4 ms·

I am compelled to create a HN account just to relate the below. A year ago while planning to move from AWS to GCE, I created some instances to test under a com

by gselva 10y ago

I am compelled to create a HN account just to relate the below. A year ago while planning to move from AWS to GCE, I created some instances to test under a company email id. Our emails were hosted under google apps. At some point, the email id got deleted for other reasons. I was in for a rude surprise. The instances disappeared, as I found out when the test urls didn't respond. Apparently, GCE deleted the instances without warning. I was later told by support staff that I should add another admin email to prevent mishaps like this. Seriously. Anyway, we use GCE these days along with AWS and I quite like GCE. Of course, we now don't delete any email ids :-)

notyourwork 10y ago
I don't have any experience with GCE but I do have a lot of experience with AWS. What does an email id have to do with your cloud resources? "We now don't delete any email ids" implies you are worried about the same happening again. This makes me wonder why you don't confidently know what an ID is associated with so when you delete you are confident about not breaking anything else.
- jdironman 10y ago
  I think it could be viewed in a different light. It provides a real sense of control over resources (which should be well documented in the first place). If there are rogue resources and objects being utlized unauthorized in an organization it makes it short work to eliminate such things.
jpatokal 10y ago
Google Cloud Support here. If you create Cloud project with a single owner (email), and that sole owner's account is deleted, the project is considered orphaned and will first be suspended, giving you some time to get touch with us if this was not intended, and then deleted after around 6 weeks. (Most running resources are stopped at suspension, but account data hangs around until deletion.) I know this seems harsh, but there's really not a whole lot of other sensible options. The former owner can't be contacted, since the only email we have for them no longer works, and the project is literally unmaintainable, since nobody has admin rights to it anymore. So TL;DR, for anything remotely important, please assign multiple owners and use role accounts (admin@corp) instead of users (bob@corp).
- nkw 10y ago
  That is good to know, however my first reaction when reading this is we shouldn't be using G Suite for admin@corp or bob@corp, but rather if I am going to be seriously dependent on Google Cloud I should perhaps move e-mail for said @corp to Office365 (or whomever else actually does e-mail these days). I don't know what the solution/answer is here, but it worries me that actions (yes even bad spam-y TOS violating actions) that someone takes using our company's google accounts can ripple across the Google ecosystem and screw important parts of our company's infrastructure.
  - jpatokal 10y ago
    YMMV (and this is my personal view, not necessarily Google's), but in general you want to have resources associated with active owners. Otherwise when Bob leaves, and his zombie solo project which you no longer have any control over gets pwned, you're going to have an even bigger problem.
    - naasking 10y ago
      No one's denying that orphaned projects are a problem, but if deactivating an e-mail has downstream effects like this, you'd expect a warning or something before permitting account deactivation.
      - stickfigure 10y ago
        How would you expect to receive this warning?
        gselva 10y ago
        In my case, where the email was hosted in Google apps, it would have been helpful if Google apps had checked with GCE before allowing email deletion. After all, this is one of the situations where being within Google Eco-system should have been a good thing.
deleted 10y ago
[deleted]

by gselva 10y ago

notyourwork 10y ago

I don't have any experience with GCE but I do have a lot of experience with AWS. What does an email id have to do with your cloud resources? "We now don't delete any email ids" implies you are worried about the same happening again. This makes me wonder why you don't confidently know what an ID is associated with so when you delete you are confident about not breaking anything else.

jdironman 10y ago
I think it could be viewed in a different light. It provides a real sense of control over resources (which should be well documented in the first place). If there are rogue resources and objects being utlized unauthorized in an organization it makes it short work to eliminate such things.

jpatokal 10y ago

Google Cloud Support here. If you create Cloud project with a single owner (email), and that sole owner's account is deleted, the project is considered orphaned and will first be suspended, giving you some time to get touch with us if this was not intended, and then deleted after around 6 weeks. (Most running resources are stopped at suspension, but account data hangs around until deletion.) I know this seems harsh, but there's really not a whole lot of other sensible options. The former owner can't be contacted, since the only email we have for them no longer works, and the project is literally unmaintainable, since nobody has admin rights to it anymore. So TL;DR, for anything remotely important, please assign multiple owners and use role accounts (admin@corp) instead of users (bob@corp).

nkw 10y ago
That is good to know, however my first reaction when reading this is we shouldn't be using G Suite for admin@corp or bob@corp, but rather if I am going to be seriously dependent on Google Cloud I should perhaps move e-mail for said @corp to Office365 (or whomever else actually does e-mail these days). I don't know what the solution/answer is here, but it worries me that actions (yes even bad spam-y TOS violating actions) that someone takes using our company's google accounts can ripple across the Google ecosystem and screw important parts of our company's infrastructure.
- jpatokal 10y ago
  YMMV (and this is my personal view, not necessarily Google's), but in general you want to have resources associated with active owners. Otherwise when Bob leaves, and his zombie solo project which you no longer have any control over gets pwned, you're going to have an even bigger problem.
  - naasking 10y ago
    No one's denying that orphaned projects are a problem, but if deactivating an e-mail has downstream effects like this, you'd expect a warning or something before permitting account deactivation.
    - stickfigure 10y ago
      How would you expect to receive this warning?
      - gselva 10y ago
        In my case, where the email was hosted in Google apps, it would have been helpful if Google apps had checked with GCE before allowing email deletion. After all, this is one of the situations where being within Google Eco-system should have been a good thing.

deleted 10y ago

[deleted]