Security
Coming from another cloud?
▸AWS·Security Pillar
This Quake AI feature maps to AWS’s Security Pillar.
▸DigitalOcean·Security
This Quake AI feature maps to DigitalOcean’s Security.
Security
Quake AI follows a shared responsibility model: the platform secures the underlying infrastructure, and you configure and protect your workloads, data, and access within your projects.
Shared responsibility at a glance#
| Area | Platform responsibility | Your responsibility |
|---|---|---|
| Physical infrastructure | Datacenter security, hardware, power, cooling | N/A |
| Hypervisor and host OS | Isolation between tenants, patching | N/A |
| Network backbone | Backbone integrity, DDoS mitigation | Security groups, firewall rules, and TLS on public endpoints |
| API authentication | Keystone identity, token issuance | Credential rotation, app credential scope, MFA |
| Compute instances | VM placement, host security | OS patching, SSH key management, user data scripts |
| Block storage | Volume encryption at rest (infrastructure layer) | Access control, snapshot policies, backup strategy |
| Object storage | Storage infrastructure availability | Bucket policies, SSE-C/SSE-OMK encryption, access control |
| Kubernetes | Control plane provisioning (via Magnum) | RBAC, network policies, image scanning, secrets |
| Service availability | API uptime, regional redundancy | Workload redundancy, health checks, auto-scaling |
For the full breakdown, see Shared responsibility model.
Start here#
Work through the Security hardening checklist on a new project. It covers the credentials, security groups, and instance settings worth fixing before you put real traffic on the project.
Concepts#
How-to#
Related builds#
Reference and operations#
When a token or an application credential stops authenticating, start with Auth token diagnostics. Access and credentials covers how to rotate keys and scope application credentials.
Network documents security groups, Compute covers SSH keys and instance access, and Object storage covers bucket policies and encryption options.