简体繁体 English

Azure 角色本地存储是否保证不能被下一个使用同一主机的应用程序访问？

[英]Is Azure role local storage guaranteed to be inaccessible to an application that is next to use the same host?

原文 2011-06-02 12:12:55 0 3 windows/ security/ azure/ cloud

Suppose my Azure role stores files to the role local filesystem and forgets to delete them.假设我的 Azure 角色将文件存储到角色本地文件系统并忘记删除它们。 Can another application that uses that host in future possibly get access to those files?将来使用该主机的另一个应用程序是否可以访问这些文件？

I've read the whitepaper and it's full of marketing style statements but I can't find a definitive statement about how thoroughly the host machine is "cleaned" before a new role is started on it.我已经阅读了白皮书，其中充满了营销风格的陈述，但我找不到关于在主机上开始新角色之前“清理”主机的彻底程度的明确陈述。

Can I be completely sure that another application won't see changes my application does to the filesystem?我可以完全确定另一个应用程序不会看到我的应用程序对文件系统所做的更改吗？

3 个解决方案

No, it cannot be used by another VM, even accidentally.不，它不能被其他虚拟机使用，即使是意外使用。 The 'scratch' drive that is mounted by your Windows Azure instance is another VHD - data is not written natively to disk.由 Windows Azure 实例安装的“暂存”驱动器是另一个 VHD - 数据不会本地写入磁盘。 So, in order for another instance to read your data, it would have to mount your VHD, which is not possible.因此，为了让另一个实例读取您的数据，它必须挂载您的 VHD，这是不可能的。

Although I am not sure it's properly documented, I am fairly certain that Windows Azure recycles thoroughly whatever local files haven been dumped by a Role into a VM before letting any other Role access the VM.尽管我不确定它是否已正确记录，但我相当肯定 Windows Azure 在让任何其他角色访问 VM 之前彻底回收角色已将任何本地文件转储到 VM 中。 That's a fairly basic security policy.这是一个相当基本的安全策略。

Then, considering the deployment time on Windows Azure for a new VM (between 6min to 8min) I am pretty sure that the VM itself is pretty much wiped-out clean, not just the local storage, so that whatever by-product files which might have been generated by the OS itself during the execution of the VM does not become available afterward.然后，考虑到 Windows Azure 上新 VM 的部署时间（在 6 分钟到 8 分钟之间），我很确定 VM 本身非常干净，而不仅仅是本地存储，因此无论可能在虚拟机执行期间由操作系统本身生成的，之后不会变得可用。

Local storage is ephemeral and it is part of specific compute instance.本地存储是短暂的，它是特定计算实例的一部分。 When the instance is recycled\deleted, the local storage is gone.当实例被回收\删除时，本地存储就消失了。