Announcing the New AWS Secret Region

https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/

by marvinpinto • 9 years ago

206 89 9 years ago

aws.amazon.com

rbanffy• 9 years ago

Cue in the "Dammit! We are not supposed to talk about it" jokes

philipov2• 9 years ago

When I first saw the headline, I thought it had something to do with secrets management, for, like, ssh keys... Why would they need an entire region for that?

nathan_long• 9 years ago

I thought it was going to be like East or West, but We're Not Telling You Where. :)

iagooar• 9 years ago

Security. No better separation, than physical.

cwkoss• 9 years ago

Hopefully it prevents S3 buckets from being set to public.

STRML• 9 years ago

The new S3 console/flow sets to private by default - so some progress there, all jokes aside.

nhumrich• 9 years ago

S3 has always been private by default. But too many people open it up to the world for convenience.

mtgx2• 9 years ago

And it only took the Pentagon exposing its main surveillance operation to get Amazon to make that change. Progress.

I wonder what other improvements we'll see when CIA's surveillance or drone strike data is also exposed to the public by a similar fuckup? Fully homomorphic encryption?

dantiberian2• 9 years ago

It goes one step better, it isn’t even connected to the Internet!

andy_ppp• 9 years ago

Will it be locatable by latency (roughly) or is that not the point?

Additionally, if I was doing secret things I'd really think it was not a great idea to put that into a data centre marked "Definitely where I keep all of my secrets".

mewfree• 9 years ago

I don't think the point is to hide its real location or to hide secrets, but to be able to build services that comply with US classification levels (sensitive, secret, top secret).

empath752• 9 years ago

It’s not on the Internet.

hackcasual2• 9 years ago

Sounds like this is an expansion of this: https://www.theatlantic.com/technology/archive/2014/07/the-d...

to non-Intelligence Community users. You'll still need US Government Secret Clearance though.

jazoom2• 9 years ago

We are pleased to announce the new AWS Secret Region. The AWS Secret Region can operate workloads up to the Secret U.S. security classification level. The AWS Secret Region is readily available to the U.S. Intelligence Community (IC) through the IC’s Commercial Cloud Services (C2S) contract with AWS.

jazoom2• 9 years ago

Usually when I post a quote from the article to shed light on what it's actually talking about it is appreciated. What's different about this time that causes a bunch of downvotes?

dsr_• 9 years ago

As long as there is only one Secret region, you can have reliability or you can have classified data, but not both.

spullara• 9 years ago

As long as they have multiple zones you can get the reliability ~ huge natural disaster that may affect other regions anyway.

mrep3• 9 years ago

Someone posted above that there already was one before and this is the second: https://www.theatlantic.com/technology/archive/2014/07/the-d...

discodave2• 9 years ago

First region is top secret. So technically data in the existing region could be moved to the new region, but not vice versa.

frandroid• 9 years ago

It doesn't say anywhere that this is a geographically distinct region.

openasocket• 9 years ago

It would have to have at least physically separate data centers, that's kind of the whole point of having this in the first place.

valbaca• 9 years ago

region != zone

jacquesm• 9 years ago

If your secret region goes down the data just got more secret.

degenerate• 9 years ago

Somehow I can see this being an actual argument in government bids, and contracting officers gobbling it up...

samstave• 9 years ago

A region is a cluster of typically three distinct data centers and this could have the three D.C.'s distributed geographically in a model specifically designed to provide both.

Rebelgecko• 9 years ago

Is this part of Govcloud? Unfortunately Govcloud doesn't support a handful of AWS services, it would be nice if this was more complete

hackcasual2• 9 years ago

It's not, though it's related. Govcloud only supports up to "Controlled Unclassified Information." This can handle Secret and Top Secret. I'd expect it to be even further restricted in terms of supported services.

rad_gruchalski• 9 years ago

What's the point of announcing it publicly?

Gaelan• 9 years ago

Investors?

jandrese• 9 years ago

If they didn't nobody would know about it. It's not like Amazon has a big list of email addresses of people who have Secret data that they might want to put on the cloud. Even if they did have a list of government people like that, most of the people interested in this service are contractors who don't officially work for the government.

The government doesn't work like those spy movies where everybody knows everything the instant it happens. It's more like a big bloated corporation with thousands of subcontractors and generally lousy communication all around.

empath752• 9 years ago

There’s hardly anyone in tech with a clearance in dc who didn’t know this was coming. They’re recruiting like crazy for it.

