Amazon EC2 区域和 Windows Azure 关联组 - 安全注意事项
我读到了有关 Amazon EC2 / Windows Azure 中的区域和关联组的信息。看起来它们首先是为了确保性能。
我担心的是安全问题。如果这些服务存在性能瓶颈，是否可以“切换”一个区域并将我在云中的部分数据传输到另一个区域？到目前为止我找不到任何关于此的信息。
对于我的雇主来说，数据永远不会跨地区非常重要，因为我们的客户要求他们的所有数据都保留在欧洲数据中心。
I read about regions and affinity groups in Amazon EC2 / Windows Azure. It seems they are used first and foremost to assure performance.
What I am concerned is about security. Can these services "switch" a region and transfer some of my data in the cloud to another region if they have a performance bottle neck? I couldn't find any information about this so far.
For my employer it's important that data never crosses regions since our clients demand that all their data stays on european data centers.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
在 Azure 中，关联组是一个抽象概念，它只是告诉 Fabric 控制器尽最大努力确保部署相关服务组，以确保应用间通信的优化。团队确保服务、存储等尽可能靠近放置。
亲和力组与区域绑定，因此您无需担心 AG 自行切换国家/地区，因为这会与区域绑定。
在 Azure 中，显式地理位置概念是区域。如果您指定一个区域，则您将绑定到该特定地理区域中的数据中心（或 DC 的虚拟概念）。目前，您无法自行在区域之间移动/迁移服务。
Fabric 控制器确实会跨物理数据中心进行复制以实现容错，但此操作与区域定义的特定于国家/地区的性质相关。因此，美国中北部的数据中心 1 可能会复制到美国中南部的数据中心 2，但绝不会复制到欧洲区域。即使是让 FC 确定代码最佳位置的“任何地方”区域也受到国家边界的约束。
将来，如果 Azure 有异地复制选项，我不会感到惊讶（尽管我认为有 50% 的可能性），但我非常怀疑这将是该平台的被动功能。仅仅开启这一功能有太多的政府和法律影响。
In Azure, affinity groups are an abstraction concept that simply tells the Fabric controller to do its best to ensure groups of related services are deployed to ensure optimization for inter-app communication. Groups ensure that services, storage, etc will all be placed in close proximity whenever possible.
Affinity groups are bound to regions, so you don't need to worry about a AG switching countries on its own, as that would be bound to the region.
In Azure, the explicit geo-location concept is that of a region. If you specify a region you are binding to a datacenter (or virtual concept of a DC) in that particular geographical region. At this time there is no ability to move/migrate services among regions on your own.
The Fabric Controller does replicate across physical datacenters for fault tolerance, but this action is bound to the country-specific nature of the region definition. So Datacenter 1 in North Central US likely replicated to Datacenter 2 in South Central US, but never to a European region. Even the "anywhere" regions which let the FC determine the best place for your code are bound by national boundaries.
In the future I wouldn't be surprised (though I'd say 50% chance) if Azure had a geo-replication option, but I highly doubt this would be a passive feature of the platform. There are simply too many governmental and legal ramification to just turn this on.
我没有使用过 Amazon EC2，因此无法回答这个问题。然而，就 Windows Azure 而言，一旦您决定使用“关联组”（我认为这是“数据中心”的一种很酷的说法），您的数据就会保留在那里（至少到目前为止）。目前，Windows Azure 不提供开箱即用的数据地理复制，因此我认为该服务中没有任何内容可以跨多个数据中心自动复制数据。
值得关注的一件有趣的事情是灾难恢复场景，其中一个数据中心发生故障。然后我认为（仅推测）Windows Azure 可能会尝试将数据从一个数据中心移动到另一个数据中心。不过，为了确定起见，我建议您阅读一些 SLA 协议。
I've not worked with Amazon EC2 hence can't answer about that. However as far as Windows Azure is concerned, once you decide on an "Affinity Group" (which I think is a cool way to say "Data Center"), your data stays there (at least as of now). Currently Windows Azure does not provide geo replication of data out of the box so I don't think there is anything there in the service which would replicate the data automatically for you across multiple data centers.
One thing interesting would be to watch out would be disaster recovery scenario, where one data center goes down. Then I think (just speculating) Windows Azure might try to move the data from one data center to another. However I would recommend reading some SLA agreements just to be sure.
这是欧盟客户普遍关心的问题，因此亚马逊和微软都非常清楚这一点。
对于 EC2，Amazon 有 2 个不同的概念 - 区域和可用区（请参阅 http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/index.html?using-regions-availability-zones.html) - 您的应用程序可以在多个区域中运行，但是永远不应该切换区域。
有关 S3 数据，请参阅 Amazon 的常见问题解答 http://aws.amazon.com/s3/faqs/# Can_I_comply_with_EU_data_privacy_regulations_using_Amazon_S3
对于 Azure，我相信答案是相似的 - 但我找不到关于此的正式常见问题解答
This is a common concern for EU customers - so Amazon and Microsoft are very aware of it.
For EC2, Amazon has 2 different concepts - regions and availability zones (see http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/index.html?using-regions-availability-zones.html) - your app can operate in multiple zones, but should never switch region.
For S3 data, See Amazon's FAQ http://aws.amazon.com/s3/faqs/#Can_I_comply_with_EU_data_privacy_regulations_using_Amazon_S3
For Azure, I believe the answer is similar - but I couldn't find a formal FAQ on this
据我对 Azure 的了解，答案是否定的，您的应用程序无法迁移区域。您选择了一个区域，它保留在该区域，灾难恢复和故障转移也保留在该区域，这正是您所问的原因，我相信每个区域至少有 2 个数据中心。
关于亲和力组的说明 - 它不仅仅是性能，通过分配亲和力组，您无需为节点之间的带宽付费，如果您正在处理大量数据，这一点很重要。
From what I know of Azure the answer is no, your apps can't migrate regions. You selected a region it stays in that region, disaster recovery and failover also stay in that region for the very reason you're asking, I believe there are at least 2 datacentres per region.
A note on affinity groups - it's more than just performance, by assigning an affinity group you don't pay for bandwidth between nodes, which is important if you're processing a lot of data.