11 ms·

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Com

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple accounts, and the need to share / copy AMIs and/or snapshots between accounts. But never making them public.

d2mw 7y ago
> Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Non-marketplace AMIs are built on public EBS snapshots, but that's something they should still fix. Marketplace AMIs already handle private snapshots
dboreham 7y ago
Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...
- heyoni 7y ago
  goes home completely forgetting to change it back...
  - hinkley 7y ago
    The later in the day, the bigger the rationalizations. At some point you are too stupid to be allowed to use a keyboard. And yet we have an entire culture around staying late to get stuff done that probably could have waited until tomorrow.
- lowdose 7y ago
  The guy that produces that last line definitely wears a suit.
  - fixitfixit 7y ago
    Oh no. I work with very trendy Silicon Valley folks and it’s always someone in shorts and a t-shirt. Which is to say: it’s definitely a culture issue, but it doesn’t have to be a PHB doing it. I know a lot of really smart people who are under a lot of pressure, and combined with a lack of AWS knowledge, “just make it public” is surprisingly common.
    - 1000units 7y ago
      And it's worth noting a nonnegligible percentage of high-achieving businesspeople would torture small animals for the right price. Being a little lax with security policies under pressure isn't so shocking.
      - hinkley 7y ago
        How much do you think they'd pay to get to torture small animals? I had a boss who brought up https://en.wikipedia.org/wiki/The_Mask_of_Sanity https://en.wikipedia.org/wiki/The_Mask_of_Sanity and organizational sociopaths about twice a month. He must have been doing a better job of shielding us from his bosses than I thought, or I've had more crazy bosses than I thought, because a lot of it seemed like normal bureaucratic pathology to me, if a little more intense than usual.
        1000units 7y ago
        There's only one known remedy and it costs 15 cents, so that mask is precious. It's a special gift to be able to see these things clearly, but it comes at the cost of close acquaintance, and you'll always be more watchful than the innocent of mind. It's grimly amusing how common and relevant psychological aberrance is relative to the average person's perception of it (cf. downvotes). It's tiring and unpleasant to examine the world antagonistically from a place of comfort but luckily others on the fringes don't have an option and force us to pay for prisons and so forth.
- privateSFacct 7y ago
  This 100%. I don't do much AWS stuff - but this issue exists outside of AWS as well (inside a corp). It's why I hate all the password rotation, double VPN stuff - people work around it too much. All the old staff start having the tech person track their passwords or write them near the computer, all the young staff use whatever new .io domain does X super easily (but less securely) or stick things on thumb driver (no keypad) or use their personal google drive etc.
- joncrane 7y ago
  Yeah, that's pretty believable. Guess some places have a laxer culture and no automated scans checking for things like that.
  - somepig 7y ago
    most places
- Bombthecat 7y ago
  Too real...
fromthestart 7y ago
>Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Maybe they're trying to reproduce functionality of docker? It would actually be extremely useful for research involving modeling/AI because you could trivially reproduce the results by bundling the exact code and data. Edit: actually maybe I'm confusing EBS snapshots with AMIs...
t34543 7y ago
Aren’t public EBS snapshots the underlying mechanism for public AMIs? I’ve ran into complex permissions in a golden image deploy model where the same AMI is used across multiple accounts. There needs to be controls like S3 where you can explicitly block public data. AWS IAM kind of sucks.
- spydum 7y ago
  I’m convinced the last few years of ramped up concern about AWS “blast radius” is an admission by AWS professionals that NOBODY gets IAM right.
Exuma 7y ago
Is it a default setting that it's public or do you have to go out of the way to do that?
based2 7y ago
to synchronize backups to the onprem datacentre. https://angus.readthedocs.io/en/2014/amazon/using-ebs-snapshot.html https://angus.readthedocs.io/en/2014/amazon/using-ebs-snapsh...

d2mw 7y ago

> Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Non-marketplace AMIs are built on public EBS snapshots, but that's something they should still fix. Marketplace AMIs already handle private snapshots

dboreham 7y ago

Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...

heyoni 7y ago
goes home completely forgetting to change it back...
- hinkley 7y ago
  The later in the day, the bigger the rationalizations. At some point you are too stupid to be allowed to use a keyboard. And yet we have an entire culture around staying late to get stuff done that probably could have waited until tomorrow.
lowdose 7y ago
The guy that produces that last line definitely wears a suit.
- fixitfixit 7y ago
  Oh no. I work with very trendy Silicon Valley folks and it’s always someone in shorts and a t-shirt. Which is to say: it’s definitely a culture issue, but it doesn’t have to be a PHB doing it. I know a lot of really smart people who are under a lot of pressure, and combined with a lack of AWS knowledge, “just make it public” is surprisingly common.
  - 1000units 7y ago
    And it's worth noting a nonnegligible percentage of high-achieving businesspeople would torture small animals for the right price. Being a little lax with security policies under pressure isn't so shocking.
    - hinkley 7y ago
      How much do you think they'd pay to get to torture small animals? I had a boss who brought up https://en.wikipedia.org/wiki/The_Mask_of_Sanity https://en.wikipedia.org/wiki/The_Mask_of_Sanity and organizational sociopaths about twice a month. He must have been doing a better job of shielding us from his bosses than I thought, or I've had more crazy bosses than I thought, because a lot of it seemed like normal bureaucratic pathology to me, if a little more intense than usual.
      - 1000units 7y ago
        There's only one known remedy and it costs 15 cents, so that mask is precious. It's a special gift to be able to see these things clearly, but it comes at the cost of close acquaintance, and you'll always be more watchful than the innocent of mind. It's grimly amusing how common and relevant psychological aberrance is relative to the average person's perception of it (cf. downvotes). It's tiring and unpleasant to examine the world antagonistically from a place of comfort but luckily others on the fringes don't have an option and force us to pay for prisons and so forth.
privateSFacct 7y ago
This 100%. I don't do much AWS stuff - but this issue exists outside of AWS as well (inside a corp). It's why I hate all the password rotation, double VPN stuff - people work around it too much. All the old staff start having the tech person track their passwords or write them near the computer, all the young staff use whatever new .io domain does X super easily (but less securely) or stick things on thumb driver (no keypad) or use their personal google drive etc.
joncrane 7y ago
Yeah, that's pretty believable. Guess some places have a laxer culture and no automated scans checking for things like that.
- somepig 7y ago
  most places
Bombthecat 7y ago
Too real...

fromthestart 7y ago

>Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Maybe they're trying to reproduce functionality of docker? It would actually be extremely useful for research involving modeling/AI because you could trivially reproduce the results by bundling the exact code and data. Edit: actually maybe I'm confusing EBS snapshots with AMIs...

t34543 7y ago

Aren’t public EBS snapshots the underlying mechanism for public AMIs? I’ve ran into complex permissions in a golden image deploy model where the same AMI is used across multiple accounts. There needs to be controls like S3 where you can explicitly block public data. AWS IAM kind of sucks.

spydum 7y ago
I’m convinced the last few years of ramped up concern about AWS “blast radius” is an admission by AWS professionals that NOBODY gets IAM right.

Exuma 7y ago

Is it a default setting that it's public or do you have to go out of the way to do that?

based2 7y ago

to synchronize backups to the onprem datacentre. https://angus.readthedocs.io/en/2014/amazon/using-ebs-snapshot.html https://angus.readthedocs.io/en/2014/amazon/using-ebs-snapsh...