5 ms·

Perhaps I'm alone here, but I'd say 50% of my time with AWS goes to (attempting to) properly configure the VPC as well as the IAM roles. For the majority of sma

Perhaps I'm alone here, but I'd say 50% of my time with AWS goes to (attempting to) properly configure the VPC as well as the IAM roles. For the majority of small-ish projects, the hardware isn't nearly as important or difficult as properly configuring access rules between services and outside parties.

rjurney 7y ago
IAM is a killer. You’re absolutely right. Are GCP permissions easier? I haven’t used them as much.
- chishaku 7y ago
  night and day imho
- mey 7y ago
  https://github.com/tilfin/aws-extend-switch-roles/blob/master/README.md https://github.com/tilfin/aws-extend-switch-roles/blob/maste... may be interesting to you. The fact that this has to exist is also interesting...
- usmannk 7y ago
  I'll hate on GCP all day long but the one thing it has going for it is the permissions.
  - wodenokoto 7y ago
    Wow, I was gonna say “haven’t tried IAM on other platforms than GCP but I can’t imagine it being more difficult than this”, but damn ...
- jsmeaton 7y ago
  I’ve stopped worrying about minimising IAM permissions and tend to just use the built in AWS roles for most things now.
  - DVassallo 7y ago
    Yes, I do the same. For service roles I just use the PowerUser managed role. I don’t see the need to put access control on Amazon’s ability to call it’s own services. I only restrict my EC2 instance profile, since that’s a bit more vulnerable, and I tend to know very precisely what it should have access to.
    - poxrud 7y ago
      What if you have a lambda with a full admin role that is not sanitizing its inputs? Or maybe it's using an outdated file parsing library (csv/yaml) with a vulnerability. Now your entire AWS account could potentially be compromised.
      - DVassallo 7y ago
        Yes, I would use a restricted role for Lambda too. Anything that gets creds in user space gets restricted permissions: EC2, Lambda, ECS, etc.
  - darkr 7y ago
    Some of the AWS built-in roles are an absolute car crash, no idea how they got through review (EMR is a good example). I use the built-in roles by default, but only after thoroughly reviewing the policies, I create my own based on that if I find anything I don’t like. It’s not restricting amazon’s access that I’m worried about, more privilege escalation (e.g non-constrained iam:PassRole in combination with anything is a good one)
- deleted 7y ago
  [deleted]
DVassallo 7y ago
Don’t you have to do it just once though? I have a CloudFormation template that I wrote in 2014 to set up all VPCs, Subnets, Gateways, Security Groups, etc, and it’s still all valid today.
- celim307 7y ago
  Depends on how fast your project grows and evolves. Hub and spoke simplifies a lot of things but not everything.
- jamestimmins 7y ago
  I think I'd agree if I had a better grasp of networking in general. VPC still requires a solid understanding of networking, which is my biggest challenge.
  - chousuke 7y ago
    What part of VPC networking is challenging to you? I'm genuinely interested, because I find the basics of internet (IP) routing and addressing to be very straightforward. Not trivial, certainly, but it's not black magic, and I don't think VPCs require anything esoteric. It all essentially boils down to some basic operations with binary numbers; the decimal repsresentations of IP addresses are useful shortcuts, but to really get a sense of what's happening, you need to look at the binary forms.
    - sah2ed 7y ago
      > What part of VPC networking is challenging to you? It can be a source of friction for someone that is just trying to accomplish a specific goal, in this case it might just be to use AWS to go live. If building a database-backed prototype is your goal, designing a schema is only tangentially related to that goal. Schema design ability can slow you down if you have limited familiarity with SQL and/or the entity relationship model used by RDBMS. NoSQL allows you to reach that specific goal faster than with an RDBMS by lowering the friction of creating database records and it does it by flipping the schema model from schema-on-write to schema-on-read which is a huge time saver. This made NoSQL great for building prototypes, especially for devs with little or no familiarity with SQL, because it eliminates the upfront effort of designing a schema (that is certain to change anyway) before you can begin to store records in the database. In other words, the use of a far more familiar language (JavaScript vs. SQL) and the simpler programming model (document-model vs. entity relationship model) is a big part of why MongoDB was able to earn mind share among devs evaluating NoSQLs databases.
arwhatever 7y ago
The lack of this hassle is a big part of what has attracted me to Azure. I had a list at one point, not much VPC and IAM Roles, but routing tables, CIDR blocks, NAT Gateways, I can't remember what all else. I just remember thinking that, while such configuration options might be powerful in the right hands, if you expect your application developers to manage all that, your cloud services are designed at the wrong level of abstraction.
- bharam 7y ago
  > I had a list at one point, not much VPC and IAM Roles, but routing tables, CIDR blocks, NAT Gateways Just curious - how is the developer experience different on Azure? There are different types of developers. Some like to have full control and end up building their own cloud infrastructure while others like to have no control and go with something like Heroku (or maybe Azure, but I'm not too familiar with that hence my question).
  - arwhatever 7y ago
    To set up basic App Services, Azure Functions, Web Jobs and the few other bits that I have been involved with, I have needed to do zero networking or permissions configuration. Perhaps this is severely less secure by default, but it sure does make for a lower barrier to entry, and for reduced distraction from app development. I also liked Heroku quite well. Felt at one point like I needed to move to Azure for some technical reason but right now, I can't recall the reason. Originally in AWS I wanted to send emails from within a Lambda Function, and doing so required me to rework my networking configuration that I felt like I had barely gotten running AND pay ~$30/mo for some additional required networking service. IP Gateway or NAT Gateway or some other such. That was what finally ran me off from AWS.
- manigandham 7y ago
  This is where GCP shines. The IAM and user system along with the organization/folder/project hierarchy is magnitudes better than anything in Azure or AWS. Makes managing everything from hobby projects to big corps simple. The only annoying thing is that GCP uses json certification files for service accounts rather than just API key/secret pairs which are more portable, but you can usually avoid dealing with this by setting the account for the underlying VM or managed service.
420codebro 7y ago
Yes this is a significant source of my time suck too. I try to automate as much IAM perms as I can via terraform, which has allowed me to speed up our deployment velocity.

