Trusting the Cloud

1. Trusting the Cloud Establishing Trust and Keeping Secrets Secure in the Cloud - Javier Godinez

2. Agenda • What • Why? • Cloud controls • IAM • Instance Metadata • The Cloud API • CloudHSM • Building a secure cloudy keystore

3. What • There is a need to develop robust Cloud ready services that help us keep control of our data; we need systems that: • Allow us to take full advantage of the Cloud (autoscaling) • Protect our most sensitive data (crypto keys) • Give us (only us) access to our data (key custody) • Helps us encrypt as much as possible • Verifies access • Separates duties • Has layers of defense

4. Why? • We all want to leverage the Public Cloud, but it is different: • Multitenant • Shared resources (e.g., AMI& EBS) • Elastic • Incredibly easy to make private resources public (e.g., S3)

5. Why? • Cloud controls that amount to checkbox encryption or forces us to reveal private keys: • Offloading SSL at load balancers exposes your private keys to your Cloud provider • If you are using server side encryption (SSE) or transparent data encryption (TDE) your Cloud provider manages they keys (S3, EBS, RDS) • TDE does not protect you against SQL injection

6. Cloud Controls Review

7. Cloud Controls Review • Identity and Access Management • Roles: used to define permissions to access resources • Instance Profiles: used to pass role information to instances (hosts in EC2) Example: { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { JSON }, "Path": String, "Policies": [{ "Statement": [ { "Effect": "Allow", "Action": [ ”s3:GetObject" ], "Resource": “arn:aws:s3:::mybucket/*" } ] }] } }

8. Cloud Controls Review • Identity and Access Management Dos and Don’ts • Use least privilege • Have few IAM administrators, don’t do this -> • If I can define any policy (PutRolePolicy) I can define any policy (split responsibilities) Example: { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { JSON }, "Path": String, "Policies": [{ "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] }] } }

9. Cloud Controls Review • The Metadata service • Delivers information into an instance through the hypervisor • Allows the instance to retrieve information about itself and its environment • It is also a mechanism by which you can run code to configure the instance on first boot • Can be accessed through a simple web call • http://169.254.169.254/latest/

10. Cloud Controls Review • The Metadata service - Instance Metadata • Used to retrieve network information • Used to retrieve temporary application credentials Example: $ curl http://169.254.169.254/latest/meta-data/local-ipv4 172.16.0.23 $ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ myrole $ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/myrole { … "AccessKeyId" : "ASIA9JD9238JHSJH8", "SecretAccessKey" : "...", "Token" : ...", "Expiration" : "2014-10-21T10:08:07Z" }

11. Cloud Controls Review • The Metadata service – user-data • Can be used to configure your instance on boot • But your distro must support this feature (cloud-init) Example: $ curl http://169.254.169.254/latest/user-data #!/bin/bash -ex yum install httpd ...

12. Cloud Controls Review • The Metadata service – dynamic data • Can be used to retrieve the instance identity document • Can be used to retrieve the instance identity signature • There isn’t much documentation, but we can use the signature with an Amazon provided certificate to verify the identity document is valid Example: $ curl http://169.254.169.254//latest/dynamic/instance-identity/document { "instanceId" : "i-ac9893a1", "billingProducts" : [ "bp-83872873" ], "accountId" : ”123456789098", "imageId" : "ami-kjhsk386s", "instanceType" : "m1.micro”, "architecture" : "x86_64", "pendingTime" : "2014-10-03T16:24:13Z", "region" : "us-west-2", "version" : "2010-08-31", "availabilityZone" : "us-west-2b”, "privateIp" : "10.0.21.234" } $ curl http://169.254.169.254//latest/dynamic/instance-identity/signature kjh34ljhlk34M7ZMBwMiUWtZ1L9XgsWCznV1LwYqNK+...

13. Cloud Controls Review • Metadata service Dos and Don’ts • Avoid putting sensitive data in user-data • Protect it, e.g., ensure your http proxy does not relay for 169.254.169.254 • Infrastructure is code, so protect your code repos (without saying) * Nimbostratus by Andres Riancho: good read!

