7 ms·

AWS Control Tower

145 points by jeffbarr 7y ago

andrewstuart 7y ago
I'd love it if at a glance I could see all of the AWS resources that I am using that cost me money, across all the regions. Right now I feel like I would have to poke into every menu option in every region across the entire set of AWS services to find out exactly what I'm using. The cynic in me wonders if this is not a priority for AWS because they make so much money from forgotten and hard to find resources that are being used and paid for but essentially lost in the interface. When I saw the new product name I thought "maybe this is it!"
- iaresee 7y ago
  Does the billing dashboard not cover your needs? With their billing query UI you can slice your billing data by region, service, etc.
  - derefr 7y ago
    The billing API tells you about resources that have charged you, whereas I think the parent comment is talking about resources that are either “active” in some sense where they will charge you at some point in the future for the usage you’re accruing (but where this usage isn’t metered in a way visible to the billing API until it “commits” somehow); or, worse, resources which are “exposed” in some sense where they could charge you if they received a request, but happen to not have received any yet. (These resources are very easy to lose track of.) Another way to think of this question is “what is my current exploitable attack surface, against the ‘attack’ of causing AWS to charge me lots of money?”
    - jjeaff 7y ago
      They do only show what you have been charged, but to my knowledge this is update very regularly. It seems at least next day.
  - slaman 7y ago
    and by Tag, which is the most useful way to organize your resources for internal billing/analysis. Don't see any missing functionality but our use case may not be complex enough.
  - andrewstuart 7y ago
    Yes that's retrospective, I'd like to see everything in use now that costs money, with links to direct manage those resources.
- dyu 7y ago
  You can also check out https://divvycloud.com/ https://divvycloud.com/, which is similar and supports a few other clouds.
- joshanderson 7y ago
  It’s not in Amazon’s interest to make billing easy to understand
  - eropple 7y ago
    This isn't really true. Billing opacity scares off small clients (it's one of the biggest reasons that, as a consultant, my clients leaned away from AWS) and can make larger clients consider diversification or divestiture.
- dstroot 7y ago
  I had a key compromise. They spun up resources across the world. I had to go on a safari to hunt and kill all the things they created in each region. I would’ve loved to of had a single view to see all the resources running across all regions. That would’ve been super helpful.
  - mooreds 7y ago
    This might help: https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/find-resources-to-tag.html https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/fi... Regions and tags are optional, which will show you everything.
- kiwicopple 7y ago
  I’ve been using komiser.io for this. I saw it here on Show HN about a month ago and have been using it ever since
- pwarner 7y ago
  3rd party services offer this for sure - https://www.cloudhealthtech.com/ https://www.cloudhealthtech.com/ - https://cloudcheckr.com/ https://cloudcheckr.com/ And several others.
- sandGorgon 7y ago
  This. This is one thing that GCP has done so brilliantly right - the projects structure. From an organisation point of view, this is the most seamless way of managing billing+access , instead of mucking about ARN crap. It's puzzling that AWS has still not been able to roll this out. What's so hard ? roll out projects and put all existing customers in a default project.
- couterSpell 7y ago
  Have you looked at AWS Config? Config gives you the ability to build asset inventories and be alerted when things change. It only works regionally, but it's better than nothing.
cbdumas 7y ago
This looks like a public facing version of a tool that AWS uses internally, which is great. Super easy tool to setup and govern AWS accounts, and also access the accounts to which you have access. I always wondered why they didn't sell it to their customers but I guess now they will!
omeid2 7y ago
AWS is pushing Organizations/Accounts as something like GCP's Projects and it mostly works, cross account iam works pretty good, so does many other services but sadly this is not reflected in the support subscriptions. You want help with a problem in your staging account? pay for support, fair enough. You want help with your production? oh sorry, you have to pay again.
- marcinzm 7y ago
  >You want help with a problem in your staging account? pay for support, you want help with your production? oh sorry, you have to pay again. In a sense this is a good thing since support is percentage based and you may want a higher level for support for production than staging.
  - omeid2 7y ago
    You should have the option to pay for the aggregate and get support across all the accounts, it only makes sense, really.
    - deleted 7y ago
      [deleted]
    - dodobirdlord 7y ago
      If I recall correctly, that only happens at the Enterprise support tier.
      - scarface74 7y ago
