This document discusses security best practices for Amazon Web Services (AWS). It recommends removing SSH host key pairs from public Amazon Machine Images (AMIs) to prevent security risks. It also suggests configuring virtual private clouds (VPCs) to restrict outbound traffic, using smaller instance types like t1.micro that offer less resources to attackers, mounting filesystems as noexec to prevent execution of unauthorized code, and using chroot jails.

1. AWS
Twitter: @ar1
yasuarak@amazon.co.jp

2. !
§
§
§
§ Twitter:ar1
§ Debian

3. IaaS(AWS)
Customer 1 Customer 2 …
Customer n
Hypervisor
Virtual Interfaces
Customer 1
Security Groups
Customer 2
Security Groups … Customer n
Security Groups
Firewall
AWS
Physical Interfaces

4. • Amazon
( )
•
Amazon
EC2
Instances
Encrypted
File
System
Amazon
EC2
Instance
Encrypted
Swap
File

5. • /
• iptables /
Inbound
Traffic
Amazon
EC2
Instances
iptables
Encrypted
File
System
Amazon
EC2
Instance
Encrypted
Swap
File

7. EC2 EC2 …
EC2
Hypervisor
Virtual Interfaces
Customer 1
Security Groups
Customer 2
Security Groups … Customer n
Security Groups
Firewall
AWS
Physical Interfaces

8. EC2
SSH AMI

9. AMI

10. AMI
AMI
EBS
?
( )
( )
EBS ssh
virus

11. ssh
! ssh
§ /etc/init.d/ssh ssh
§ lsof (lsof –i :22, lsof –p XXX)
! authorized_keys
§ # sshd -T | grep authorizedkeysfile

12. AWS Public AMI ssh
If you forget to remove the existing SSH host key pairs
from your public AMI, our routine auditing process will
notify you and all customers running instances of your
AMI of the potential security risk. After a short grace
period, we will mark the AMI private.

13. ! VPC outbound
! t1.micro
§ 32bit 64bit 64bit 32bit VM mount
! mount –o noexec
! chroot