Skip to content

AWS_OpenHands_Isolation_Proposal.md

Latest commit

 

History

History
272 lines (211 loc) · 8.92 KB

AWS_OpenHands_Isolation_Proposal.md

File metadata and controls

272 lines (211 loc) · 8.92 KB

AWS OpenHands Isolation Technical Proposal

Executive Summary

This proposal outlines a comprehensive solution for deploying OpenHands AI assistant in a secure, isolated AWS environment that restricts network access to only approved LLM endpoints while providing secure web-based user authentication. The solution ensures maximum security through multiple layers of network isolation, access controls, and monitoring.

Business Requirements

Primary Objectives

  • Deploy OpenHands AI assistant with web interface access
  • Restrict all network communications to approved LLM endpoints only
  • Implement secure user authentication using standard Linux credentials
  • Ensure complete isolation from unauthorized internet resources
  • Maintain audit trails and monitoring capabilities

Security Requirements

  • Network-level isolation using AWS VPC
  • Multi-layer security controls (Security Groups, NACLs, host-level firewalls)
  • Encrypted web traffic (HTTPS/SSL)
  • Password-based authentication with fail2ban protection
  • Complete audit logging of user activities
  • Zero-trust network access model

Technical Architecture

High-Level Architecture

Internet → Web Proxy (Public Subnet) → OpenHands Server (Private Subnet) → LLM Endpoint Only
           ↓
    HTTPS + Basic Auth
    SSL Termination
    Reverse Proxy

Network Design

VPC Configuration

  • VPC CIDR: 10.0.0.0/16
  • Public Subnet: 10.0.0.0/24 (Web Proxy/Bastion)
  • Private Subnet: 10.0.1.0/24 (OpenHands Server)
  • Internet Gateway: Public subnet access only
  • NAT Gateway: Controlled outbound access for private subnet

Security Groups

Web Proxy Security Group (openhands-web-proxy-sg)

  • Inbound: SSH (22), HTTP (80), HTTPS (443) from authorized IPs
  • Outbound: SSH to private subnet, HTTP/HTTPS to OpenHands server

OpenHands Server Security Group (openhands-server-sg)

  • Inbound: SSH and port 3000 from web proxy only
  • Outbound: HTTPS to LLM endpoints, DNS to VPC resolver, NTP

Component Architecture

Web Proxy Server (Public Subnet)

  • Instance Type: t3.small
  • OS: Ubuntu 22.04 LTS
  • Services: Nginx reverse proxy, SSL termination, Basic Auth
  • Security: fail2ban, UFW firewall, SSL certificates

OpenHands Server (Private Subnet)

  • Instance Type: t3.large
  • OS: Ubuntu 22.04 LTS
  • Services: OpenHands application, Docker, Python environment
  • Security: Strict iptables rules, network isolation, audit logging

Implementation Plan

Phase 1: Infrastructure Setup (Week 1)

Day 1-2: Network Infrastructure

  1. Create VPC with public/private subnets
  2. Configure Internet Gateway and NAT Gateway
  3. Set up route tables and network ACLs
  4. Create and configure Security Groups

Day 3-4: Instance Deployment

  1. Create EC2 key pairs
  2. Launch web proxy instance in public subnet
  3. Launch OpenHands server in private subnet
  4. Configure initial security settings

Day 5: Network Security Hardening

  1. Implement strict firewall rules
  2. Configure network ACLs for additional security
  3. Test network isolation
  4. Validate security group configurations

Phase 2: Application Configuration (Week 2)

Day 1-2: Web Proxy Setup

  1. Install and configure Nginx reverse proxy
  2. Set up SSL certificates (self-signed or Let's Encrypt)
  3. Configure basic authentication
  4. Implement fail2ban protection

Day 3-4: OpenHands Installation

  1. Install OpenHands and dependencies
  2. Configure application settings
  3. Set up systemd service
  4. Configure LLM API connections

Day 5: Integration Testing

  1. Test web interface access
  2. Verify LLM connectivity
  3. Validate network restrictions
  4. Performance testing

Phase 3: Security Hardening & Monitoring (Week 3)

Day 1-2: Advanced Security

  1. Implement strict iptables rules for LLM-only access
  2. Configure audit logging
  3. Set up monitoring scripts
  4. Implement backup procedures

Day 3-4: Documentation & Training

  1. Create operational documentation
  2. Develop user guides
  3. Conduct security review
  4. Staff training sessions

Day 5: Go-Live Preparation

  1. Final security validation
  2. Performance optimization
  3. Disaster recovery testing
  4. Production deployment

Security Controls

Network Security

  • VPC Isolation: Complete network segmentation
  • Security Groups: Application-level firewall rules
  • Network ACLs: Subnet-level access controls
  • iptables: Host-level packet filtering for LLM-only access

Access Controls

  • Basic Authentication: Username/password for web interface
  • SSH Key Authentication: Secure administrative access
  • fail2ban: Brute force attack prevention
  • User Account Management: Standard Linux user controls

Monitoring & Auditing

  • System Logs: Comprehensive logging of all activities
  • Network Monitoring: Connection tracking and analysis
  • Security Alerts: Automated alerting for suspicious activities
  • Audit Trails: Complete user action logging

Cost Analysis

Monthly AWS Costs (Estimated)

Component Instance Type Monthly Cost
Web Proxy t3.small $15.18
OpenHands Server t3.large $60.74
NAT Gateway - $32.40
Data Transfer - $10.00
EBS Storage (100GB) - $10.00
Total Monthly $128.32

Annual Cost Projection

  • Year 1: $1,539.84 (including setup costs)
  • Ongoing Annual: $1,539.84

Cost Optimization Options

  • Reserved Instances: 30-40% savings on compute costs
  • Spot Instances: Up to 70% savings (with availability considerations)
  • Storage optimization: Lifecycle policies for logs and backups

Risk Assessment & Mitigation

Technical Risks

Risk Impact Probability Mitigation
Network misconfiguration High Low Automated testing, peer review
LLM endpoint changes Medium Medium Monitoring, flexible configuration
SSL certificate expiry Low Medium Automated renewal, monitoring
Instance failure Medium Low Automated backups, quick recovery

Security Risks

Risk Impact Probability Mitigation
Unauthorized access High Low Multi-layer authentication, monitoring
Network bypass High Very Low Multiple security layers, testing
Credential compromise Medium Low Strong passwords, rotation policy
DDoS attacks Medium Medium Rate limiting, fail2ban

Operational Procedures

Daily Operations

  • Monitor system health and performance
  • Review security logs and alerts
  • Verify LLM connectivity and response times
  • Check backup completion status

Weekly Operations

  • Security patch assessment and application
  • Performance metrics review
  • User access audit
  • Capacity planning review

Monthly Operations

  • Full security assessment
  • Disaster recovery testing
  • Cost optimization review
  • Documentation updates

Compliance & Governance

Security Standards

  • Follows AWS Well-Architected Security Pillar
  • Implements defense-in-depth security model
  • Maintains principle of least privilege
  • Ensures data encryption in transit and at rest

Audit Requirements

  • Complete logging of all user activities
  • Network traffic monitoring and analysis
  • Regular security assessments
  • Incident response procedures

Success Metrics

Security Metrics

  • Zero unauthorized network connections
  • 100% authentication success rate for authorized users
  • < 1 minute response time for security alerts
  • Zero security incidents

Performance Metrics

  • < 2 second response time for web interface
  • 99.9% uptime for OpenHands service
  • < 5 second LLM query response time
  • 100% successful LLM API connections

Operational Metrics

  • < 4 hours mean time to recovery (MTTR)
  • 100% backup success rate
  • < 24 hours security patch deployment
  • Zero unplanned downtime

Conclusion

This proposal provides a comprehensive, secure solution for deploying OpenHands in an isolated AWS environment. The multi-layered security approach ensures that the AI assistant can only access approved LLM endpoints while providing secure web-based access for authorized users.

The solution balances security requirements with operational efficiency, providing:

  • Complete network isolation with LLM-only access
  • Secure web interface with authentication
  • Comprehensive monitoring and auditing
  • Cost-effective AWS implementation
  • Scalable architecture for future growth

Next Steps

  1. Approval: Obtain stakeholder approval for technical approach and budget
  2. Resource Allocation: Assign technical team and project timeline
  3. AWS Account Setup: Prepare AWS environment and access credentials
  4. Implementation: Begin Phase 1 infrastructure deployment
  5. Testing: Comprehensive security and functionality validation
  6. Go-Live: Production deployment with monitoring

Document Version: 1.0
Last Updated: 2025-08-13
Author: Technical Architecture Team
Review Date: 2025-09-13