general/other how to make sure that my cloud provider cant spy on my VM?

[gergeskirolos59]

same as question , as i can see azure and aws gives you good tools to make your life manging VM easier however it also raises question beside trust what prevent them to use same features they provide for me to access my VM and do whatever they want?

 

[covacat]

you can't. they can dump your vm's memory.

 

[cracauer@]

You are looking for a VM with AMD SEV (Secure Encrypted Virtualization).

Lots of holes in it have been discovered in the past, though.

 

[gergeskirolos59]

You are looking for a VM with AMD SEV (Secure Encrypted Virtualization).

Lots of holes in it have been discovered in the past, though.

ignore SEV for a moment their mangement console let you access ssh and change vm password for example without knowing anything except new password

what prevent their employees to just access my vm even with SEV?

 

[gergeskirolos59]

you can't. they can dump your vm's memory.

there are some technologies to encrypt vm memory however i do not believe they even need to dump vm memory to see my data

 

[cracauer@]

ignore SEV for a moment their mangement console let you access ssh and change vm password for example without knowing anything except new password

what prevent their employees to just access my vm even with SEV?

There are some incantations to first have a secretless VM and then establish keys to access it later over channels the provider can't read. Obviously all the traditional stuff such as default ssh keys and cloudinit are out. I haven't done it myself, but that's the idea. I lack the hardware to experiment with it.