3

For example, suppose I have an ec2 instance and an elastic load balancer, is it safe to receive HTTPS traffic at the loadbalancer and forward it (unencrypted) to the instance.

I've enabled the minimum set of security group permissions to allow the load balancer to talk to the instance, however, its unclear to me whether these permissions are applied at VM level, or at the networking level. If just at the VM level then, presumably, other instances on the subnet can sniff unencrypted network traffic.

Improve this question

2 Answers 2

Reset to default
11

This is what a VPC is for. You can isolate your instance on its own subnet and the only way to access it would be its internal IP address. Read about it here: http://aws.amazon.com/vpc/

Improve this answer
2
  • 1
    +1. I really wish AWS would make VPC mandatory. There are so many benefits, and nearly zero minuses to using them.
    – EEAA
    Oct 21, 2013 at 17:29
  • 3
    By default on new AWS accounts now, a default VPC & security group is created. If you create EC2 instances on that account, they now default to that security group. aws.amazon.com/vpc/faqs/#D1
    – Travis Stoll
    Oct 21, 2013 at 19:09
6

Your traffic should be secure, as only traffic meant for your instance is ever sent to it. Though, if it's sensitive data, you might want to encrypt it all the way to the instance.

From https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf (located on https://aws.amazon.com/whitepapers/):

Packet sniffing by other tenants: It is not possible for a virtual instance running in promiscuous mode to receive or "sniff" traffic that is intended for a different virtual instance. While customers can place their interfaces into promiscuous mode, the hypervisor will not deliver any traffic to them that is not addressed to them. This includes two virtual instances that are owned by the same customer, even if they are located on the same physical host. Attacks such as ARP cache poisoning do not work within EC2. While Amazon EC2 does provide ample protection against one customer inadvertently or maliciously attempting to view another's data, as a standard practice customers should encrypt sensitive traffic.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .