Contrary to popular belief, enclaves do not have encrypted state

The isolation and confidentiality is enforced by the AWS Nitro hypervisor

Any code on the hypervisor can bypass confidentiality