Core Compute & Isolation
AWS Nitro System
A clean break from traditional virtualization. It shrinks the shared attack surface by offloading networking, EBS, and administrative management onto dedicated, custom-built Nitro Cards.
Nitro Security Chip
Performs hardware-verified secure boot, cryptographically ensuring only authorized AWS firmware executes. It completely locks down administrative access, preventing even AWS engineers from accessing tenant memory spaces.
Under the Hood Architecture
VPC Hardware Firewall
Security Groups operate at the hypervisor level. The system verifies the cryptographic identity of the sender before the packet even touches the destination virtual machine.
VPC Traffic Mirroring
Copies live packet data from an elastic network interface to a blue-team sensor — Suricata or Zeek — fully out of band, giving DFIR teams real network forensics without ever touching the production data path.
Real-World Attack Surface
IAM Complexity & Privilege Creep
IAM relies on highly granular JSON policies. The sheer volume of permissions routinely leads to severe privilege escalation vectors through overly permissive, misconfigured roles.
SSRF targeting IMDSv1
Server-Side Request Forgery (SSRF) remains a primary attack vector. Exploiting legacy IMDSv1 allows attackers to extract highly-privileged IAM credentials via web application flaws.
Mandatory Hardening Baseline
- Enforce IMDSv2 Globally: Forcefully disable IMDSv1 across the entire fleet to neutralize SSRF metadata theft via session-based tokens.
- Root Account Security: Hardware Multi-Factor Authentication (MFA) on the root account is absolutely non-negotiable.
- Strict IAM Boundaries: Least-privilege must be verified via IAM Access Analyzer, especially restricting cross-account managed service roles.
Architecture Comparison
| Component | AWS | GCP | Azure |
|---|---|---|---|
| Isolation Architecture | Nitro System (Hardware offload) | KVM (Custom/Non-QEMU) | Hyper-V + Cerberus chip |
| Network Visibility | VPC Flow Logs (Costly) | Native Packet Mirroring | NSG Flow Logs |
| Identity Security Tax | Moderate (Directory Services cost) | Severe ($7.20/user/mo for SCIM) | High (Entra ID P1/P2) |
| Key Management | KMS (FIPS 140-2 L2) / CloudHSM | KMS / Cloud HSM (L3) | Key Vault (L2) / Managed HSM |
