riptano/ComboAMI — pull request #33 by jdsumsion (2014-02-06 23:32:57+00:00)
Title: Security: Removing step 0 'git pull'

If anyone contrives to gain access to the riptano/ComboAMI repository, they
could push a commit that would immediately start running arbitrary code on
any datastax AMI launch in the world. They would be able to do this without
gaining access to the datastax AWS account. They would then have access
inside the AWS account that cassandra is being launched in, as long as the
launched instance can talk back to github to auto-pull the exploit.

Other options for better security:
a) fork ComboAMI, apply this patch, build your own AMI based on your fork, or
b) apply a firewall to avoid talking back to github (VPC or iptables), or
c) build your cassandra clusters without the ComboAMI automation (roll your own)

All of those other options sound pretty inconvenient -- it would be nice to
have a more secure default launch.

If this commit is accepted, then it would be harder to run arbitrary code.
It would be necessary to both 1) own riptano's computer, and 2) insert logic
into the AMI at build time. Or it would be necessary to gain access to the
datastax AWS account and insert the logic into the AMI post-build. Both of
which would seem to me to be less likely than gaining access to a single git
repo.

The obvious downside is that it's harder to ship ComboAMI fixes/tweaks
because it involves building a whole new AMI for any slight change.

I think that the pain of having to update the AMI more frequently pays down
a significant central security risk, and it's worth the inconvenience.