rjurney 7y ago

IAM is a killer. You’re absolutely right. Are GCP permissions easier? I haven’t used them as much.

chishaku 7y ago
night and day imho
mey 7y ago
https://github.com/tilfin/aws-extend-switch-roles/blob/master/README.md https://github.com/tilfin/aws-extend-switch-roles/blob/maste... may be interesting to you. The fact that this has to exist is also interesting...
usmannk 7y ago
I'll hate on GCP all day long but the one thing it has going for it is the permissions.
- wodenokoto 7y ago
  Wow, I was gonna say “haven’t tried IAM on other platforms than GCP but I can’t imagine it being more difficult than this”, but damn ...
jsmeaton 7y ago
I’ve stopped worrying about minimising IAM permissions and tend to just use the built in AWS roles for most things now.
- DVassallo 7y ago
  Yes, I do the same. For service roles I just use the PowerUser managed role. I don’t see the need to put access control on Amazon’s ability to call it’s own services. I only restrict my EC2 instance profile, since that’s a bit more vulnerable, and I tend to know very precisely what it should have access to.
  - poxrud 7y ago
    What if you have a lambda with a full admin role that is not sanitizing its inputs? Or maybe it's using an outdated file parsing library (csv/yaml) with a vulnerability. Now your entire AWS account could potentially be compromised.
    - DVassallo 7y ago
      Yes, I would use a restricted role for Lambda too. Anything that gets creds in user space gets restricted permissions: EC2, Lambda, ECS, etc.
- darkr 7y ago
  Some of the AWS built-in roles are an absolute car crash, no idea how they got through review (EMR is a good example). I use the built-in roles by default, but only after thoroughly reviewing the policies, I create my own based on that if I find anything I don’t like. It’s not restricting amazon’s access that I’m worried about, more privilege escalation (e.g non-constrained iam:PassRole in combination with anything is a good one)
deleted 7y ago
[deleted]

