Skip to main content

Security and privacy

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

This page summarizes what the platform guarantees, and what you need to know to benefit from it.

Your resources are isolated​

  • Everything you create belongs to your tenant. Other customers see neither your applications, nor your secrets, nor your domains, nor your images, and cannot reach them.
  • The tenant of an action is always the one from your session. A manifest cannot target another tenant: so you never have to specify one.
  • To work on another tenant, you must have been invited to it (sng tenant assume).

Your applications are protected by default​

  • A service only accepts the traffic you allow: traffic from the other services of the same application, from the applications you list in allowFrom, and from the Internet if it is exposed. Nothing else reaches it.
  • A service only reaches the Internet if you ask for it (egress: [internet]).
  • Your containers run without administrator privileges. An image that requires running as administrator does not start: use an image designed for an unprivileged user.
  • Each exposed address automatically receives an HTTPS certificate, renewed without intervention.

Your secrets stay secret​

  • Your secret values are encrypted as soon as they are stored and never appear in your manifests: an SSMSecret manifest declares a secret, it does not contain its value.
  • Every read of a value is checked and logged.
  • Every change creates a new version: you can read a previous version again.
  • Periodic rotation replaces the value automatically; your applications receive the new value without any action on your part.

Access is explicit​

  • Every action requires a permission granted by a policy of your tenant. Without permission, the response is a denial; an explicit denial always wins over an allow.
  • If the platform cannot check a permission, it denies rather than allows: try again a few moments later.
  • There is no permanent API key. A person signs in with sng sso login, a CI with its own identity (see Deploy without a secret), an application with a client ID that you declare.
  • A tenant session lasts one hour at most; the CLI renews it for you. sng sso logout ends it before the hour is up, within a few seconds, for every session opened with your account.

Your domains belong to you​

  • A domain you bring can only be used after proof that you own it, and no other customer can use it afterwards.
  • Only public addresses can be published in your DNS records.

Your images are private​

  • An image repository is only accessible to the people, pipelines and access keys you grant access to, unless you make it public.
  • The credentials of a registry access key are renewed automatically at the frequency you choose. By default, they only serve image pulls: no application can read them, unless you explicitly allow it (ci: true).

What you can do on your side​

  • Give everyone the bare minimum: readonly for reading, targeted policies rather than admin for everyone.
  • Have your pipelines deploy without a secret.
  • Declare your passwords as secrets and let the platform generate and rotate them.
  • Only expose to the Internet the services that need to be.

Usage limits​

To guarantee fair service, the API accepts 300 requests per minute per IP address. Beyond that, it responds 429 and indicates when to retry. See Limits.