3 ms·

I've never used AWS, but I keep seeing news about large companies or organizations, such as the recent Pentagon story [1], exposing all of their customers' data

by mtgx 9y ago

I've never used AWS, but I keep seeing news about large companies or organizations, such as the recent Pentagon story [1], exposing all of their customers' data in plain-text. Is Amazon making it that easy to screw something like that up, or what is going on here? When you see a few random cases likes, you might think it's just an engineering making a dumb mistake, but this is starting to seem systematic, like there's a UX/UI issue at play here that makes all of these companies that should know better screw-up so easily. Or maybe Amazon just needs to make it hard to screw something like this up. So what's going on? [1] - https://www.pcmag.com/news/357465/pentagon-accidentally-exposes-web-monitoring-operation https://www.pcmag.com/news/357465/pentagon-accidentally-expo...

bfrydl 9y ago
Speaking generally, most services offered by AWS are too low level to be blamed for problems besides outages or similar issues. They are computing and storage resources that behave exactly as they are configured to do. For example, S3 buckets are not public by default. The Pentagon is entirely to blame for the data breach. Amazon can't make it any harder to make this mistake, because publicly accessible buckets are an extremely common use case, and it is already an explicit choice.
- toomuchtodo 9y ago
  Amazon doesn’t allow you to inhibit public buckets through AWS org and service control policies unless something has changed recently. Pretty big gap in that feature set.
res0nat0r 9y ago
s3 objects are private by default. Someone had to manually change the bucket permissions or upload each object and explicitly state they should be world-readable. This case is more user error than anything. I believe they are also starting to mail customers whos buckets are marked world-readble just to remind them there could be a security problem if they didn't mean to do this.
- empath75 9y ago
  There are also config rules which will notify you if buckets are public, and automatically encrypt them..
empath75 9y ago
It's partially a UX/UI issue (which amazon is belatedly working on -- https://www.theregister.co.uk/2017/11/07/amazon_aws_s3_alert/ https://www.theregister.co.uk/2017/11/07/amazon_aws_s3_alert... ). It's also just dumb/lazy users. S3 is one of the oldest aws services, and also one of the clunkiest to use.

by mtgx 9y ago

bfrydl 9y ago

Speaking generally, most services offered by AWS are too low level to be blamed for problems besides outages or similar issues. They are computing and storage resources that behave exactly as they are configured to do. For example, S3 buckets are not public by default. The Pentagon is entirely to blame for the data breach. Amazon can't make it any harder to make this mistake, because publicly accessible buckets are an extremely common use case, and it is already an explicit choice.

toomuchtodo 9y ago
Amazon doesn’t allow you to inhibit public buckets through AWS org and service control policies unless something has changed recently. Pretty big gap in that feature set.

res0nat0r 9y ago

s3 objects are private by default. Someone had to manually change the bucket permissions or upload each object and explicitly state they should be world-readable. This case is more user error than anything. I believe they are also starting to mail customers whos buckets are marked world-readble just to remind them there could be a security problem if they didn't mean to do this.

empath75 9y ago
There are also config rules which will notify you if buckets are public, and automatically encrypt them..

empath75 9y ago

It's partially a UX/UI issue (which amazon is belatedly working on -- https://www.theregister.co.uk/2017/11/07/amazon_aws_s3_alert/ https://www.theregister.co.uk/2017/11/07/amazon_aws_s3_alert... ). It's also just dumb/lazy users. S3 is one of the oldest aws services, and also one of the clunkiest to use.