Amazon Web Services and Cloud admin on 24 Apr 2009 01:10 pm
System hardening guidelines for Amazon EC2
One of the biggest questions we get from Clients is “Is Amazon EC2 secure” . That is like saying is my Vanilla network secure. Like anything you can take some steps to make the environment as secure as you can, such as:
- First read the Amazon Security Whitepaper and the Amazon discussion of Security processes
- Ensure the system key is encrypted at start-up
- Ensure you plan for load balancing in case an instance goes down. Ensure you understand all the security implications of this and harden any other instances.
- Test or emulate the performance of applications deployed to the cloud in all geographies where you plan to deploy them. The latency could vary greatly for each.
- Never ever allow password base authentication for shell access.
- Encrypt all network traffic always.
- Always encrypt everything stored on S3
- Encrypt file systems for Block devices
- Open only the minimum required ports
- Include no authentication information in any AMI images
- Think about how your system can be hardened and what is out there such as SELinux, PAX, ExecShield etc
- Don’t allows any decryption keys into the cloud – understand the perils of keys and security
- Install host based intrusion detection system such as OSSEC
- Regularly backup Amazon instances and store them securely.
- Use Security Groups. With EC2 security groups, you can completely isolate every tier, even internally to the EC2 cloud.
- Design in a way you can issue security patches to AMI instances
The nightmare scenario that you cannot cater for is is that Xen has unforeseen security issues which would allow inter-VM communication and which in essence would enable instance spying. Amazons doomsday scenario…..
on 24 Apr 2009 at 8:44 pm # Cloud Computing Links April 24, 2009 at Cloud Curious
[...] System hardening guidelines for Amazon EC2 – Cloudiquity [...]
on 23 Dec 2010 at 9:25 am # Nico
I agree the filesystem should be encryption. However I would like to see some pointers to info on how to properly manage the key/password for an encrypted filesystem on EC2. If you’re not supposed to store your password in the image (I agree) then how do you make sure your filesystems are mounted properly at boot time?
on 11 Nov 2011 at 10:52 am # Pether Sorling
No mention of running instances in amazon vpc, plan to run backoffice and database instances in different subnets.
on 29 Jan 2012 at 9:46 pm # Security and moving your private data into the public Cloud | jamieschuts
[...] You should also lock down your virtual environment as you would a node running on an unsecure DMZ http://www.cloudiquity.com/2009/04/system-hardening-guidelines-for-amazon-ec2/. Consider encrypting all of the data you store on the [...]
on 30 Mar 2012 at 4:43 pm # Derek
Do you know of any kind of full root/system block-level volume encryption solution exists for Windows which would work well with EC2 EBS volumes?
It would be nice to have an option to send a key file to each virtual guest during the Start command to cover any authentication. So far, solutions like TrueCrypt require entry of a passphrase during boot. Well, on EC2, you don’t get a console and would prefer to have an automated solution anyway when stopping and starting hundreds of instances.