2

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties.

The machines do talk with each other. My concern is about communication security. I tried searching around the web, but may be I am missing right keywords as I could not find relevant information.

Do we need to encrypt traffic between virtual machines if contains sensitive data? Can someone with wireshark or similar tools, inspect my traffic. How does amazon prevent someone hosting a virtual machine and use wireshark to observe traffic?

Improve this question
1
  • This is a non quetion really. If you have sensitive data and are concerned about leaking it then you should just encrypt it.
    – user9517
    Apr 2, 2014 at 5:24

2 Answers 2

Reset to default
2

According to their Security Practices statement: http://aws.amazon.com/articles/1697

Packet sniffing by other tenants: It is not possible for a virtual instance running in promiscuous mode to receive or "sniff" traffic that is intended for a different virtual instance. While customers can place their interfaces into promiscuous mode, the hypervisor will not deliver any traffic to them that is not addressed to them. This includes two virtual instances that are owned by the same customer, even if they are located on the same physical host. Attacks such as ARP cache poisoning do not work within EC2. While Amazon EC2 does provide ample protection against one customer inadvertently or maliciously attempting to view another's data, as a standard practice customers should encrypt sensitive traffic.

Basically, you wont see any traffic not meant for your specific instance, and multicast does not work. Your traffic is fairly secure, but if you're transferring data that warrants encryption, it's best practices to do so.

Improve this answer
0

If you want to have more security tan already mentioned use a VPC - so you will get you own private network inside of the Amazon Cloud. This will add another layer of security as you can use internal IP addresses which are routed internally to your machines only - so no way of sniffing your traffic (except for AWS on their switches and routers).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .