MongoDB Distribution in EC2 Regions

Question

I want to distribute a deployed / replicated MongoDB setup across several Amazon EC2 regions. Is this traffic already encrypted with MongoDB or can I configure it? Or does Amazon offer a dedicated VPN connection between its data centers?

Answer 1

Yesterday I answered a similar question about Apache Cassandra: Securing Cassandra with TLS / SSL .

My experience was, in particular, with Amazon, if possible, to set up a VPN between your instances to ensure that everything is safe. An interesting fact that we encountered when implementing our VPN over EC2 was that the response time was faster ... We chose Vyatta and have been very pleased so far. It can be fully virtualized ... and allows us to connect between zones, regions and data centers (Amazon, not Amazon).

Another option is to use the Amazon Virtual Private Cloud :

• Create an Amazon virtual private cloud on your scalable AWS infrastructure and specify its range of private IP addresses from any range you select.
• Divide the range of private VPC IP addresses into one or more public or private subnets to facilitate the launch of applications and services on your VPC.
• Control of inbound and outbound access to and from individual subnets using network access control lists.
• Store data in Amazon S3 and set permissions so that data can only be accessed from your Amazon VPC.
• Attach Amazon Elastic IP address to any instance of your VPC so that it can be obtained directly from the Internet.
• Bridge your VPC and your IT infrastructure in place with an encrypted VPN connection, extending existing security and management policies to your VPC instances as if they were running on your infrastructure.

Vyatta has nice graphics showing how VPC and Vyatta (or any other corporate VPN solution) can connect together (as in the last paragraph above):

• http://www.vyatta.com/sites/vyatta.com/files/images/Vyatta_Amazon.png

• http://www.vyatta.com/solutions/amazon

I do not work for Vyatta ... just as well as we managed to achieve everything that could not do without buying an expensive cisco device

Answer 2

According to [mongo docs] , you can use SSL for mongo . You could either compile the mongo with the -ssl flag, or use the commercial version. With SSL protocol support, all communications between the database and the client, as well as the communication between the replica sets and the arbiter, are protected (see faq ).

Has anyone really tried this approach? Are there any disadvantages?

Answer 3

If you are not working on EC2, these solutions are not really an option. There is another way, which is to create your own independent VPC provider IaaS. VCider has a solution for this that works well with Mongo as well as with Kassandra. For Cassandra, providing client / DB traffic is especially painful since there is no native encryption.

A good example of how it all works here:

http://www.vcider.com/vpc-deployments/secure-saas

As for Kassandra, there is some kind of reference information.

http://blog.vcider.com/2011/09/virtual-networks-can-run-cassandra-up-to-60-faster/

With native encryption in the kernel, you can work much faster.

Answer 4

Mongo messaging through replicas is not encrypted. So, you are on yours. You can create a replica in availability zones in the area

Answer 5

You yourself use the encryption of data transferred between EC2 regions. Amazon does not guarantee that they will be connected to private channels, so you should assume that they go through public networks.