Is my Jupyter notebook on EC2 secure?

Question

I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For example ec2-54-145-162-999.compute-1.amazonaws.com:80/lab?token=whatever

I am worried this is not secure and my AWS credentials could be compromised since Jupyter has a built in terminal where users can do whatever they want (yes I know sub process module as well). Now I am running Jupyter inside a docker container, but I'm not sure how much protection that provides since I have to run it as root to work. For example I run the container via

docker run -it -p 80:8888 myUserName/myRepo:myImage jupyter lab --ip=0.0.0.0 --allow-root

So my question is, is this reasonably secure?

I'm only planning to give the specific URLs to people and have the service up for days or maybe a week. Any information on why it is, or is not secure would be greatly appreciated.

Answer 1

The risk here is that someone will be able to gain access to your EC2 machine and from there potentially to any other cloud services you have on the same AWS account. This can be possible by escaping the Docker container that the users will have access to (take a look here for escaping methods) and then attempting to gain access to other services.

I would recommend using a more isolated Docker container service such as AWS ECS which will run each container separately completely. Right now it seems that there is risk to other users/your own AWS account.