Ouch. This one has to hurt. Amazon Web Services, the biggest, best known and by far the most dominant cloud infrastructure vendor just advised customers that an urgent patch is going to be rolled out over the next week.
According to a blog post by Thorsten Von Eicken, the CTO of cloud management vendor, RightScale, there is a distinct lack of transparency around this news. The details, according to Von Eicken, are that Amazon Web Services (AWS) notified its customers today, Sept 24, that it will be rolling out an urgent patch to all hosts causing a maintenance reboot of nearly all EC2 instances starting September 26, 2014 and ending on September 30, 2014. If customers relaunch an instance before the maintenance, they are not guaranteed to get an already-patched host. Von Eicken points out that;
- Normally, whenever our Ops team receives a maintenance notice regarding a specific set of instances, we relaunch them as soon as possible at our convenience so that by the time the maintenance windows arrives, our instances are already on hosts that have had the maintenance done. This time, due to the scale of the patching, there is not enough patched capacity available to guarantee this.
Of course every legacy vendor under the sun will point out that this is a huge failing of the cloud and that only through taking individual control of an organization's infrastructure, can they ensure stability and security.
Which is a tempting claim to make, but one which ignores the fact that AWS has the resource to identify and patch vulnerabilities faster than organizations who have their own infrastructure and who have to balance different priorities.
Sure it's not a good look for AWS, but at the end of the day, I'd still go cloud, notwithstanding this little hiccup.
Update - It seems the issue was one with Xen - details (actually a lack of details) here.
