5 ms·

I've heard it's possible to set something like that up on AWS, but of course Amazon could still access it.

rufius 7y ago
That depends. If it’s “bring your own key” then there’s nothing they can do. That said - I’m not familiar enough with how they’d build that infra at scale to make it cost effective.
chucky_z 7y ago
I set this up to force myself to stop SSHing to boxes all the time and trust in my own automation. It took some effort and setup is frustrating but it ended up being a net positive. I baked everything with Ansible and did last touch setup with user-data, and deployed it all with Terraform.
- deleted 7y ago
  [deleted]
vorpalhex 7y ago
I've built a system like this recently for a payments platform. Access _is_ possible but requires rebuilding the environment (and thus blowing everything away) as well as admin access.
- deleted 7y ago
  [deleted]
- monoideism 7y ago
  You built in on AWS? Using some application of CloudHSM?
- roddux 7y ago
  Is it possible to verify that you cannot access said system, though? How would that even be done? In most scenarios I can imagine you're still rely on the server telling you something about itself... which it can lie about.
Abishek_Muthian 7y ago
>but of course Amazon could still access it That depends upon the key management. Even with default encryption, keymanagement facilities available for EBS, S3, RDS amazon can be locked out; the key resides with the owner.
- core-questions 7y ago
  So how does a machine boot?
  - Abishek_Muthian 7y ago
    EC2 sends DEK(Data Encryption Key) from the volume Metadata to the KMS (Key Management Service), KMS decrypts the DEK with CMS(Customer Master Keys), EC2 stores the decrypted DEK in hypervisor memory to decrypt the volume.
    - admax88q 7y ago
      Who owns the hypervisor memory?
      - Abishek_Muthian 7y ago
        The same entity which owns every other hardware in this infrastructure.
        mirimir 7y ago
        So then "Amazon could still access it", right?
        Abishek_Muthian 7y ago
        According to Amazon, "AWS KMS is designed so that no one, including AWS employees, can retrieve your plaintext CMKs from the service. The service uses hardware security modules (HSMs) that have been validated under FIPS 140-2, or are in the process of being validated, to protect the confidentiality and integrity of your keys regardless of whether you use AWS KMS or AWS CloudHSM to create your keys or you import them into the service yourself. Your plaintext CMKs never leave the HSMs, are never written to disk and are only ever used in the volatile memory of the HSMs for the time needed to perform your requested cryptographic operation. AWS KMS keys are never transmitted outside of the AWS regions in which they were created. Updates to software on the service hosts and to the AWS KMS HSM firmware is controlled by multi-party access control that is audited and reviewed by an independent group within Amazon as well as a NIST-certified lab in compliance with FIPS 140-2."[1] [1]https://aws.amazon.com/kms/faqs/ https://aws.amazon.com/kms/faqs/

That depends. If it’s “bring your own key” then there’s nothing they can do. That said - I’m not familiar enough with how they’d build that infra at scale to make it cost effective.

chucky_z 7y ago

I set this up to force myself to stop SSHing to boxes all the time and trust in my own automation. It took some effort and setup is frustrating but it ended up being a net positive. I baked everything with Ansible and did last touch setup with user-data, and deployed it all with Terraform.

deleted 7y ago
[deleted]

vorpalhex 7y ago

I've built a system like this recently for a payments platform. Access _is_ possible but requires rebuilding the environment (and thus blowing everything away) as well as admin access.

deleted 7y ago
[deleted]
monoideism 7y ago
You built in on AWS? Using some application of CloudHSM?
roddux 7y ago
Is it possible to verify that you cannot access said system, though? How would that even be done? In most scenarios I can imagine you're still rely on the server telling you something about itself... which it can lie about.

Abishek_Muthian 7y ago

>but of course Amazon could still access it That depends upon the key management. Even with default encryption, keymanagement facilities available for EBS, S3, RDS amazon can be locked out; the key resides with the owner.

core-questions 7y ago
So how does a machine boot?
- Abishek_Muthian 7y ago
  EC2 sends DEK(Data Encryption Key) from the volume Metadata to the KMS (Key Management Service), KMS decrypts the DEK with CMS(Customer Master Keys), EC2 stores the decrypted DEK in hypervisor memory to decrypt the volume.
  - admax88q 7y ago
    Who owns the hypervisor memory?
    - Abishek_Muthian 7y ago
      The same entity which owns every other hardware in this infrastructure.
      - mirimir 7y ago
        So then "Amazon could still access it", right?
        Abishek_Muthian 7y ago
        According to Amazon, "AWS KMS is designed so that no one, including AWS employees, can retrieve your plaintext CMKs from the service. The service uses hardware security modules (HSMs) that have been validated under FIPS 140-2, or are in the process of being validated, to protect the confidentiality and integrity of your keys regardless of whether you use AWS KMS or AWS CloudHSM to create your keys or you import them into the service yourself. Your plaintext CMKs never leave the HSMs, are never written to disk and are only ever used in the volatile memory of the HSMs for the time needed to perform your requested cryptographic operation. AWS KMS keys are never transmitted outside of the AWS regions in which they were created. Updates to software on the service hosts and to the AWS KMS HSM firmware is controlled by multi-party access control that is audited and reviewed by an independent group within Amazon as well as a NIST-certified lab in compliance with FIPS 140-2."[1] [1]https://aws.amazon.com/kms/faqs/ https://aws.amazon.com/kms/faqs/