Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found that there is a fair deal of overhead when uploading a lot of small files to S3. Some of this overhead comes from SSL itself.

How safe is it to talk to S3 without SSL when running in EC2?


From the awesome comments below, here are some clarifications: this is NOT a question about HTTPS versus HTTP or the sensitivity of my data. I'm trying to get a feeling for the networking and protocol particularities of EC2 and S3. For example

  • Are we guaranteed to be passing through only the AWS network when communicating from EC2 to S3
  • Can other AWS users (apart from staff) sniff my communications between EC2 and S3
  • Is authentication on their api done on every call, and thus credentials are passed on every call? Or is there some kind of authenticated session. I am using the jets3t lib.

Feedback from people with some AWS experience would be appreciated.

share|improve this question
2  
It has a safe value of 3, of course you don't know what that means since I just made it up. To put it differently, since you haven't told us what you are transmitting, how do you expect us to give you a useful answer about how 'safe' it is. The safety or security level is a relative value that takes the risks, threats, and costs into account. –  Zoredache Oct 31 '12 at 20:48
    
Some of this overhead comes from SSL itself. - How much of it? The data overhead from SSL is very little.. –  Shane Madden Nov 1 '12 at 4:09
    
@ShaneMadden the overhead becomes significant when you upload a large number of small files, since the overhead is per REST request. See improve.dk/archive/2011/11/07/… for some examples (search for "HTTP still wins out over HTTPS") –  Marc Nov 1 '12 at 12:00

2 Answers 2

up vote 1 down vote accepted

Are we guaranteed to be passing through only the AWS network when communicating from EC2 to S3

Within the same region (including between availability zones), yes. Between regions, no.

Can other AWS users (apart from staff) sniff my communications between EC2 and S3

No (barring some sort of security hole).

Is authentication on their api done on every call, and thus credentials are passed on every call? Or is there some kind of authenticated session. I am using the jets3t lib.

Each call is authenticated separately.

share|improve this answer

It's as safe as doing anything else over HTTP instead of HTTPS. Would you bank over HTTP? No. But would you download porn over HTTP? Probably.

All depends on your usage case, but I'm going to go out on a whim and say "Yes". Except for when the answer is "No".


On a 2nd read of your question, I think you're basically asking "Is the attack surface reduced due to the fact that I'm going from EC2 to S3 directly"; i.e. because they are from between two services that are both within Amazon's network.

I don't use AWS on a regular basis, but my recollection is this: If it only passes through Amazon's internal networks (in the same availability zones), you don't get charged for the traffic, but if passes through their ingress/egress then you pay for it. So if you're not paying for AWS > S3 traffic, then yes, your attack surface is reduced because it's only passing through one network and not networks owned by a 3rd party, but that's not an excuse to not use HTTPS where it needs to be used.

share|improve this answer
    
"I don't always bank online, but when I do, I use HTTP." –  cjc Oct 31 '12 at 20:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.