I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He also needs proof that I cannot modify any of the running processes after he makes an audit.
My idea was to create an Amazon AMI, pre-load it only with applications of the customer. There will be no SSH access or any kind of access to that image in order to guarantee that no changes can be made to it. The only interface to the outside world will be a process listening for incoming connections.
Is it possible to implement this using AWS? My concern is that AWS has no mechanism to make an instance read-only, such that even the filesystem could be locked from modification by external means.
Any suggestions? Any services which provide independent verification?