I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (I have a simple CAD interface) along some simulation properties, and clicks a button to run the simulation on a cloud instance and get some results.
Everything is hosted on AWS. The flow goes like this:
- User logs into the web platform (hosted on AWS Amplify*) using Amazon Cognito
- User creates a new project, which creates some files in an S3 bucket (
- User uploads their project data to S3 and submits their simulation project to run, by calling an API endpoint that triggers a Lambda function, launching an EC2 instance
- The (high-performance) EC2 instance downloads the project from S3, runs a bunch of complicated math, and uploads/updates the results to S3 every few seconds as the simulation runs (until it finishes, which takes a few minutes/hours)
- As the simulation is running, the user queries S3 every few seconds to update the results and plot them in the browser
*Amplify simply hosts my web page - it's probably an irrelevant detail in the context of security.
Here is a diagram of my cloud architecture:
As my customers would be extremely cautious about their highly-confidential simulation data (and uploading their data to the cloud would raise concerns), is there a reliable way to ensure that not only other customers, but also me and Amazon cannot access their data? This may imply encrypting/decrypting data on the browser before submitting to/after reading from S3. However, in order for the EC2 math engine to run the simulations, it needs to handle the decrypted data, and I need to make sure that Amazon and I cannot access the data in the instance.
Note: in case it matters, from the frontend client-side browser code, to the backend EC2 math engine & AWS architecture, everything will be entirely open source. This implies that users can freely study the flow of their data, which should hopefully provide an additional layer of comfort.