Hacker News Reader

Comment by insomniacity | Hacker News Reader

> Regions – Rotation is needed for database instances in all commercial AWS regions except Asia Pacific (Hong Kong), Middle East (Bahrain), and China (Ningxia).

I wonder why?

Are these CAs subject to... shall we say, additional goverment oversight?

View on HN

It's because those regions were created after the 2019 certificate was released. Hence there is no 2015 cert for those. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...

Fair enough - I didn't realise they'd launched regions that recently!

The Ningxia region might not support encryption. That one was released in 2017. Unsure about this one.

Yeah, Ningxia is a weird region. It’s run under license by a Chinese company, and KMS isn’t available, which by extension means most encryption isn’t either since that’s all built on top of KMS these days.

I wonder why they do that instead of asking for access to the private keys.

KMS launched in Ningxia (and Beijing) in June: https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-n...

Oh, fair enough, last time I looked into the China regions that didn't exist. Reading the announcement I'm loving the seeming contradiction between " AWS KMS is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Chinese government-approved hardware security modules to protect the security of your keys." and the very next sentence "The service is designed so that no one, including KMS service operators, can retrieve your plaintext master keys from the service."

Something tells me those master keys aren't quite as secure as you'd expect in other regions.

The US government also has their own set of security requirements for AWS regions in the USA that serve the US government.

If the government wants your database, I'm guessing they just ask Amazon for a copy. They don't need to break TLS to do that.

Yes, but if they're already in the network (although I've nothing to suggest they are), MITMing the database connection means they get the data immediately, rather than at the next quasi-judicial request.

Reply on news.ycombinator.com