0

I have a questions.

  • I run MongoDB on one of instances of EC2 and application on Elastic BeansTalk.
  • I restricted access to DB: only application can access it.
  • DB instance has Elastic IP because it is replicated in different zones, so private IP is not an option.

Questions:

  1. Can communication between application and DB be eavesdropped?
  2. Should I implement SSL with mongo connection?

Thanks in advance to everyone!

2 Answers 2

0

If eavesdropping of traffic intra-cloud is a potential issue for you, you really should implement the connection over SSL. You should also consider running all of your resources in a VPC (virtual private cloud). This allows you to isolate all of your EC2 resources in a private network that is isolated from the rest of the traffic. It also enables you to control where the points of connection to the external world are and how they behave.

3
  • Thanks for advice! I'm not sure that trafic is intra cloud... Is it so?
    – user2982432
    Nov 12, 2013 at 10:36
  • If the resources are in the same region, but different AZ's then it should be intra-cloud. If the resources span multiple regions then we're talking about inter-cloud traffic, and SSL is of course a much important feature in this case.
    – andreimarinescu
    Nov 12, 2013 at 11:29
  • Thanks again. I went through their documentation, they indeed say that across regions one should consider encryption, as you suggest. They do not say this about "across AZ", so I assume that it is intra-cloud. Moreover, they guarantee that no spoofing, port scanning or phishing is allowed intra-cloud. Thanks a lot again, really helped me to clear up situation!
    – user2982432
    Nov 12, 2013 at 19:49
0

If eavesdropping of traffic is an issue, then realistically you probably don't want to be using cloud services. Cloud services are great, but they do come at a cost, one of which is you have no real control of where your data is going or who is looking at it.

You can use SSL and the like, but ask yourself if someone is able to capture your data off the line (so are targeting you personally), wouldn't they also be able to do that via a man in the middle attack or some other means.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.