14. Cloud Controls Review • The API • Can do anything that the CloudFormation and the Console can do and more • You can use it to list resources, run instances, copy files… Example: > require 'aws-sdk-core' => true > conn = Aws::EC2::Client.new(region: 'us-west-2') => #<Aws::EC2::Client> > conn.describe_instance_status => #<struct instance_statuses= [#<struct instance_id="i-6461046f", availability_zone="us-west-2a", events=[], instance_state=#<struct code=16, name="running">, system_status= #<struct status="ok", details= [#<struct name="reachability", ... Anything you can do I can do better… Yes I can, yes I can Yes I can! No you cant… Console API

15. Cloud Controls Review • The CloudHSM • A hardware security module (HSM), SafeNet Luna HSM • Provides secure key storage and cryptographic operations • Helps you meet corporate, contractual and regulatory compliance requirements • An appliance that is connected to your VPC • A good place to keep symmetric and asymmetric keys

16. Cloud Controls Review • The CloudHSM Setup • Configuration • Set a password • Initialize the HSM • Create an HSM key pair • Restart network interface • Create a partition Example: $ ssh manager@[hsm_ip_address] lunash:> user password lunash:> hsminit -label [luna_name] lunash:> sysconfregenCert lunash:> ntls bind eth0 lunash:> hsm login lunash:> partition create -partition [partition_name]

17. Cloud Controls Review • The CloudHSM Setup • CloudHSM Client Setup • Copy server cert from HSM to client • Register server cert with client • Generate client cert • Copy client cert to HSM • Register the client • Assign the client partition Example: $ cd /usr/lunasa/bin $ sudoscp -i ~/.ssh/[private_key_file] manager@[hsm_ip_address]:server.pem . $ sudo ./vtladdServer -n [hsm_ip_address] -c server.pem $ sudo ./vtlcreateCert -n [client_name] $ scp -i ~/.ssh/[private_key_file] /usr/lunasa/cert/client/[client_name].pem manager@[hsm_ip_address]: $ ssh -i ~/.ssh/[private_key_file] manager@[hsm_ip_address] lunash:> client register -client [client_id] -hostname [client_name] lunash:> client assignPartition -client [client_id] -partition [partition_name]

18. Cloud Controls Review • A few notes about the CloudHSM • Upfront setup cost of $5K • If you loose your admin password you loose your data • Does not play nice with autoscaling, client registration is static • It is not Cloud aware, that is it does not leverage e.g., IAM to make access determinations • It is built for the datacenter not for the Cloud even it if has Cloud in its name • Easily integrated with Java as a crypto provider • …but, it is still a good place to keep keys

19. A Secure Cloud Environment

20. A Secure Cloud Environment • So, we have some pretty good controls that we can take advantage of, what to do…? • How about combining these controls together to build a Secure Cloudy Keystore?

21. A Secure Cloud Environment • Simple deployment where the CloudHSM is used to house all secrets and all hosts have access to all secrets • But it has all the weaknesses we pointed out previously

22. A Secure Cloud Environment • Secure Cloudy Keystore • Centralize access to the HSM • Minimizes manual setup • Need to seed user pin in one place only • Verify access to keys using other controls

23. A Closer Look: AWS API Metadata Service Cloud-init

24. A Secure Cloud Environment • What can we verify through the API when an instance is requesting a secret? • Instance Profile/IAM Role • Role permissions • Instance Identity Document (IID) fields • IID signature • Request IP Address • Uptime • Etc…

25. A Secure Cloud Environment • A review of our principles: • Isolates HSM interactions • Allow us to take full advantage of the Cloud • Protect our most sensitive data • Give us (only us) access to our data • Helps us encrypt as much as possible • Verifies access • Separates duties • Has layers of defense

26. Questions?

27. Thank You! Javier Godinez godinezj at gmail