My memory is that there are ways to punch through virtualization that AWS uses and get insight into cache hits/misses of other tenants, but I'm not sure if that

My memory is that there are ways to punch through virtualization that AWS uses and get insight into cache hits/misses of other tenants, but I'm not sure if that applies here. In that world, you just rent some time on a large AWS instance and sit around mucking with the cache timing waiting for another tenant to do some cryptography. I can't find the link to the paper now, but my thoughts went to combining these two immediately -- you can get a local process without remote code execution if you just log onto your shiny new multitenant virtual server.