Security Controls

Overview

Security Controls for Everpure Cloud Dedicated for AWS describe the core safeguards used to secure a deployment in AWS, including private-subnet network design, interface-specific security groups, required IAM roles, encryption options, and optional AWS audit logging. Pure Storage Cloud Dedicated (PSCD) uses four interfaces—system, replication, iSCSI, and management—and each interface has distinct access requirements that are enforced during deployment.

Key Benefits

The high-level win is stronger security without losing operational simplicity. PSCD is designed to run on private subnets, isolate traffic by interface, and use purpose-built security groups so customers can reduce exposure while keeping the deployment model straightforward.

A second benefit is better data protection and governance. PSCD includes encryption as a core data service, supports customer-managed KMS keys for organizations that require tighter key control, and can be paired with AWS CloudTrail for account-level event tracking and longer-term audit retention.

Audience & Use Cases

This topic is for cloud architects, AWS administrators, security engineers, and storage or platform teams deploying PSCD in an Amazon VPC.

Use it when you need to:

• plan secure VPC, subnet, and route-table design for a PSCD deployment,
• define required security groups and IAM permissions,
• choose between AWS-managed and customer-managed encryption keys, or
• enable AWS-side event logging for security monitoring and investigations.

How it Works

1. Build the PSCD network in AWS using private subnets for the PSCD interfaces, and provide internet access only where required for the system subnet.
2. Create and apply dedicated security groups for replication, iSCSI, and management traffic, while the system security group is created automatically during deployment.
3. Create the required IAM policy and deployment role so CloudFormation can deploy, upgrade, and manage the PSCD resources.
4. Deploy PSCD through the AWS Marketplace and CloudFormation workflow, selecting the subnets, security groups, key pair, license key, and IAM role as part of the stack configuration.
5. Optionally enable CloudTrail to retain AWS event history and support troubleshooting, activity tracking, and security investigations.

Prerequisites

Deployment

To start building, go to the AWS Marketplace listing for Pure Storage Cloud Dedicated, then select Continue to Subscribe > Continue to Configuration > choose the version and region > Continue to Launch > Launch. This opens the CloudFormation stack workflow, where you provide the stack name, array name, license key, key pair, subnets, security groups, and PurityServiceRole.

Additional Information