DVassallo 7y ago

Don’t you have to do it just once though? I have a CloudFormation template that I wrote in 2014 to set up all VPCs, Subnets, Gateways, Security Groups, etc, and it’s still all valid today.

celim307 7y ago
Depends on how fast your project grows and evolves. Hub and spoke simplifies a lot of things but not everything.
jamestimmins 7y ago
I think I'd agree if I had a better grasp of networking in general. VPC still requires a solid understanding of networking, which is my biggest challenge.
- chousuke 7y ago
  What part of VPC networking is challenging to you? I'm genuinely interested, because I find the basics of internet (IP) routing and addressing to be very straightforward. Not trivial, certainly, but it's not black magic, and I don't think VPCs require anything esoteric. It all essentially boils down to some basic operations with binary numbers; the decimal repsresentations of IP addresses are useful shortcuts, but to really get a sense of what's happening, you need to look at the binary forms.
  - sah2ed 7y ago
    > What part of VPC networking is challenging to you? It can be a source of friction for someone that is just trying to accomplish a specific goal, in this case it might just be to use AWS to go live. If building a database-backed prototype is your goal, designing a schema is only tangentially related to that goal. Schema design ability can slow you down if you have limited familiarity with SQL and/or the entity relationship model used by RDBMS. NoSQL allows you to reach that specific goal faster than with an RDBMS by lowering the friction of creating database records and it does it by flipping the schema model from schema-on-write to schema-on-read which is a huge time saver. This made NoSQL great for building prototypes, especially for devs with little or no familiarity with SQL, because it eliminates the upfront effort of designing a schema (that is certain to change anyway) before you can begin to store records in the database. In other words, the use of a far more familiar language (JavaScript vs. SQL) and the simpler programming model (document-model vs. entity relationship model) is a big part of why MongoDB was able to earn mind share among devs evaluating NoSQLs databases.

arwhatever 7y ago

The lack of this hassle is a big part of what has attracted me to Azure. I had a list at one point, not much VPC and IAM Roles, but routing tables, CIDR blocks, NAT Gateways, I can't remember what all else. I just remember thinking that, while such configuration options might be powerful in the right hands, if you expect your application developers to manage all that, your cloud services are designed at the wrong level of abstraction.

bharam 7y ago
> I had a list at one point, not much VPC and IAM Roles, but routing tables, CIDR blocks, NAT Gateways Just curious - how is the developer experience different on Azure? There are different types of developers. Some like to have full control and end up building their own cloud infrastructure while others like to have no control and go with something like Heroku (or maybe Azure, but I'm not too familiar with that hence my question).
- arwhatever 7y ago
  To set up basic App Services, Azure Functions, Web Jobs and the few other bits that I have been involved with, I have needed to do zero networking or permissions configuration. Perhaps this is severely less secure by default, but it sure does make for a lower barrier to entry, and for reduced distraction from app development. I also liked Heroku quite well. Felt at one point like I needed to move to Azure for some technical reason but right now, I can't recall the reason. Originally in AWS I wanted to send emails from within a Lambda Function, and doing so required me to rework my networking configuration that I felt like I had barely gotten running AND pay ~$30/mo for some additional required networking service. IP Gateway or NAT Gateway or some other such. That was what finally ran me off from AWS.
manigandham 7y ago
This is where GCP shines. The IAM and user system along with the organization/folder/project hierarchy is magnitudes better than anything in Azure or AWS. Makes managing everything from hobby projects to big corps simple. The only annoying thing is that GCP uses json certification files for service accounts rather than just API key/secret pairs which are more portable, but you can usually avoid dealing with this by setting the account for the underlying VM or managed service.

420codebro 7y ago

Yes this is a significant source of my time suck too. I try to automate as much IAM perms as I can via terraform, which has allowed me to speed up our deployment velocity.