I am currently entering the world of deploying my web application to the cloud.

While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The docker container I'm deploying via there command line tool is fully readable by heroku and passwords for database, external storage providers are all in my env variables that are also stored in my heroku account.

Does this mean, I need to fully trust my paas provider?

In my mind a simple VPS would be safer in that regard, because the iaas provider does not need (have?) access to my private machine. Only I have the password to that server. And my application code and passwords are inside the machine, so he has no access to it.

Of course the server would probably be more insecure to the outside world than my nodes on paas, because I have to configure the application hosting myself with a VPS and I'm certainly not as qualified as people who get paid for that stuff.

Is there some truth in this text or am I understanding something wrong here?

  • I believe this is a general fear that will be associated with any third party closed source software that you use. You have to decide how much you trust a provider to adhere to their terms and conditions – Limit Apr 28 '18 at 12:06

It is true you need to trust your Paas provider. They have full access to your stuff. What I would argue is not completely true is that a VPS is safe. It is maybe a bit safer, as it would be slightly harder for the provider to set up surveillance of your setup, but they still have full access to the underlying hypervisor, and can therefore access contents of your memory, and from there everything. If you want any real amount of security, you need a dedicated server and for full security, this dedicated server needs to be physically protected.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.