Re:Zenbleed
by yencabulator on Monday July 24, 2023 @05:00PM
(#36854130)
You can pay AWS a premium to make sure you're the only tenant on the physical machine. You can also split your own stuff into multiple tenants, and keep those separate too.
[ Parent
| on HN ]
Re:Zenbleed
by nicolas_17 on Monday July 24, 2023 @06:19PM
(#36855036)
At which point you don't really need the flexibility of AWS and you might as well get a Dedicated Server elsewhere?
Re:Zenbleed
by yencabulator on Monday July 24, 2023 @06:21PM
(#36855054)
It'll still let you do the elastic scaling stuff, billing for actual usage instead of racked hardware.
Re:Zenbleed
by segfaultbuserr on Monday July 24, 2023 @11:55PM
(#36857674)
Eric Brandwine (VP/DE @ AWS) said publicly in 2019 that EC2 had never scheduled different tenants on the same physical core at the same time, even before we learned about these kinds of side-channel attacks.
Re:Zenbleed
by yencabulator on Tuesday July 25, 2023 @12:01AM
(#36857714)
Yes (lowest vCPU seems to be 2 everywhere), and that protects against this attack. However, this thread was talking about airgapping hosts, which is needed for the general threat of VM escapes.
At least Fargate and Lightsail can select < 2 vCPU. (and maybe micro EC2 instance types?)
Re:Zenbleed
by yencabulator on Tuesday July 25, 2023 @12:26PM
(#36864864)
Well, that does sound like those were vulnerable then, if they happened to run on Zen 2. (Obviously microcode patched by now.)
As usual, cost is the biggest hindrance to security.
Even before then, the sufficiently paranoid (but still bound to AWS for whatever reason) would track usage/steal/IO reporting along with best guesses for Amazon hardware expidenture and use that information to size instances to attempt to coincide with 1:1 node membership.