Hacker News new | ask | show | jobs
by pclmulqdq 1181 days ago
This isn't how things always run in the cloud. I think the conventional wisdom is that the isolation of VMs is good enough unless you are very paranoid. Auth services are regularly run on less than full baremetal machines.

AWS serverless, by the way, uses VM isolation.
1 comments
jmillikin 1181 days ago
Both AWS and GCP offer the ability to schedule VMs onto isolated machines:

https://aws.amazon.com/ec2/dedicated-hosts/

https://cloud.google.com/compute/docs/nodes/sole-tenant-node...

The AWS offering is pretty much turn-key. I've not used the GCP version, but it seems to be similar if you're willing to create a separate "project" for each security domain.

Once your company has any PII and/or has regulatory obligations (PCI, HIPAA, etc) then it's worth spending a bit extra to make sure sensitive components are running on their own hardware.

link
pclmulqdq 1181 days ago
Usually you have to buy the whole host when you do that, and there are many ways to buy the whole machine. I personally think baremetal is a better trade - Amazon insiders have a harder time spying on you if you do that, while they can still pause your dedicated VM to take a peek at what's going on. Regardless, I have seen authentication systems and other sensitive things run on multi-tenant machines.
link