I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.

I will present my findings so far here, but it will be good if you guys can confirm these findings, or comment on them.

  1. Netword based IPS/IDS systems are not necessary because:

Packets are only delivered to the destination addresses and no other devices will ever see that packet. While that eliminates many traditional threat vectors, it also makes intrusion detection approaches like NIDS/NIPS basically useless in AWS. So for intrusion detection in AWS you must look to host-based approaches.

Quoted from: http://www.erpassociates.com/peoplesoft-corner-weblog/cloud-computing/securing-enterprise-data-in-aws.html

  1. People tend to use nagios for IDS purposes on AWS: https://forums.aws.amazon.com/thread.jspa?messageID=176652&#176652 How to do it.

  2. People use host-based(software) IPS/IDS in AWS EC2, like OSSEC.

What do you guys think? Also, it seems to be that nagios can be configured to achieve what OSSEC can do. Is this correct too?

  • Please ask one question at a time. Mar 28, 2013 at 6:38

1 Answer 1


I'm not sure how you would manage a physical IDS on AWS since you are limited to what Amazon has in their system. When using a cloud provider, you largely have to trust their physical security, but you can reinforce it with your own software security to attempt to protect against any broad breach in their technology or any direct attacks against functionality you don't need or don't use in certain contexts.

  • How about Snort? (snort.org) Is it a physical or software IDS/IPS? Mar 29, 2013 at 17:56
  • 1
    @WinstonChen - As I recall, Snort is software that runs on a system you place in between the networks as hardware. Functionally, I believe it would be considered hardware, but it may be able to do IDS for the host it is running on as well. I don't know Snort well enough to be certain. Mar 29, 2013 at 18:05
  • From what I understand, Snort runs in promiscuous mode on a network interface. This is a problem because on AWS traffic not intended for a certain host will never be delivered to that host making promiscuous mode useless. Feb 9, 2015 at 0:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .