3 ms·
Most servers have some sort of "lights out" management, which gives KVM + remote imaging and bios control. With amazon, they have complete control over the net
by KaiserPro 9y ago
Most servers have some sort of "lights out" management, which gives KVM + remote imaging and bios control.
With amazon, they have complete control over the network in and out, so cutting you off and re-imaging a server is pretty trivial.
To be fair, its not that hard to do even if you're not amazon.
Most of the big server vendor's out of band interfaces have an API, so telling a server to reboot from a network image is pretty trivial. Providing a netboot infrastructure to install images with a 'userdata' script is also not that difficult.
you'll need a DHCP server, tftp to serve the boot image, and usuaally an NFS server to pull the rest of the image over. With some engineering work that could be made to use HTTP.
https://wiki.centos.org/HowTos/NetworkInstallServer https://wiki.centos.org/HowTos/NetworkInstallServer
- detaro 9y agoIt's a bit harder if you host something like this for the general public to use (vs administrating machines in your private DC). Normal setups aren't really hardened against someone flashing firmware, messing with UEFI, ..., all of which mean you can't entirely trust a machine coming back from customer control. I wouldn't be surprised if Amazon took this seriously and invested effort in stopping such things. At their scale, they probably can customize the hardware enough.
- justincormack 9y agoEveryone who sells bare metal as a service takes this seriously. As AWS build their own hardware, especially in these newer machines, I would guess that its not possible to flash firmware from the user machine, only from the control node.
- _msw_ 9y agoEC2 Bare Metal instances boot from an EBS volume that is accessed via a NVMe PCI device (implemented in ASICs built by Annapurna Labs), just like virtualized C5 instances.
- KaiserPro 9y agoWhy would you boot what is essentially an iSCSI target via NVMe?
- _msw_ 9y agoNVMe is just how the storage is surfaced -- the hardware programming interface for the block device. Hardware iSCSI initiators (HBAs) also have a hardware programming interface, but at the end of the day you talk SCSI over that interface. NVMe is a better match for the the storage operations supported by EBS. A bonus is that by surfacing EBS over NVMe there is a common storage interface for both managed storage volumes and local NVMe storage.