And then, if it is exposed, it’s through an application gateway of some sort to shim the acces and log the heck out of it with cloudwatch/trail,e tc., and local login to ENC server is limited to like 3 people and an infosec account. The classification is living in a database on the ENC here, and gets handed out by the ENC script which reads that database which has tight SSH rules, and puppet access pinholed on a specificc firewall port (if I’m hardening, that is)