Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An AWS Region is coming to France

allthingsdistributed.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: An AWS Region is coming to France

#41

Post by Cshelton »

So this is great however I have a very large concern.

In a U.S. AWS data center, I am very confident (right now) that my encryption keys and encrypted data will never be given out to any governmental agency. Even with a warrant, they can not access my data unencrypted.

What will Amazon do when the French government says hand us all of your keys or else...

As our data is all extremely sensitive financial information, we really can not even take that chance until we know.

Clarification: We send all data over HTTPS with AES 256 encryption. If authorities have a warrant for data, can we hand them the encrypted data and say the keys are in the U.S. and we can't give them to you?

Re: An AWS Region is coming to France

#42

Post by idlewords »

Cshelton wrote: post #41

So this is great however I have a very large concern. In a U.S. AWS data center, I am very confident (right now) that my encryption keys and encrypted data will never be given out to any governmental agency. Even with a warrant, they can not access my data unencrypted. What will Amazon do when the French government says hand us all of your keys or else... As our data is all extremely sensitive financial information,…

Why are you:

1) Keeping keys to extremely sensitive financial data on a cloud server

2) Confident that the US government won't request this information through warrant or national security letter

3) Asking for advice about this on a message board?

Re: An AWS Region is coming to France

#43

Post by philsnow »

jeffbarr wrote: post #38
inopinatus wrote: post #20

Earlier quoted context omitted.

Not every decision is about cost minimisation. There's a resiliency motivation to place DCs in separate flood plains and separate power grids if possible. Whether AWS is following that, I cannot say.

We (I am part of the AWS team) pay a lot of attention to that; our "Overview of Security Practices" paper[1] says: "Each availability zone is designed as an independent failure zone. This means that availability zones are physically separated within a typical metropolitan region and are located in lower risk flood plains (specific flood zone categorization varies by Region). In addition to discrete uninterruptable po…

I've always assumed that availability zones would not necessarily be in the same building or even site in a given region, but something I've wondered is what does the network look like between zones?

Does inter-AZ traffic traverse only fiber that you wholly own? Does AWS send traffic over some shared links in some cases? If only some cases, which cases?

Re: An AWS Region is coming to France

#44

Post by dgemm »

inopinatus wrote: post #20
alicewales wrote: post #14

Earlier quoted context omitted.

It's hardly surprising. Everything on the UK internet goes through London anyway. If you have a DC in Manchester and an end-user in Liverpool, the link normally goes Manchester - London - Liverpool. It's not a great situation, having everything so centralised on London, but it's a small enough country that it doesn't have a huge effect on latency. It would make no sense for AWS to locate in a non-London region when e…

Not every decision is about cost minimisation. There's a resiliency motivation to place DCs in separate flood plains and separate power grids if possible. Whether AWS is following that, I cannot say.

I would assume they wouldn't put any DC on a flood plain.

Re: An AWS Region is coming to France

#45

Post by Cshelton »

idlewords wrote: post #42
Cshelton wrote: post #41

So this is great however I have a very large concern. In a U.S. AWS data center, I am very confident (right now) that my encryption keys and encrypted data will never be given out to any governmental agency. Even with a warrant, they can not access my data unencrypted. What will Amazon do when the French government says hand us all of your keys or else... As our data is all extremely sensitive financial information,…

Why are you: 1) Keeping keys to extremely sensitive financial data on a cloud server 2) Confident that the US government won't request this information through warrant or national security letter 3) Asking for advice about this on a message board?

1) They are in a key management service (not AWS). Highly unlikely somebody will get both access to the keys and the data together. They are also rotated periodically.

2) Well lately, I'm not. The Apple/FBI case was somewhat assuring. And I believe that to date, AWS has not handed over any data or keys without permission.

3) More theoretical advice about the new French region. What are the laws about privacy and how will that work. We just saw what Germany ruled on with WhatsApp. And really just asking the question because it needs to be asked. I don't actually expect an ultimate answer, just discussion about it.