        You pay a minimum of $100 per account for business support - 10% of your bill.
        dragonwriter 7y ago
        Business support has pricing that drops as a percentage as your spend goes up, like Enterprise, but does not allow you aggregate across accounts like enterprise. It's only 10% for the first $10K. 7% for the portion up to $80K, 5% for the portion up to $250K, and 3% beyond that. (Enterprise has the same kind of %age ranges but cutoffs of $150K/$500K/$1M and the bottom range doesn't really matter because the hard minimum is $15K/mo.)
wayne_skylar 7y ago
Sorry but I've never felt that Amazon is completely operating in good faith with regards to allowing users to manage their costs. The proof of that is the fact that they still don't have a page where you can see the price of an ec2 instance alongside its stats. I've been wanting to see that for ten years and they still haven't added it.
- joemag 7y ago
  EC2 engineer here. Pricing is definitely a hard topic, and we can do more to make it easier. However, with regards to your second comment, are you looking for something more than this page [1] [1] https://aws.amazon.com/ec2/pricing/on-demand/ https://aws.amazon.com/ec2/pricing/on-demand/
  - pwarner 7y ago
    Of course there is https://www.ec2instances.info/ https://www.ec2instances.info/ or if you are into Azure then https://azureprice.net/ https://azureprice.net/
  - roca 7y ago
    The one obvious thing that's missing from that page is the network interface.
- athrun 7y ago
  In addition to the resources other commenters have listed, there's also the Price List API: https://aws.amazon.com/blogs/aws/new-aws-price-list-api/ https://aws.amazon.com/blogs/aws/new-aws-price-list-api/ It provides both pricing and product information, so you can build your own dashboard/tooling if you want to.
rukenshia 7y ago
I love that AWS is starting to care more about providing these services. For context, we have basically been building this for 2 years in our company internally to provide hundreds of “compliant by default” accounts. Every company seems to do it themselves. What I personally find very frustrating is the lack of being able to migrate any existing organisations into this. I’d love to get rid of some of our account provisioning but this would basically mean starting over with a brand-new AWS Organization which is impossible for us. It still is quite a hassle to manage many accounts (and resources you need in them) so I hope this service will sooner or later help us with this. PS: if anyone is over at re:Inforce and wants to talk about anything AWS Orgs & accounts, feel free to mail me (profile)!
- joseph 7y ago
  I also worked on a team that built something similar, and I've seen it done in other companies. With services like this, and others like Transit Gateway, it's getting a lot easier to manage multiple accounts and VPCs. I haven't tried AWS Control Tower yet, but I am hoping it gives easy visibility into all the accounts in one place. With Amazon accounts, once you assume a role into an account, you can't see other accounts without switching back into them. This is one area where I think GCP got it right. By using organizations and projects within one account instead of having parent and child accounts, it's quite a bit easier to see what's going on. And a parent account has a very different role from child accounts, so it makes sense to treat them as separate things.
thomasedwards 7y ago
Just tried it on our master account: > You tried to use an account that is a member of an organization in AWS Organizations. To set up your AWS Control Tower landing zone, use an account that is not a member of an organization. Looks like it’s only feasible if you’re starting from scratch.
- s14ve 7y ago
  Have you managed to get it working in the end? I've encountered the same issue.
  - thomasedwards 7y ago
    No stopped trying – I’m not too worried as I have a Firefox Containers setup to switch between all the accounts.
dvfjsdhgfv 7y ago
Thank you AWS. In the meantime, if you could offer me just one basic setting that users have been asking for years (hard limit on your spending), it would be even better.
- kousikk 7y ago
  (Assuming no malicious intent from AWS) One of the reasons this is probably hard is probably because a lot of services didn't start out with having resource constraints. So now if you support something like a "hard-billing-cap", every single service in AWS has to support it. That's a huge stone to move - it could even be in the works today.
  - marcinzm 7y ago
    There's also no good way for most services to support it since storing data costs money and presumably you don't want AWS to wipe your data when you hit your spending cap.
    - deleted 7y ago
      [deleted]
- marcinzm 7y ago
  How would hard limits work? Do all your ec2 instances shut down? Do your s3 buckets and their data get deleted? Do you snapshots and EBS volumes get deleted? There's no way to pause these things since they still costs AWS money.
  - argd678 7y ago
    You don’t let people start up the service if it will exceed a cost quota. For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance, but yeah other usage based services like s3 and network traffic that won’t work.
    - 7y ago

