30

Say I have a few EC2 instances in an AWS VPC network, each assigned its own private address for the subnet at creation. Say one of them is a DB, and another one some kind of web app talking to the DB. The DB makes sure to authorize only a certain segment of IPs on that subnet.

How critical is it that the communication within this subnetwork is encrypted with SSL? If eavesdropping occurs then you should be able to see the password get transmitted over cleartext.

Assuming, for the sake of argument, that there aren't exploits in AWS, how possible is it to either eavesdrop on the communication to the database instance, or to even MITM it?

When you run your own physical datacenter, you can be relatively confident that your data won't be snooped on internally, but how does cloud hosting alter this approach? I imagine the trust levels are a lot lower.

Improve this question

1 Answer 1

Reset to default
25

Amazon claims that AWS VPC is "logically isolated" from the other AWS instances, and from the Internet. "Logically" means that it is done in software, not with dedicated hardware system. An AWS VPC can be connected to your VPN and it will use IPsec for that external connection, but this does not mean that internally IPsec is used. In fact, how the "isolation" is really enforced is not documented, so that's a big unknown.

Assuming that Amazon is not hostile to you (in which case you would be doomed anyway), and that furthermore they do their job properly, then your communications between your systems should be safe from eavesdropping or interception by third parties. However, you can botch it if your servers reference each other by name and you let your internal DNS be poisoned externally. I suggest you use explicit /etc/hosts files so that your servers may not be convinced to use wrong IP addresses, letting the data escape into the Wild Internet.

Using SSL anyway would make things easier if you decide, in the future, to migrate your servers into some other cloud provider, or if you cease to be so trustful in Amazon's competence against network attacks. After all, IT security is known to be hard.

Improve this answer
1
  • 7
    To add to this answer, I would recommend AWS's Route53 Private Zones to manage internal DNS that's isolated within a VPC, instead of using /etc/hosts, especially if you have more than a couple of servers. Ref: docs.aws.amazon.com/Route53/latest/DeveloperGuide/… The cost ($0.50 per month) should be minimal to save time.
    – martian111
    Sep 3, 2015 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .