Summary of AWS re:Invent 2022 - A day in the life of a billion requests (SEC404)

00:00:00 - 00:50:00

AWS re:Invent is a yearly event where AWS developers showcase new features and products. In this particular video from 2022, Michael Hart describes how the company has improved its request processing to handle billions of requests per second. He explains how the system is designed to be secure and efficient, and how changes are made without disrupting the customer experience.

• 00:00:00 The video discusses the authentication process used by AWS, which includes logging into a website, receiving a cookie, and being redirected back to the website. The system is designed to be able to authenticate users quickly and securely.
• 00:05:00 This video describes how the TLS protocol is used to protect API calls from eavesdroppers. The video also mentions that the protocol has a signature over the entire request, which helps to protect against replay attacks.
• 00:10:00 In this video, the presenter discusses the use of hashes in signing protocols, highlighting the benefits of using a hash over a signature. He also points out that hashes are already in use in some protocols, making them free to use.
• 00:15:00 In this video, AWS developer Michael Hart describes how to create a primitive based on my slides for use in securing requests against extension and Brute Force attacks. Hart also describes how the primitive is faster than Brute Force, and how it has been reviewed by cryptographic experts.
• 00:20:00 The video provides an overview of AWS's history, including the development of IAM and theauth runtime service. It explains how the auth runtime service is used for authentication and authorization of inbound API calls, and how AWS is divided into regions with different IAM deployments.
• 00:25:00 AWS's signature version four is a better way to do key management than signature version three, which was never widely used. Signature version four is fast and easy to use, and does not require customers to get new keys.
• 00:30:00 In this video, AWS describes how it uses regional caching to improve the performance of API calls. Regional caching allows for a shorter time frame for a service's configuration values to propagate policy updates, and this benefits customers who have workloads that fall into two different categories. Sig V4 is the only supported cryptographic protocol, and all regions launched since Hong Kong have been opt-in.
• 00:35:00 The video discusses the different use cases for short-term keys (Sessions), including federated logins and assuming an IAM role. The key difference between a Session and a Short-term key is that a Session will expire after 36 hours, while a Short-term key will expire automatically.
• 00:40:00 AWS provides a secure token service that allows for short-term sessions to be created at scale. The service is deployed in every region and allows for access keys and secret keys to be generated and encrypted.
• 00:45:00 In this video, a day in the life of a billion requests, the author describes how AWS handles session management. They explain that AWS sessions are cached and regenerated on a per-request basis, and that AWS API signatures are unique per request.
• 00:50:00 This video describes how AWS services are used to process billions of requests per second. The video also describes how changes to the system are made without the customer noticing.