5 ms·
We are big aws customers at my current employer and have generally had success, and I use amazon products, but that said: This is totally on amazon for not hav
by awinder 8y ago
We are big aws customers at my current employer and have generally had success, and I use amazon products, but that said:
This is totally on amazon for not having vpc-enabled elasticsearch clusters for way too long, AND, not providing an upgrade mechanism to move an existing internet-accessible cluster to a vpc. I was mindblown when I first utilized elasticsearch service and was sure that there would be data leaks for only having public net.
- sailfast 8y agoWhile I agree and those defaults are certainly suboptimal with blame to share, I would argue the buck stops with the individual that indexed all the proprietary data on :9200 open to the internet. You can do all sorts of stupid things with AWS (or any other tool). That doesn't make it Amazon's fault entirely. The individual is responsible for attempting a basic understanding of the tools they use. When I learned the ropes of ES, configuring the endpoint was one of the first things that came up in a large number of docs and posts. In this case, I also wonder if the person doing it even realized it would be a problem since the database was based on "Publicly Available data". "Sure, turn CORS on, let's roll." Thankfully this leak was of public data combined into a proprietary reporting tool, rather than something more sinister that would cause greater harm.
- awinder 8y agoJust so I'm clear -- AWS elasticsearch service was launched in October 2015, and VPC support didnt come around until fall 2017. So for over 2 full years the only way to utilize their elasticsearch service was to run it internet-accessible. I'm not talking about defaults here -- it was the only option.