Infrastructure Security in AWS Device Farm - AWS Device Farm

Infrastructure Security in AWS Device Farm

As a managed service, AWS Device Farm is protected by the AWS global network security procedures that are described in the Amazon Web Services: Overview of Security Processes whitepaper.

You use AWS published API calls to access Device Farm through the network. Clients must support Transport Layer Security (TLS) 1.0 or later. We recommend TLS 1.2 or later. Clients must also support cipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes.

Requests must be signed by using an access key ID and a secret access key that is associated with an IAM principal. Or, you can use the AWS Security Token Service (AWS STS) to generate temporary security credentials to sign requests.

Infrastructure Security for Physical Device Testing

Devices are physically separated during physical device testing. Network isolation prevents cross-device communication over wireless networks.

Public devices are shared, and Device Farm makes a best-effort attempt at keeping devices safe over time. Certain actions, such as attempts to acquire complete administrator rights on a device (a practice referred to as rooting or jailbreaking), cause public devices to become quarantined. They are removed from the public pool automatically and placed into manual review.

Private devices are accessible only by AWS accounts explicitly authorized to do so. Device Farm physically isolates these devices from other devices and keeps them on a separate network.

On privately managed devices, tests can be configured to use an Amazon VPC endpoint to secure connections in and out of your AWS account.

Infrastructure Security for Desktop Browser Testing

When you use the desktop browser testing feature, all test sessions are separated from one another. Selenium instances cannot cross-communicate without an intermediate third party, external to AWS.

All traffic to Selenium WebDriver controllers must be made through the HTTPS endpoint generated with createTestGridUrl.

The desktop browser testing feature does not support Amazon VPC endpoint configuration at this time. You are responsible for making sure that each Device Farm test instance has secure access to resources it tests.