The key derivation step is designed to take a set amount of CPU time (say, a second), so it's difficult to brute force.
(A cloud instance with a disk without encryption is a different business.)
The key derivation step is designed to take a set amount of CPU time (say, a second), so it's difficult to brute force.