13

If I have several AWS EC2 and azure instances running on separate regions. I am using rabbitmq to exchange messages between them. Should I worry about adding TLS and encrypting those connections?

In other words if server A is on AWS us-east for example and server B is in azure how bad will it be if they exchange information without it being encrypted? Only the internet service provider and Amazon/Microsoft will be able to see that unencrypted data correct?

I will obviously encrypt anything that deals with the client. I am just curious about 2 backend servers talking to each other.


Edit

Thanks for the help guys. I know how to encrypt the connection and also how to set up a VPN. Sorry I phrased the question incorrectly.

I just wanted to know who will be able to see that traffic between those servers. Why will it be risky? I know it will be risky I believe you lol. I just want to know why. Also how bad will it be to generate my own ssl certificates and trust it on each server.

7
  • 3
    Only the internet service provider and Amazon/Microsoft will be able to see that unencrypted data correct? No, that is not correct.
    – Greg Askew
    Oct 27, 2022 at 9:22
  • 1
    "Also how bad will it be to generate my own ssl certificates and trust it on each server." - With a self signed certificates you get the same levels of transport encryption and security, but less guarantees that you're connection is not with a man-in-the-middle spoofing the identity of the server you're attempting to reach.
    – diya
    Oct 27, 2022 at 14:43
  • 4
    @diya, this is not true. If you create own CA you will be sure who you connect. Especially if you implement mutual authentication. Because hypothetically external CA can issue to someone else certificate for your other site. Oct 27, 2022 at 15:07
  • 1
    Indeed but self signed certificate != internal CA and my comment was intended as a general recommendation. IMHO with certificate pinning you could arguably even ensure suitable protection with a self signed certificate alone but that is hardly I would consider a conventional approach that would work for most.
    – diya
    Oct 27, 2022 at 15:16
  • 2
    @diya generating two self signed certificates and adding each them as trusted on the other system is actually more secure that anything else, because servers essentially will trust each other's public key directly. This is on the the same level of security as SSH or WireGuard keys. When you use third party CA to issue certificates you must trust also that CA, and even if you create own CA and make it trusted on both systems and issue certificates, this is still an additional point of trust which could be subverted, which is avoided with self signed certificates. Oct 27, 2022 at 16:53

3 Answers 3

25

Should you encrypt data between 2 servers in the cloud?

Yes.

Modern security thinking is that you don't consider your own network / datacenter as more trusted (than your WAN or the regular internet).

Traditionally one would allow for more relaxed security standards in the datacenter, within the "secure" perimeter of your own network. Both internal systems and users would be trusted, implicitly expected to be secure and never abusive or malicious. One only added for example TLS for connections crossing the perimeter and borders of your "secure" internal network.

Nowadays the increasingly more prevalent security concept is one of "zero trust", which abandons the concept of a secure and trusted internal networks/systems/users and applies the same rigorous level of security everywhere, regardless.

So for two back-end servers exchanging information with each-other:

  • both servers and and all their services should be configured with TLS certificates (for server authentication and transport encryption)
  • their communication should be encrypted
  • clients should authenticate to services (with username password, a token, client certificate or whatever is suitable)
  • your applications/(micro-)services should still do input validation and not trust the input from the internal clients/backend-systems to always be correct and safe to use verbatim.
  • etc.
  • etc.

In response to your edit

I just wanted to know who will be able to see that traffic between those servers
(server A is on AWS us-east for example and server B is in Azure)

Unless Amazon and Microsoft have their own physical datacenter interlinks, traffic between AWS and Azure clouds will be routed over the public internet and/or transit one or more network segments operated by third parties. The exact path your traffic takes and which third parties that are can change at any moment due to how routing protocols and the internet work.

When you don't set up transport encryption that traffic will be in clear text and anybody with access to any segment can trivially eavesdrop.

8
5

Depending on the stakes, one could not label "trusted" a physical network that is not physically visible end-to-end.

For a human with an average vision this amounts to a cable between two computers on a single desk.

In a sense, you can label a network "trusted" if you operate, manage and physically control it.

The Internet is not only owned, controlled and operated by multiple parties. One can even not be sure that the path that packets take today between points A and B will be the same tomorrow.

Packets between two different datacenters in the same city could route thru another continent. This can happen even if these datacenters have a dedicated direct connection between them. The direct connection can fail or be compromised in a number of ways and the connectivity will be maintained by other means.

And then, there is such things as https://en.wikipedia.org/wiki/BGP_hijacking - an attack that routes the traffic of interest towards devices that the attacker controls.

4

From security point of view is reasonable to secure the connections if they leave datacenter/service provider. This can be done by adding SSL/TLS to both parties. Also you can establish mutual authentication (client/server certificates). Another approach is to establish VPN connection between the hosts and tunnel the entire communication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .