Disk encryption

What is it

On Lightning AI Studios, customer data is automatically encrypted at rest using AES-256 to protect all volume (disk) data. This process utilizes your cloud provider's transparent disk encryption, with the provider managing the encryption keys. Additionally, you have the option to enable database-level encryption, allowing you to use your own encryption keys via AWS Key Management Service (KMS). It protects sensitive information by encrypting volumes and automatically handling key management.

Encryption in transit secures data during transmission between clients and servers, preventing unauthorized access or tampering. All network traffic to Lightning clusters is protected by Transport Layer Security (TLS), which is enabled by default and cannot be disabled. The default version is TLS 1.2.

How to use

Enable advanced disk encryption when adding data sources and attaching cloud accounts to secure all data at rest on Studio and job instances. This is the optimal method with minimal impact on modern cloud performance. The tradeoff is a slight increase in boot times and may introduce minor performance overhead.

Enable advanced metadata security to protect Studios and jobs using IMDSv2, enhancing security with session authentication tokens and mitigating server-side request forgery (SSRF) risks.