BLanen• 9 years ago

What's the point of keeping it secret?

walshemj• 9 years ago

OPSEC

outworlder• 9 years ago

Just because it's called AWS "Secret", it doesn't mean it has to be a secret :)

DonHopkins2• 9 years ago

Secrecy as a Service.

martyvis• 9 years ago

What's the point of hiding it's existence? (Security by obscurity doesn't work).

Spooky23• 9 years ago

Contractors.

DonHopkins2• 9 years ago

It's actually a giant honeypot.

alexnewman• 9 years ago

I spent a lot of time on gov cloud console at a couple of jobs. It's very limited. At the time they didn't have lambda.

CJKinni• 9 years ago

What does it mean for something to be an "air-gapped commercial cloud"?

jlgaddis4• 9 years ago

The "Top Secret" cloud is not connected to the Internet.

user5994461• 9 years ago

Which obviously can't be true or it would be inaccessible and thus utterly useless.

Zarathust• 9 years ago

They have a robot constantly hot-swapping disks between racks maybe?

jo909• 9 years ago

I know of two government approved methods for data transfers for closed networks, one of which is pretty close. You basically have two servers connected to the same disk array, and they take turns mounting it to move files onto/off it. There is of course scanning and logging and such involved.

The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through.

Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.

mrep3• 9 years ago

https://en.wikipedia.org/wiki/Air_gap_(networking)

jimktrains2• 9 years ago

It's probably connected only to the us government secret network (I forget the acronym) and not the public internet.

nhf• 9 years ago

The contracted top secret cloud is connected to JWICS. JWICS and SIPRnet (the secret counterpart) are both government internets (but are not the Internet with a capital I).

jlgaddis4• 9 years ago

Now all of your e-mails and private data don't have to be carried all the way around the world back to Bluffdale, they can simply be dumped into AWS!

AaronFriel• 9 years ago

Article says that this is the first cloud provider certified for these workloads, but I believe both Microsoft Azure and Amazon AWS began negotiating these contracts around the same time.

Microsoft announced their version a few weeks ago[1]. I wonder if Google will follow shortly?

[1] https://azure.microsoft.com/en-us/blog/announcing-new-azure-...

killjoywashere2• 9 years ago

Microsoft's announcement has a lot "will". Amazon's has a lot of "is".

jknoepfler2• 9 years ago

Where the "is" should be generally understood as "is[1]"

[1] but in such a poorly tested, underbaked fashion you probably shouldn't bother for a few years

IncRnd2• 9 years ago

https://aws.amazon.com/compliance/fedramp/

https://azure.microsoft.com/en-us/blog/azure-government-exte...

zitterbewegung• 9 years ago

Anyone use this feature ? Also where is this region located ? ( Washington DC ?)

softgrow• 9 years ago

From the headline I was actually expecting a ‘mystery trip’ region, cut price but you don’t find out where till you start using it.

SimbaOnSteroids• 9 years ago

Right like its actually AWS Atlantis-West.

Antrikshy• 9 years ago

Wakanda

gesman• 9 years ago

AWS is a 3-letter agency from now on :)

mockery• 9 years ago

"With the new AWS Secret Region, we are bringing the same tools and workflows that are already available for Top Secret workloads to customers with Secret datasets and workloads."

Does this mean they already had an AWS "Top Secret" Region?

nova22033• 9 years ago

Yes. It's called C2S.

dantiberian2• 9 years ago

http://www.defenseone.com/technology/2015/07/how-break-cias-...

WatchDog• 9 years ago

Does anyone know what sort of price premium AWS charge for their secret regions over their public commercial regions?

discodave2• 9 years ago

They're not charging per GB of S3 or whatever. It's likely a fixed(ish) priced contract that basically covers their cost of building a complete region. So the pricing doesn't really compare.

Basically, AWS is all public cloud, none of this private cloud nonsense... until you come along with a $600MM check and then you can have a private region all to yourself!

mrep3• 9 years ago

Someone's still got to pay the energy bill and for new servers to account for growth.

I don't see why they would throw at their current billing model for something else.

frabbit• 9 years ago

the CIA has placed a big bet on adopting commercial cloud technology

Can't they get the NSA to rent them some of their spare capacity from the CNCI? Or is this because they trust Amazon to have actually solved the hard problems?

https://en.wikipedia.org/wiki/Utah_Data_Center

Announcing the New AWS Secret Region

Related Stories