Re: An AWS Region is coming to France

#46

Post by dastbe »

philsnow wrote: post #43
jeffbarr wrote: post #38

Earlier quoted context omitted.

We (I am part of the AWS team) pay a lot of attention to that; our "Overview of Security Practices" paper[1] says: "Each availability zone is designed as an independent failure zone. This means that availability zones are physically separated within a typical metropolitan region and are located in lower risk flood plains (specific flood zone categorization varies by Region). In addition to discrete uninterruptable po…

I've always assumed that availability zones would not necessarily be in the same building or even site in a given region, but something I've wondered is what does the network look like between zones? Does inter-AZ traffic traverse only fiber that you wholly own? Does AWS send traffic over some shared links in some cases? If only some cases, which cases?

James Hamilton gives a good talk that goes over networking (and more). This is it from reinvent 2014.

https://m.youtube.com/watch?v=JIQETrFC_SQ

Re: An AWS Region is coming to France

#47

Post by grif-fin »

tomcart wrote: post #40
grif-fin wrote: post #33

Earlier quoted context omitted.

" if you're large enough to be in multiple regions, all of this should be configured via the APIs" Is the suggestion to recreate what Amazon Console has done (using APIs) in every large organisation using AWS because Amazon Console is not good enough?

No, treat your infrastructure as code. Define it programatically, version it, have a standard, automated process for recreating it. If you're using AWS then Cloudformation (maybe with an abstraction like troposphere), will do what you need. If you are pressing the big blue 'launch instance' button, you are doing it wrong.

"No, treat your infrastructure as code."

Agreed. Advantage is clear and understood.

My point here is: there exists something called 'Amazon Console'. I argue it is a good thing to have if done properly easing the service management as visualized management is more human friendly and APIs more computer friendly. If there exists a bad visualized service management (e.g. Amazon Console) it is the lack of skills of the humans developing it not because managing a vast complex clusters is easier through APIs/CLI and impossible/wrong via UI.

Re: An AWS Region is coming to France

#48

Post by jeffbarr »

grif-fin wrote: post #6

I do sincerely wished Amazon would have consider changing their AWS service management UI and workflow as well as epanding their servers around the globe. Currently it is an incredibly inefficient design of a service management trying to do everything yet many are dependent for using it.

Do you have some specific feedback that I can share with the team? Which aspects of the console and the workflow are not working for you?

Re: An AWS Region is coming to France

#49

Post by jsingleton »

Symbiote wrote: post #32
jsingleton wrote: post #30

Earlier quoted context omitted.

I've found latency in the UK can be about a third lower than Ireland. I used Bytemark for testing in my recent book but Azure have UK regions now [0] and DO have had a London DC for a couple of years [1]. AWS UK is currently just "coming soon" [2] but Werner has said "end of 2016 (or early 2017)" [3]. [0] https://unop.uk/azure-eu-regions-naming-confusion [1] https://www.digitalocean.com/company/blog/introducing-our-l…

> [0] https://unop.uk/azure-eu-regions-naming-confusion I expect Microsoft are using the UN region names for Europe, where Britain are Ireland are part of Northern Europe. https://en.wikipedia.org/wiki/United_Nations_geoscheme_for_E...

Nice find! That probably explains it.

The UK names still aren't great, even if they sound reasonable in isolation (Cardiff - West, London - South). They have fixed the map though.

Re: An AWS Region is coming to France

#50

Post by shmel »

Cshelton wrote: post #41

So this is great however I have a very large concern. In a U.S. AWS data center, I am very confident (right now) that my encryption keys and encrypted data will never be given out to any governmental agency. Even with a warrant, they can not access my data unencrypted. What will Amazon do when the French government says hand us all of your keys or else... As our data is all extremely sensitive financial information,…

Would you feel better if NSA gets your data using a warrant signed by a secret court and gags Amazon using a NSL? Why do you think that US agencies can ask Lavabit to hand encryption keys, but the same can't happen with Amazon?

Comparing with the US I don't remember that France has any gag laws.

Post reply on HN