This thesis work was conducted within beSharp, an IT company that provides products based on Cloud Computing. Under the "Noovolari" team has been deployed a software called Leapp to manage Cloud login credentials for Cloud providers like AWS, Azure, and Google Cloud Platform. These providers offer services and solutions to build Cloud IT infrastructures and also dedicated services to keep secure connections to virtual machines, to manage applications and databases. Nowadays, each developer deals with virtual machines that can be on Premises or created into a Cloud Provider which, allows running a remote instance with a preferred operating system on demand and avoids overloading a local machine with multiple nodes exploiting its hardware components. However, when a user wants to establish a connection with a remote instance it should use the console offered by each Cloud Provider or take advantage of the SSH protocol. In contrast to this, every virtual machine has a public IP address and which means that it is publicly accessible, which can be a vulnerability for those who host applications in a virtualized environment like a managed node. A possible solution is to have a connection just by the private IP address and forward the traffic from the client to the remote node just through a central location that, filters incoming traffic and results to be not vulnerable. There are many solutions provided by managed services in AWS, Azure, GCP to have a secure connection to a virtual machine established with different authentication and authorization checks. Talking about AWS, it provides a service called Session Manager that removes the need to have a public address since each virtual machine is accessed just by the private address and controls incoming requests through a managed service called Identity and Access Management which allows defining roles and policies to restrict access to a specific resource declaring particular policies. One of Leapp’s features is the integration of Session Manager and granting direct access to virtual machines(EC2 instances) created in AWS without performing actions using the AWS Console. However, Leapp is a multi-cloud application and there is the need to replicate the same feature for virtual machines created in Azure and Google Cloud. In this thesis work, with the Noovolari team, it has been decided to focus on the analysis, design, and implementation of a possible solution of integration into Leapp of managed services like Azure Bastion and GCP Identity-Aware Proxy which could provide a secure connection to a virtual machine.
Analisi e studio di soluzioni AWS, Azure e Google Cloud per una connessione sicura a macchine virtuali tramite progetto open-source Leapp. Questo lavoro di tesi è stato condotto all'interno di beSharp, un'azienda IT che fornisce prodotti basati sul Cloud Computing. Sotto il team "Noovolari" è stato implementato un software chiamato Leapp per gestire le credenziali di accesso al Cloud per Cloud provider come AWS, Azure e Google Cloud Platform. Questi provider offrono servizi e soluzioni per costruire infrastrutture Cloud IT e anche servizi dedicati per mantenere sicure le connessioni alle macchine virtuali, per gestire applicazioni e database. Al giorno d'oggi, ogni sviluppatore si occupa di macchine virtuali che possono essere On Premises o create in un Cloud Provider che, consente di eseguire un'istanza remota con un sistema operativo preferito su richiesta ed evita di sovraccaricare una macchina locale con più nodi sfruttandone i componenti hardware. Tuttavia, quando un utente vuole stabilire una connessione con un'istanza remota deve utilizzare la console offerta da ciascun Cloud Provider o sfruttare il protocollo SSH. Al contrario, ogni macchina virtuale ha un indirizzo IP pubblico e ciò significa che è pubblicamente accessibile, il che può rappresentare una vulnerabilità per coloro che ospitano applicazioni in un ambiente virtualizzato come un nodo gestito. Una possibile soluzione è avere una connessione solo tramite l'indirizzo IP privato e inoltrare il traffico dal client al nodo remoto solo attraverso una posizione centrale che filtri il traffico in entrata e risulti non vulnerabile. Esistono molte soluzioni fornite dai servizi gestiti in AWS, Azure, GCP per avere una connessione sicura a una macchina virtuale stabilita con diversi controlli di autenticazione e autorizzazione. Parlando di AWS, fornisce un servizio chiamato Session Manager che elimina la necessità di avere un indirizzo pubblico poiché ad ogni macchina virtuale si accede solo dall'indirizzo privato e controlla le richieste in arrivo attraverso un servizio gestito chiamato Identity and Access Management che permette di definire ruoli e policy per limitare l'accesso a una risorsa specifica dichiarando politiche particolari. Una delle funzionalità di Leapp è l'integrazione di Session Manager e la concessione dell'accesso diretto alle macchine virtuali (istanze EC2) create in AWS senza eseguire operazioni utilizzando la Console AWS. Tuttavia, Leapp è un'applicazione multi-cloud e c'è la necessità di replicare la stessa funzionalità per le macchine virtuali create in Azure e Google Cloud. In questo lavoro di tesi, con il team di Noovolari, si è deciso di concentrarsi sull'analisi, la progettazione e l'implementazione di una possibile soluzione di integrazione in Leapp di servizi gestiti come Azure Bastion e GCP Identity-Aware Proxy che potesse fornire una connessione sicura a una macchina virtuale.
Analysis and study of AWS, Azure and Google Cloud solutions for secure connection to virtual machines through open-source project Leapp
CREA, GIUSEPPE NUCCIO
2021/2022
Abstract
This thesis work was conducted within beSharp, an IT company that provides products based on Cloud Computing. Under the "Noovolari" team has been deployed a software called Leapp to manage Cloud login credentials for Cloud providers like AWS, Azure, and Google Cloud Platform. These providers offer services and solutions to build Cloud IT infrastructures and also dedicated services to keep secure connections to virtual machines, to manage applications and databases. Nowadays, each developer deals with virtual machines that can be on Premises or created into a Cloud Provider which, allows running a remote instance with a preferred operating system on demand and avoids overloading a local machine with multiple nodes exploiting its hardware components. However, when a user wants to establish a connection with a remote instance it should use the console offered by each Cloud Provider or take advantage of the SSH protocol. In contrast to this, every virtual machine has a public IP address and which means that it is publicly accessible, which can be a vulnerability for those who host applications in a virtualized environment like a managed node. A possible solution is to have a connection just by the private IP address and forward the traffic from the client to the remote node just through a central location that, filters incoming traffic and results to be not vulnerable. There are many solutions provided by managed services in AWS, Azure, GCP to have a secure connection to a virtual machine established with different authentication and authorization checks. Talking about AWS, it provides a service called Session Manager that removes the need to have a public address since each virtual machine is accessed just by the private address and controls incoming requests through a managed service called Identity and Access Management which allows defining roles and policies to restrict access to a specific resource declaring particular policies. One of Leapp’s features is the integration of Session Manager and granting direct access to virtual machines(EC2 instances) created in AWS without performing actions using the AWS Console. However, Leapp is a multi-cloud application and there is the need to replicate the same feature for virtual machines created in Azure and Google Cloud. In this thesis work, with the Noovolari team, it has been decided to focus on the analysis, design, and implementation of a possible solution of integration into Leapp of managed services like Azure Bastion and GCP Identity-Aware Proxy which could provide a secure connection to a virtual machine.È consentito all'utente scaricare e condividere i documenti disponibili a testo pieno in UNITESI UNIPV nel rispetto della licenza Creative Commons del tipo CC BY NC ND.
Per maggiori informazioni e per verifiche sull'eventuale disponibilità del file scrivere a: unitesi@unipv.it.
https://hdl.handle.net/20.500.14239/14359