3 ms·
It could all be under the same AWS account, and all using the same IAM role. It's just that the role doesn't have access to anything. It can write logs to its o
by idbehold 9y ago
It could all be under the same AWS account, and all using the same IAM role. It's just that the role doesn't have access to anything. It can write logs to its own function-specific log group and read from them potentially.
Also, a hell of a lot of work went into this feature. You can try setting this infrastructure up yourself if you think it will save you money. You already know they're using Lambda!
- kentonv 9y agoMy comment wasn't intended as an attack. I was just curious about their approach to sandboxing, as it's my area of expertise. Sometimes systems that are secure with two parties become horribly insecure when you add a third. I don't know a lot about IAM but generally I'd be very cautious about using standard access control mechanisms to implement sandboxing while running the code "in your account", as often you find resources are made available to "the whole account" with no further access control settings, because the system designers didn't imagine customers running true third-party code. That said Amazon has some pretty thorough access control features and I'm sure Twilio has looked into it and figured out something reasonable.