Behind the scenes: AWS investments in security innovation
summary
AWS describes concrete infrastructure and cryptography work: the Nitro system uses custom Nitro cards, a minimized hypervisor, and a security chip to provide hardware roots of trust, live updates, and zero operator access (NCC Group review finds no gaps). s2n TLS and Firecracker replace legacy stacks for smaller, verifiable crypto and container isolation. KMS HSMs reach FIPS 140-2 Level 3 and are submitted for 140-3; External Key Store uses a double-envelope wrap. Automated reasoning powers IAM Access Analyzer and VPC Reachability Analyzer.
AI-written summary · about
chapters (13)
- 0:00Introduction and philosophy
- 2:14Culture of security ownership
- 6:10Shared responsibility model
- 9:29Global network infrastructure
- 12:23VPC networking and security
- 17:44Data encryption in transit
- 18:53The Nitro system
- 25:12Compute isolation and firecracker
- 27:03Cryptography and HSMs
- 34:21External key store and XKS
- 38:18Future-proofing cryptography
- 49:23Identity and authorization
- 55:40Provable security and automated reasoning
related talks
25mOverview of the AWS Nitro System: Building Trust Through Secure Cloud Infrastructure
46mEnhance security with the AWS Nitro System
01h 19mKeynote
28mAWS security at scale
39mExplorations of cryptography research
24mConfidential Compute Architecture
24mNitro System Innovation
09mAn introduction to Confidential Computing