在 EC2 区域中传播 MongoDB
我想在多个 Amazon EC2 区域中分发分片/复制的 MongoDB 设置。此流量是否已由 MongoDB 加密，或者我可以选择进行设置吗？或者亚马逊是否在其数据中心之间提供类似 VPN 的特殊连接？
I want to distribute a sharded/replicated MongoDB setup across multiple of Amazon's EC2 regions. Is this traffic already encrypted by MongoDB or can I optionally set this up? Or does Amazon offer a special VPN-like connection between its data centers?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
跨副本的 Mongo 通信未加密。所以你就在你的身上。您可以在一个区域内跨可用区创建副本
Mongo communication across replicas is not encrypted. So you are on your on. You can create Replica's across availability zones in a region
您可以自行加密 EC2 区域之间传输的数据。亚马逊不保证它们与私人渠道连接，因此您必须假设它们通过公共网络进行连接。
You're on your own with encrypting data transfered between EC2 regions. Amazon does not guarantee them to be connected with private channels so you have to assume they are going over the public networks.
我昨天回答了有关 Apache Cassandra 的类似问题： 使用 TLS/ 确保 Cassandra 通信安全SSL。
我的经验是，特别是在亚马逊方面，如果可以的话，在您的实例之间建立一个 VPN 网络，以保证一切都是安全的。在 EC2 上实施 VPN 网络时，我们遇到的一个有趣的事实是，它使响应时间更快......我们选择了 Vyatta 到目前为止，我们对此非常满意。它可以完全虚拟化......并允许我们在区域、区域和数据中心（亚马逊和非亚马逊）之间建立桥梁。
另一种选择是利用 Amazon 虚拟私有云：
Vyatta 有一个很好的图形，显示了 VPC 和 Vyatta（或任何其他企业 VPN 解决方案）如何桥接在一起（根据上面的最后一点）：
http://www.vyatta.com/solutions/amazon
我不为 Vyatta 工作......就像我们在不购买昂贵的思科设备的情况下成功地让一切正常运转一样
I answered a similar question yesterday about Apache Cassandra: Securing Cassandra communication with TLS/SSL.
My experience has been, specifically with Amazon, if you can, set up a VPN network between your instances to guarantee that everything is secure. An interesting fact we came across when implementing our VPN network on top of EC2 is that it made response times faster ... We opted for Vyatta and have been very happy with it so far. It can be fully virtualized ... and allows us to bridge between zones, regions and data centres (amazon and not amazon)
Another option is to leverage Amazon Virtual Private Cloud:
Vyatta has a nice graphic showing how VPC and Vyatta (or any other corporate VPN solution) can bridge together (as per the last point above):
http://www.vyatta.com/solutions/amazon
I don't work for Vyatta ... just like how well we've managed to get everything working without purchasing mega expensive cisco gear
根据 [mongo docs] mongo 可以使用 SSL。人们要么必须使用 --ssl 标志编译 mongo，要么使用商业版本。通过启用 SSL 的 mongo，数据库和客户端之间的所有通信以及副本集和仲裁器之间的通信都是安全的（请参阅 常见问题解答）。
有人真正尝试过这种方法吗？有什么缺点吗？
According to [mongo docs] it's possible for mongo to use SSL. One would either have to compile mongo with --ssl flag or use commercial edition. With SSL-enabled mongo all communication between the DB and client, as well as communication between replica sets and arbiter is secured (see faq).
Has anyone actually tried this approach? Are there any drawbacks?
如果您不在 EC2 上运行，那么这些解决方案并不是真正的选择。还有另一种方法，那就是建立您自己的 IaaS 提供商独立的 VPC。 vCider 为此提供了一个与 Mongo 和 Cassandra 配合良好的解决方案。对于 Cassandra 来说，保护客户端/数据库流量尤其痛苦，因为没有本机加密。
这里有一个很好的例子来说明这一切是如何工作的：
http://www.vcider.com/vpc-部署/secure-saas
就 Cassandra 而言，这里有一些基准信息。
http://blog. vcider.com/2011/09/virtual-networks-can-run-cassandra-up-to-60-faster/
通过内核中的本机加密，您可以运行得更快。
If you're not running on EC2, these solutions aren't really an option. There is another way and that is to set up your own IaaS provider independent VPC. vCider has a solution for this that works well with Mongo as well as Cassandra. For Cassandra securing client/DB traffic is especially painful since there is no native encryption.
Good example of how this all works here:
http://www.vcider.com/vpc-deployments/secure-saas
As far as Cassandra goes, some benchmark info here.
http://blog.vcider.com/2011/09/virtual-networks-can-run-cassandra-up-to-60-faster/
With native encryption in the kernel you can run much faster.