3 ms·

Generally it's not a good idea to sabotage your employer's clients, but I wonder how many engineers across the Big 3 US cloud providers have the know-how to exp

Generally it's not a good idea to sabotage your employer's clients, but I wonder how many engineers across the Big 3 US cloud providers have the know-how to exploit holes in how Forture 500 companies use their platforms.

cj 7y ago
This is a legitimate risk. At a minimum, AWS Support has near complete read access to AWS accounts in connection with support cases. It would be interesting to hear from an AWS employee how access to customer information is controlled.
- joncrane 7y ago
  Metadata, yes. But not content. So they can see you have 200 c5.9xlarges running in 3 AZs in 3 subnets in one VPC, for example. But they can't see what you have on the volumes attached to those instances, what processes are running, etc.
  - vaesh 7y ago
    I've had AWS support tell me exactly what processes are running on my instance. They do seem to have some visibility beyond metadata.
    - yandie 7y ago
      I'm an Amazon employee here - but my words don't represent the company. Internally we also talk to AWS support. They absolutely don't have much visibility into our accounts at all - much to my frustrations. They only see metadata - even for internal accounts. The only teams that have some access to such information is security team, or when you Grant access explicitly to the other person via standard AWS auth mechanism (IAM)
      - deleted 7y ago
        [deleted]
    - WaxProlix 7y ago
      Seems vanishingly unlikely, unless you're using a service (SSM Inventory or similar) that would reflect what you have running/installed. I'm at AWS and we have basically zero insight into these things.
jcims 7y ago
If you include professional services in that list then the number is quite high. Also, keep in mind that many AWS services are composed of other AWS services, and in that composition there are services and infrastructure operating within AWS to manage it. All of that will operate on some type of maturity curve and sometimes be backed by an alarmingly small team. So my recommendation is only use AWS services that have been included in compliance certifications that are important to you: https://aws.amazon.com/compliance/services-in-scope/ https://aws.amazon.com/compliance/services-in-scope/ That of course doesn't mean you won't get hacked, but there's at least some evidence that the service is operated in accordance within AWS control standards, which are generally quite good and should minimize your exposure to rogue admins run amok.

cj 7y ago

This is a legitimate risk. At a minimum, AWS Support has near complete read access to AWS accounts in connection with support cases. It would be interesting to hear from an AWS employee how access to customer information is controlled.

joncrane 7y ago
Metadata, yes. But not content. So they can see you have 200 c5.9xlarges running in 3 AZs in 3 subnets in one VPC, for example. But they can't see what you have on the volumes attached to those instances, what processes are running, etc.
- vaesh 7y ago
  I've had AWS support tell me exactly what processes are running on my instance. They do seem to have some visibility beyond metadata.
  - yandie 7y ago
    I'm an Amazon employee here - but my words don't represent the company. Internally we also talk to AWS support. They absolutely don't have much visibility into our accounts at all - much to my frustrations. They only see metadata - even for internal accounts. The only teams that have some access to such information is security team, or when you Grant access explicitly to the other person via standard AWS auth mechanism (IAM)
    - deleted 7y ago
      [deleted]
  - WaxProlix 7y ago
    Seems vanishingly unlikely, unless you're using a service (SSM Inventory or similar) that would reflect what you have running/installed. I'm at AWS and we have basically zero insight into these things.

jcims 7y ago

If you include professional services in that list then the number is quite high. Also, keep in mind that many AWS services are composed of other AWS services, and in that composition there are services and infrastructure operating within AWS to manage it. All of that will operate on some type of maturity curve and sometimes be backed by an alarmingly small team. So my recommendation is only use AWS services that have been included in compliance certifications that are important to you: https://aws.amazon.com/compliance/services-in-scope/ https://aws.amazon.com/compliance/services-in-scope/ That of course doesn't mean you won't get hacked, but there's at least some evidence that the service is operated in accordance within AWS control standards, which are generally quite good and should minimize your exposure to rogue admins run amok.