Cloud Security
In our previous session, we explored runtime security. In this microlearning, we are shifting our focus to cloud security within the eMagiz cloud. This module will delve into high-level security measures, including cloud setup, cloud location, cloud slot, cloud template, and the carwash in the cloud. Whether you're familiar with these concepts or new to them, this microlearning will enhance your understanding of how to secure your solutions effectively in the cloud.
Should you have any questions, please contact academy@emagiz.com.
1. Prerequisites
- Intermediate knowledge of the eMagiz platform
2. Key concepts
This microlearning centers on cloud security.
- With cloud security, we mean: The measures that are taken within the context of the eMagiz cloud to secure the eMagiz cloud properly for our customers
3. Cloud security
In the last microlearning, we focused on runtime security. In this microlearning, the focus will be on various aspects of cloud security when running your solution in the eMagiz cloud. We will focus on high-level security measurements within the cloud. We will look at the cloud setup, cloud location, cloud slot, cloud template, and the carwash in the cloud.
- The key aspects are:
- Running in the cloud works for both single as well as double lane setups
- The cloud template governs how the various components are deployed within the cloud
- The carwash enables additional security measures
3.1 Cloud setup
In the picture shown below, you see a standard double-lane setup of an eMagiz instance within the eMagiz Cloud. A single-lane setup looks similar but only consists of one core machine.
This gives a good insight into how messages are flowing through the cloud, which measures are taken for monitoring and auto-healing, and where data is temporarily stored 'in transit'.
We would like to use this picture to explain certain components within the cloud from a security perspective. We will start at the outside and work our way inwards.
3.2 Cloud location
Within the AWS cloud, there are several regions where your cloud setup can be running. Examples of these regions are us-east-1, af-south-1, ap-northeast-1, eu-central-1.
As you can see in the picture eMagiz cloud slots are running within the eu-central-1 region. This region is located in Frankfurt and falls therefore under European data and security laws such as the GDPR.
3.3 Cloud slot (VPC)
Within this region, a unique cloud slot per customer is assigned. In the picture, this is represented as a Virtual Private Cloud (VPC). Setting up a VPC provides a logically isolated section of the AWS Cloud where AWS resources can be launched in a virtual network defined. There is complete control over the virtual networking environment, including a selection of the IP address range, creation of subnets, and configuration of route tables and network gateways.
Incoming data from the internet passes through a load balancer to route data randomly to one of the core machines containing the runtimes holding the process flows. The setup of a VPC is governed by what is called a Cloud Template.
3.4 Cloud template
This Cloud Template, designed by eMagiz defines the setup of the cloud instance. The following parts of the cloud setup are configured here:
- Java version
- OS version (Linux)
- Runtime version
- Auto healing
- Monitoring
- Notification options
Staying on the latest cloud template version guards yourself against vulnerabilities in older versions of Java and OS for example. In addition, it gives the user more options for monitoring the health of the cloud environment reducing the risk of a loss of availability of data (promptly) without compromising the integrity of the data.
As one can imagine anyone with access to the machines where runtimes are running on can compromise the availability, integrity, and confidentiality of data. eMagiz offers two locations where eMagiz runtimes can be installed. Per location, specific security measures are discussed that should be taken to ensure the availability, integrity, and confidentiality of the data. More information on cloud templates can be found here.
3.5 Carwash
All data that is exchanged between an external system and a cloud instance goes through the carwash that protects all client instances from harm and routes data to the correct client instance.
In terms of security this means the following benefits from being behind the carwash:
- The connection is HTTPS instead of HTTP via the emagiz.com certificate
- Your VMs are protected because the carwash only allows relevant traffic to get through
- It gives you the ability to submit a certificate request via the Support portal to ensure two-way SSL (both server as well as client certificate validation).
4. Key takeaways
- eMagiz cloud supports both single and double lane setups, ensuring versatility in deployment options.
- The cloud template defines the configuration of your cloud instance, including Java and OS versions, runtime settings, auto-healing, monitoring, and notifications. Keeping it up-to-date helps mitigate vulnerabilities and enhance security.
- The carwash provides additional protection by using HTTPS connections, filtering traffic to your virtual machines, and supporting two-way SSL for improved data security.
5. Suggested Additional Readings
If you are interested in this topic and want more information please check out these links: