What is the expectation of privacy on an EC2 instance?

Question

If I turn on a machine in EC2, what expectation of privacy do I have for my running processes, command line history, data stored on ephemeral disk, etc?

Can people at Amazon decide to take a look at what I'm running?

Could Amazon decide to do some profiling for the purposes of upselling?

Hi there! Looks like you're running Cassandra! Here's the optimal tuning requirements for Cassandra on your m1.xlarge machine!

I can't seem to find anything in the docs...

Answer 1

What you are asking about should be addressed in their "Data Privacy" policy (http://aws.amazon.com/agreement/) in their Customer Agreement page:

3.2 Data Privacy. We participate in the safe harbor programs described in the Privacy Policy. You may specify the AWS regions in which Your Content will be stored and accessible by End Users. We will not move Your Content from your selected AWS regions without notifying you, unless required to comply with the law or requests of governmental entities. You consent to our collection, use and disclosure of information associated with the Service Offerings in accordance with our Privacy Policy, and to the processing of Your Content in, and the transfer of Your Content into, the AWS regions you select.

Here's a link to their "Privacy Policy":

http://aws.amazon.com/privacy/

So in essence, it's saying that you need to consent for them to gather information stored in your server. Now that's different from poking at the TCP ports on your machines from the outside. Amazon constantly runs port checking and traffic checking from the outside (it could be in their intranet too) to make sure you are complying with their customer agreement. For example, they can monitor that you are not hosting something illegal (through public content) or that you are not sending spam or robot traffic to hack into other servers.

Having said that, it's quite possible that they use some of these monitoring tools to check: ok this person has port so and so open. So he/she must be running this application and we can suggest something better for them.

Hope it helps.

Answer 2

This is the most applicable thing I found:

AWS only uses each a customer's content to provide the AWS services selected by that customer and does not use customer content for any other purposes. AWS treats all customer content the same and has no insight into what type of content the customer chooses to store in AWS. AWS simply makes available the compute, storage, database, mobile, and network services selected by the customer. AWS does not require access to customer content to provide its services.

http://aws.amazon.com/compliance/data-privacy-faq/