5 ms·

> Regions – Rotation is needed for database instances in all commercial AWS regions except Asia Pacific (Hong Kong), Middle East (Bahrain), and China (Ningxia).

> Regions – Rotation is needed for database instances in all commercial AWS regions except Asia Pacific (Hong Kong), Middle East (Bahrain), and China (Ningxia). I wonder why? Are these CAs subject to... shall we say, additional goverment oversight?

jontro 7y ago
It's because those regions were created after the 2019 certificate was released. Hence there is no 2015 cert for those. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...
- insomniacity 7y ago
  Fair enough - I didn't realise they'd launched regions that recently!
  - jontro 7y ago
    The Ningxia region might not support encryption. That one was released in 2017. Unsure about this one.
    - jon-wood 7y ago
      Yeah, Ningxia is a weird region. It’s run under license by a Chinese company, and KMS isn’t available, which by extension means most encryption isn’t either since that’s all built on top of KMS these days.
      - Cpoll 7y ago
        I wonder why they do that instead of asking for access to the private keys.
      - dlgeek 7y ago
        KMS launched in Ningxia (and Beijing) in June: https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-now-available-aws-china-beijing-sinnet-and-aws-china-ningxia-nwcd/ https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-n...
        jon-wood 7y ago
        Oh, fair enough, last time I looked into the China regions that didn't exist. Reading the announcement I'm loving the seeming contradiction between " AWS KMS is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Chinese government-approved hardware security modules to protect the security of your keys." and the very next sentence "The service is designed so that no one, including KMS service operators, can retrieve your plaintext master keys from the service." Something tells me those master keys aren't quite as secure as you'd expect in other regions.
        sneak 7y ago
        The US government also has their own set of security requirements for AWS regions in the USA that serve the US government.
jrockway 7y ago
If the government wants your database, I'm guessing they just ask Amazon for a copy. They don't need to break TLS to do that.
- insomniacity 7y ago
  Yes, but if they're already in the network (although I've nothing to suggest they are), MITMing the database connection means they get the data immediately, rather than at the next quasi-judicial request.

jontro 7y ago

It's because those regions were created after the 2019 certificate was released. Hence there is no 2015 cert for those. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...

insomniacity 7y ago
Fair enough - I didn't realise they'd launched regions that recently!
- jontro 7y ago
  The Ningxia region might not support encryption. That one was released in 2017. Unsure about this one.
  - jon-wood 7y ago
    Yeah, Ningxia is a weird region. It’s run under license by a Chinese company, and KMS isn’t available, which by extension means most encryption isn’t either since that’s all built on top of KMS these days.
    - Cpoll 7y ago
      I wonder why they do that instead of asking for access to the private keys.
    - dlgeek 7y ago
      KMS launched in Ningxia (and Beijing) in June: https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-now-available-aws-china-beijing-sinnet-and-aws-china-ningxia-nwcd/ https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-n...
      - jon-wood 7y ago
        Oh, fair enough, last time I looked into the China regions that didn't exist. Reading the announcement I'm loving the seeming contradiction between " AWS KMS is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Chinese government-approved hardware security modules to protect the security of your keys." and the very next sentence "The service is designed so that no one, including KMS service operators, can retrieve your plaintext master keys from the service." Something tells me those master keys aren't quite as secure as you'd expect in other regions.
        sneak 7y ago
        The US government also has their own set of security requirements for AWS regions in the USA that serve the US government.

jrockway 7y ago

If the government wants your database, I'm guessing they just ask Amazon for a copy. They don't need to break TLS to do that.

insomniacity 7y ago
Yes, but if they're already in the network (although I've nothing to suggest they are), MITMing the database connection means they get the data immediately, rather than at the next quasi-judicial request.