tenant metadata;
• tenant service tag;
• or tenant security certificate,
• wherein the tenant-specific catalog is stored at a cloud site that includes the respective confidential container,
• wherein the provisioning, the storing, and the implementing, are all provided as a Software-as-a-Service to the tenant.