145 points by jeffbarr 7y ago

I'd love it if at a glance I could see all of the AWS resources that I am using that cost me money, across all the regions. Right now I feel like I would have to poke into every menu option in every region across the entire set of AWS services to find out exactly what I'm using. The cynic in me wonders if this is not a priority for AWS because they make so much money from forgotten and hard to find resources that are being used and paid for but essentially lost in the interface. When I saw the new product name I thought "maybe this is it!"

iaresee 7y ago
Does the billing dashboard not cover your needs? With their billing query UI you can slice your billing data by region, service, etc.
- derefr 7y ago
  The billing API tells you about resources that have charged you, whereas I think the parent comment is talking about resources that are either “active” in some sense where they will charge you at some point in the future for the usage you’re accruing (but where this usage isn’t metered in a way visible to the billing API until it “commits” somehow); or, worse, resources which are “exposed” in some sense where they could charge you if they received a request, but happen to not have received any yet. (These resources are very easy to lose track of.) Another way to think of this question is “what is my current exploitable attack surface, against the ‘attack’ of causing AWS to charge me lots of money?”
  - jjeaff 7y ago
    They do only show what you have been charged, but to my knowledge this is update very regularly. It seems at least next day.
- slaman 7y ago
  and by Tag, which is the most useful way to organize your resources for internal billing/analysis. Don't see any missing functionality but our use case may not be complex enough.
- andrewstuart 7y ago
  Yes that's retrospective, I'd like to see everything in use now that costs money, with links to direct manage those resources.
dyu 7y ago
You can also check out https://divvycloud.com/ https://divvycloud.com/, which is similar and supports a few other clouds.
joshanderson 7y ago
It’s not in Amazon’s interest to make billing easy to understand
- eropple 7y ago
  This isn't really true. Billing opacity scares off small clients (it's one of the biggest reasons that, as a consultant, my clients leaned away from AWS) and can make larger clients consider diversification or divestiture.
dstroot 7y ago
I had a key compromise. They spun up resources across the world. I had to go on a safari to hunt and kill all the things they created in each region. I would’ve loved to of had a single view to see all the resources running across all regions. That would’ve been super helpful.
- mooreds 7y ago
  This might help: https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/find-resources-to-tag.html https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/fi... Regions and tags are optional, which will show you everything.
kiwicopple 7y ago
I’ve been using komiser.io for this. I saw it here on Show HN about a month ago and have been using it ever since
pwarner 7y ago
3rd party services offer this for sure - https://www.cloudhealthtech.com/ https://www.cloudhealthtech.com/ - https://cloudcheckr.com/ https://cloudcheckr.com/ And several others.
sandGorgon 7y ago
This. This is one thing that GCP has done so brilliantly right - the projects structure. From an organisation point of view, this is the most seamless way of managing billing+access , instead of mucking about ARN crap. It's puzzling that AWS has still not been able to roll this out. What's so hard ? roll out projects and put all existing customers in a default project.
couterSpell 7y ago
Have you looked at AWS Config? Config gives you the ability to build asset inventories and be alerted when things change. It only works regionally, but it's better than nothing.

cbdumas 7y ago

This looks like a public facing version of a tool that AWS uses internally, which is great. Super easy tool to setup and govern AWS accounts, and also access the accounts to which you have access. I always wondered why they didn't sell it to their customers but I guess now they will!

omeid2 7y ago

AWS is pushing Organizations/Accounts as something like GCP's Projects and it mostly works, cross account iam works pretty good, so does many other services but sadly this is not reflected in the support subscriptions. You want help with a problem in your staging account? pay for support, fair enough. You want help with your production? oh sorry, you have to pay again.

marcinzm 7y ago
>You want help with a problem in your staging account? pay for support, you want help with your production? oh sorry, you have to pay again. In a sense this is a good thing since support is percentage based and you may want a higher level for support for production than staging.
- omeid2 7y ago
  You should have the option to pay for the aggregate and get support across all the accounts, it only makes sense, really.
  - deleted 7y ago
    [deleted]
  - dodobirdlord 7y ago
    If I recall correctly, that only happens at the Enterprise support tier.
    - scarface74 7y ago
      You pay a minimum of $100 per account for business support - 10% of your bill.
      - dragonwriter 7y ago
        Business support has pricing that drops as a percentage as your spend goes up, like Enterprise, but does not allow you aggregate across accounts like enterprise. It's only 10% for the first $10K. 7% for the portion up to $80K, 5% for the portion up to $250K, and 3% beyond that. (Enterprise has the same kind of %age ranges but cutoffs of $150K/$500K/$1M and the bottom range doesn't really matter because the hard minimum is $15K/mo.)

