4 ms·

Most of the usefulness of this service is that you need a NAT gateway if you want instances to be created with private IPs only but also be able to access the i

by tobz 11y ago

Most of the usefulness of this service is that you need a NAT gateway if you want instances to be created with private IPs only but also be able to access the internet. The IPv4 point isn't wrong but it misses the mark, I think. You could put them in super restrictive security groups, sure, but some people just want to say "these don't have a public IP, so it checks off this box" and those people are going to be super happy with this. There's also the comments about checking off other boxes like central points for IDS, etc.

zAy0LfpBZLC8mAC 11y ago
> [...] but some people just want to say "these don't have a public IP, so it checks off this box" and those people are going to be super happy with this. Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. An IP address being private is simply a convention adhered to by people assigning addresses--that does not in any way guarantee that one cannot send packets to those addresses from outside your network or forward packets from those addresses out of your network, so it doesn't obviate the need for you to filter at the borders of your network, and if you do filter, you might as well filter "public addresses". The only difference between private and public addresses is that private addresses are potentially assigned to more than one network/machine, which makes it difficult to make those networks/machines communicate with one another in case you ever need to, and to make the world communicate with them because the world in general can't distinguish between the multiple instances of the same address, and thus usually doesn't really know who to talk to.
- kesor 11y ago
  For a network with several hundred instances where each instance has a public IP, the borders of your network become quite wide. You now need to audit several dozen security groups. When you setup a private subnet, there are a lot less security groups, and access points in general, which makes it much easier to audit and maintain reasonable security for. This is especially true where unprofessional people start and stop instances (say developers) and don't have the same security mind-set, making it a risk of human-error that causes services which normally should be protected to be open to the world.
  - zAy0LfpBZLC8mAC 11y ago
    Well, then you have to make it so that new instances automatically contain your packet filter. You have to think outside what the current implementation easily supports, which obviously reflects the limitations of the current network setup, and think about what would be possible if those limitations didn't exist. And it's obviously technically possible to automatically deploy the same packet filter to each VM that gets added to your network range ... Also, as I said, the point is not that a central firewall cannot ever be a good solution--but with the current limitations, you have no other choice even when it doesn't really make much sense.
- joecot 11y ago
  > Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. And yet is a requirement for many compliance policies. For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. That's the sort of thing that private subnets and NAT in Amazon's VPC was really made to cover. Could you give your database with millions of credit card records a public IP, and just firewall it to be secure? Sure. But you don't need to, and a core part of compliance is not taking risks you don't need to take. You can accidentally add a bad firewall rule, you can leave some sort of hole that makes it easy to punch through. It's much harder to accidentally make your database accessible from the public internet through a NAT. What this new service means is that, instead of having a server in every region whose sole job it is to accept outgoing connection requests for package upgrades, I can use this service. Why do I not just have those connections go through the web server? Because PCI requires one role per server. Why do I not just use a micro instance instead of this more expensive service? Because then I have one more server I have to maintain and test for compliance. For people that have security policies and compliance requirements to meet, this service makes life a small amount simpler, and is worth the price.
  - zAy0LfpBZLC8mAC 11y ago
    > And yet is a requirement for many compliance policies. I didn't claim there aren't any incompetent people out there. > For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. "Not having access to the internet" != "private address range". A private address range does not prevent someone external from accessing your machine. That people think that is a dangerous misconception. Also, private address ranges make it much, much harder to reason about your firewall's correctness.

by tobz 11y ago

zAy0LfpBZLC8mAC 11y ago

> [...] but some people just want to say "these don't have a public IP, so it checks off this box" and those people are going to be super happy with this. Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. An IP address being private is simply a convention adhered to by people assigning addresses--that does not in any way guarantee that one cannot send packets to those addresses from outside your network or forward packets from those addresses out of your network, so it doesn't obviate the need for you to filter at the borders of your network, and if you do filter, you might as well filter "public addresses". The only difference between private and public addresses is that private addresses are potentially assigned to more than one network/machine, which makes it difficult to make those networks/machines communicate with one another in case you ever need to, and to make the world communicate with them because the world in general can't distinguish between the multiple instances of the same address, and thus usually doesn't really know who to talk to.

kesor 11y ago
For a network with several hundred instances where each instance has a public IP, the borders of your network become quite wide. You now need to audit several dozen security groups. When you setup a private subnet, there are a lot less security groups, and access points in general, which makes it much easier to audit and maintain reasonable security for. This is especially true where unprofessional people start and stop instances (say developers) and don't have the same security mind-set, making it a risk of human-error that causes services which normally should be protected to be open to the world.
- zAy0LfpBZLC8mAC 11y ago
  Well, then you have to make it so that new instances automatically contain your packet filter. You have to think outside what the current implementation easily supports, which obviously reflects the limitations of the current network setup, and think about what would be possible if those limitations didn't exist. And it's obviously technically possible to automatically deploy the same packet filter to each VM that gets added to your network range ... Also, as I said, the point is not that a central firewall cannot ever be a good solution--but with the current limitations, you have no other choice even when it doesn't really make much sense.
joecot 11y ago
> Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise. And yet is a requirement for many compliance policies. For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. That's the sort of thing that private subnets and NAT in Amazon's VPC was really made to cover. Could you give your database with millions of credit card records a public IP, and just firewall it to be secure? Sure. But you don't need to, and a core part of compliance is not taking risks you don't need to take. You can accidentally add a bad firewall rule, you can leave some sort of hole that makes it easy to punch through. It's much harder to accidentally make your database accessible from the public internet through a NAT. What this new service means is that, instead of having a server in every region whose sole job it is to accept outgoing connection requests for package upgrades, I can use this service. Why do I not just have those connections go through the web server? Because PCI requires one role per server. Why do I not just use a micro instance instead of this more expensive service? Because then I have one more server I have to maintain and test for compliance. For people that have security policies and compliance requirements to meet, this service makes life a small amount simpler, and is worth the price.
- zAy0LfpBZLC8mAC 11y ago
  > And yet is a requirement for many compliance policies. I didn't claim there aren't any incompetent people out there. > For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. "Not having access to the internet" != "private address range". A private address range does not prevent someone external from accessing your machine. That people think that is a dangerous misconception. Also, private address ranges make it much, much harder to reason about your firewall's correctness.