An application on Amazon EC2 processes sensitive data, including credit card numbers. The numbers must be sent to a highly isolated component that encrypts, stores, and decrypts them, and issues tokens for use elsewhere in the application. Only the tokenization component may access the raw numbers. What solution should be used for the tokenization component?

AWS Nitro Enclaves provide an isolated, hardened, and highly constrained execution environment within an EC2 instance. This isolation ensures that even privileged users or processes on the parent EC2 instance cannot access the sensitive data or code running within the enclave, making it ideal for handling credit card numbers and tokenization. Running on EC2 Dedicated Instances offers hardware isolation but doesn't prevent privileged access from the host instance itself. A partition placement group distributes instances across different racks but doesn't provide the necessary process-level isolation for sensitive data. Creating a separate VPC provides network isolation but doesn't prevent access to sensitive data by other processes on the same instance or by privileged users.