wayne_skylar 7y ago

Sorry but I've never felt that Amazon is completely operating in good faith with regards to allowing users to manage their costs. The proof of that is the fact that they still don't have a page where you can see the price of an ec2 instance alongside its stats. I've been wanting to see that for ten years and they still haven't added it.

joemag 7y ago
EC2 engineer here. Pricing is definitely a hard topic, and we can do more to make it easier. However, with regards to your second comment, are you looking for something more than this page [1] [1] https://aws.amazon.com/ec2/pricing/on-demand/ https://aws.amazon.com/ec2/pricing/on-demand/
- pwarner 7y ago
  Of course there is https://www.ec2instances.info/ https://www.ec2instances.info/ or if you are into Azure then https://azureprice.net/ https://azureprice.net/
- roca 7y ago
  The one obvious thing that's missing from that page is the network interface.
athrun 7y ago
In addition to the resources other commenters have listed, there's also the Price List API: https://aws.amazon.com/blogs/aws/new-aws-price-list-api/ https://aws.amazon.com/blogs/aws/new-aws-price-list-api/ It provides both pricing and product information, so you can build your own dashboard/tooling if you want to.

rukenshia 7y ago

I love that AWS is starting to care more about providing these services. For context, we have basically been building this for 2 years in our company internally to provide hundreds of “compliant by default” accounts. Every company seems to do it themselves. What I personally find very frustrating is the lack of being able to migrate any existing organisations into this. I’d love to get rid of some of our account provisioning but this would basically mean starting over with a brand-new AWS Organization which is impossible for us. It still is quite a hassle to manage many accounts (and resources you need in them) so I hope this service will sooner or later help us with this. PS: if anyone is over at re:Inforce and wants to talk about anything AWS Orgs & accounts, feel free to mail me (profile)!

joseph 7y ago
I also worked on a team that built something similar, and I've seen it done in other companies. With services like this, and others like Transit Gateway, it's getting a lot easier to manage multiple accounts and VPCs. I haven't tried AWS Control Tower yet, but I am hoping it gives easy visibility into all the accounts in one place. With Amazon accounts, once you assume a role into an account, you can't see other accounts without switching back into them. This is one area where I think GCP got it right. By using organizations and projects within one account instead of having parent and child accounts, it's quite a bit easier to see what's going on. And a parent account has a very different role from child accounts, so it makes sense to treat them as separate things.

thomasedwards 7y ago

Just tried it on our master account: > You tried to use an account that is a member of an organization in AWS Organizations. To set up your AWS Control Tower landing zone, use an account that is not a member of an organization. Looks like it’s only feasible if you’re starting from scratch.

s14ve 7y ago
Have you managed to get it working in the end? I've encountered the same issue.
- thomasedwards 7y ago
  No stopped trying – I’m not too worried as I have a Firefox Containers setup to switch between all the accounts.

dvfjsdhgfv 7y ago

Thank you AWS. In the meantime, if you could offer me just one basic setting that users have been asking for years (hard limit on your spending), it would be even better.

kousikk 7y ago
(Assuming no malicious intent from AWS) One of the reasons this is probably hard is probably because a lot of services didn't start out with having resource constraints. So now if you support something like a "hard-billing-cap", every single service in AWS has to support it. That's a huge stone to move - it could even be in the works today.
- marcinzm 7y ago
  There's also no good way for most services to support it since storing data costs money and presumably you don't want AWS to wipe your data when you hit your spending cap.
  - deleted 7y ago
    [deleted]
marcinzm 7y ago
How would hard limits work? Do all your ec2 instances shut down? Do your s3 buckets and their data get deleted? Do you snapshots and EBS volumes get deleted? There's no way to pause these things since they still costs AWS money.
- argd678 7y ago
  You don’t let people start up the service if it will exceed a cost quota. For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance, but yeah other usage based services like s3 and network traffic that won’t work.
  - 7y ago