The question is this: can I, as a 3rd party, deploy my software into a customers AWS account and not allow them any access the resources that need to be provisioned for them? So for instance, can I provision some number of EC2 instances and not allow them any access?

The question arises from a desire to protect our IP from being divulged by virtue of the source code being easily readable by the customer. So license agreements aside, there is the chance that IP is compromised, which at this stage in the life of the business could be very commercially harmful.

I've been trawling questions on related topics, as well as the AWS documentation but to be honest I'm not seeing a clear way forward.

Any thoughts would be greatly appreciated.

  • 1
    Protect your IP with contracts. As the media industry has discovered, once you've put it in someone else's hands there's not much you can do about it. Don't want them accessing your software? Host it for them. – ceejayoz Jan 23 '17 at 0:42
  • I appreciate the comment, it's much as I thought it would be. Thanks for taking the time to chip in. – Neil Albrock Jan 23 '17 at 0:51

No, the administrator of the AWS account has full access. Even if they give you sole access to the account using IAM they can reverse that at any time.

I assume your code is in a language such as PHP? You could try an obfuscater, which is some protection, but not much. You could try some kind of conversion that changed the PHP to a language that can be compiled.

The best solution is probably to provide your product as SAAS.

| improve this answer | |
  • Thanks for the answer. It's what I was expecting to hear but I appreciate the confirmation. I think we'll need to go the SAAS route. Not just for this reason but it's the deal breaker. – Neil Albrock Jan 23 '17 at 0:52

When you provide a 3rd party service via an AMI, you don't have to leave account provisioning intact. Meaning that unless you tell them the SSH or RDP details, it can be somewhat difficult to gain access to the EC2 instance. I've rented a service from a 3rd party before, and was not given any credentials to ssh or rdp to the box, and was only able to manage the box via a web interface.

If you haven't come across it before, the AWS Marketplace is designed to allow 3rd party software to be run on your AWS account, and AWS builds in some protections to the 3rd party, such as preventing users from detaching EBS volumes from the official AMI and attaching it to another, or cloning AMIs for personal usage.

Sadly, if you want to use AWS Marketplace, you do however need to allow users access to perform OS-level administration. I don't know how far that actually extends to however, you are required to lock down the root/admin accounts, and allow access via a normal user. Perhaps chrooting this user could offer some code protection.

A good example of that is some of the professional security software: https://aws.amazon.com/marketplace/pp/B01CEYZ5S6

You can also use the AWS marketplace to bill AWS users for SaaS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.