9 ms·
Announcing the New AWS Secret Region
- rbanffy 9y agoCue in the "Dammit! We are not supposed to talk about it" jokes
- philipov 9y agoWhen I first saw the headline, I thought it had something to do with secrets management, for, like, ssh keys... Why would they need an entire region for that?
- nathan_long 9y agoI thought it was going to be like East or West, but We're Not Telling You Where. :)
- iagooar 9y agoSecurity. No better separation, than physical.
- cwkoss 9y agoHopefully it prevents S3 buckets from being set to public.
- STRML 9y agoThe new S3 console/flow sets to private by default - so some progress there, all jokes aside.
- nhumrich 9y agoS3 has always been private by default. But too many people open it up to the world for convenience.
- mtgx 9y agoYes, but now Amazon will show them orange alerts if they do that! I've argued this before around here - I believe it's a platform provider's responsibility for the most part to secure data, and less so the responsibility of the developer or user. Amazon should go much further and make it hard to open-up the data to the public, at least for certain categories of buckets. So for instance some buckets should always be public by default, and some should always be encrypted and private by default. That should make intelligence agencies' choice easier, because I would imagine even if it's "harder" to process the data from an encrypted bucket, they would still prefer that option to the always public bucket. And maybe both categories could still be configured to either be private or public, respectively, but the account owners should have to really go out of their way to make those changes. So most shouldn't bother, and just use the defaults for each category of buckets.
- colechristensen 9y ago>I believe it's a platform provider's responsibility for the most part to secure data, and less so the responsibility of the developer or user I would say that is going too far, or maybe I'd say it differently. If a certain problem becomes very frequent relative to it's severity, the problem is a design bug and not just user error. The provider isn't responsible for every mistake, but they are responsible for designing with mistakes in mind.
- staticassertion 9y agoIf your design allows insecure setups without users understanding the risks in full, I think that's on the providers and not the user. If the user understands the risks fully, then it's on the user. I think we are way far away from users fully understanding the risks, and we're still mostly dealing with people not realizing they're vulnerable. So I put this primarily on the provider.
- dantiberian 9y agoIt goes one step better, it isn’t even connected to the Internet!
- deleted 9y ago[deleted]
- andy_ppp 9y agoWill it be locatable by latency (roughly) or is that not the point? Additionally, if I was doing secret things I'd really think it was not a great idea to put that into a data centre marked "Definitely where I keep all of my secrets".
- hackcasual 9y agoSounds like this is an expansion of this: https://www.theatlantic.com/technology/archive/2014/07/the-details-about-the-cias-deal-with-amazon/374632/ https://www.theatlantic.com/technology/archive/2014/07/the-d... to non-Intelligence Community users. You'll still need US Government Secret Clearance though.
- deleted 9y ago[deleted]
- jazoom 9y agoWe are pleased to announce the new AWS Secret Region. The AWS Secret Region can operate workloads up to the Secret U.S. security classification level. The AWS Secret Region is readily available to the U.S. Intelligence Community (IC) through the IC’s Commercial Cloud Services (C2S) contract with AWS.
- jazoom 9y agoUsually when I post a quote from the article to shed light on what it's actually talking about it is appreciated. What's different about this time that causes a bunch of downvotes?
- dsr_ 9y agoAs long as there is only one Secret region, you can have reliability or you can have classified data, but not both.
- spullara 9y agoAs long as they have multiple zones you can get the reliability ~ huge natural disaster that may affect other regions anyway.
- mrep 9y agoSomeone posted above that there already was one before and this is the second: https://www.theatlantic.com/technology/archive/2014/07/the-details-about-the-cias-deal-with-amazon/374632/ https://www.theatlantic.com/technology/archive/2014/07/the-d...
- discodave 9y agoFirst region is top secret. So technically data in the existing region could be moved to the new region, but not vice versa.
- frandroid 9y agoIt doesn't say anywhere that this is a geographically distinct region.
- openasocket 9y agoIt would have to have at least physically separate data centers, that's kind of the whole point of having this in the first place.
- valbaca 9y agoregion != zone
- jacquesm 9y agoIf your secret region goes down the data just got more secret.
- Rebelgecko 9y agoIs this part of Govcloud? Unfortunately Govcloud doesn't support a handful of AWS services, it would be nice if this was more complete
- hackcasual 9y agoIt's not, though it's related. Govcloud only supports up to "Controlled Unclassified Information." This can handle Secret and Top Secret. I'd expect it to be even further restricted in terms of supported services.
- rad_gruchalski 9y agoWhat's the point of announcing it publicly?
- Gaelan 9y agoInvestors?
- jandrese 9y agoIf they didn't nobody would know about it. It's not like Amazon has a big list of email addresses of people who have Secret data that they might want to put on the cloud. Even if they did have a list of government people like that, most of the people interested in this service are contractors who don't officially work for the government. The government doesn't work like those spy movies where everybody knows everything the instant it happens. It's more like a big bloated corporation with thousands of subcontractors and generally lousy communication all around.
- empath75 9y agoThere’s hardly anyone in tech with a clearance in dc who didn’t know this was coming. They’re recruiting like crazy for it.
- BLanen 9y agoWhat's the point of keeping it secret?
- walshemj 9y agoOPSEC
- outworlder 9y agoJust because it's called AWS "Secret", it doesn't mean it has to be a secret :)
- DonHopkins 9y ago
- alexnewman 9y agoI spent a lot of time on gov cloud console at a couple of jobs. It's very limited. At the time they didn't have lambda.
- CJKinni 9y agoWhat does it mean for something to be an "air-gapped commercial cloud"?
- jlgaddis 9y agoThe "Top Secret" cloud is not connected to the Internet.
- user5994461 9y agoWhich obviously can't be true or it would be inaccessible and thus utterly useless.
- jlgaddis 9y agoWhy? It can still be connected to SIPRnet or JWICS. Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect. As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.
- jlgaddis 9y agoNow all of your e-mails and private data don't have to be carried all the way around the world back to Bluffdale, they can simply be dumped into AWS!
- AaronFriel 9y agoArticle says that this is the first cloud provider certified for these workloads, but I believe both Microsoft Azure and Amazon AWS began negotiating these contracts around the same time. Microsoft announced their version a few weeks ago[1]. I wonder if Google will follow shortly? [1] https://azure.microsoft.com/en-us/blog/announcing-new-azure-government-capabilities-for-classified-mission-critical-workloads/ https://azure.microsoft.com/en-us/blog/announcing-new-azure-...
- killjoywashere 9y agoMicrosoft's announcement has a lot "will". Amazon's has a lot of "is".
- jknoepfler 9y agoWhere the "is" should be generally understood as "is[1]" [1] but in such a poorly tested, underbaked fashion you probably shouldn't bother for a few years
- pnathan 9y agoI see someone's experienced in AWS product rollout.
- jknoepfler 9y agoYeah, I worked on an AWS product launch for a product that was not ready to go live, and we ended up trying to dog-food a bunch of other AWS services that were also not ready to be live. It was honestly pretty shocking.
- killjoywashere 9y agoThanks. This is the sort of experience-based comment that I read Hacker News for.
- IncRnd 9y ago
- zitterbewegung 9y agoAnyone use this feature ? Also where is this region located ? ( Washington DC ?)
- softgrow 9y agoFrom the headline I was actually expecting a ‘mystery trip’ region, cut price but you don’t find out where till you start using it.
- SimbaOnSteroids 9y agoRight like its actually AWS Atlantis-West.
- gesman 9y agoAWS is a 3-letter agency from now on :)
- mockery 9y ago"With the new AWS Secret Region, we are bringing the same tools and workflows that are already available for Top Secret workloads to customers with Secret datasets and workloads." Does this mean they already had an AWS "Top Secret" Region?
- nova22033 9y agoYes. It's called C2S.
- dantiberian 9y agohttp://www.defenseone.com/technology/2015/07/how-break-cias-cloud-amazon/117175/ http://www.defenseone.com/technology/2015/07/how-break-cias-...
- WatchDog 9y agoDoes anyone know what sort of price premium AWS charge for their secret regions over their public commercial regions?
- discodave 9y agoThey're not charging per GB of S3 or whatever. It's likely a fixed(ish) priced contract that basically covers their cost of building a complete region. So the pricing doesn't really compare. Basically, AWS is all public cloud, none of this private cloud nonsense... until you come along with a $600MM check and then you can have a private region all to yourself!
- mrep 9y agoSomeone's still got to pay the energy bill and for new servers to account for growth. I don't see why they would throw at their current billing model for something else.
- frabbit 9y ago> the CIA has placed a big bet on adopting > commercial cloud technology Can't they get the NSA to rent them some of their spare capacity from the CNCI? Or is this because they trust Amazon to have actually solved the hard problems? https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center