3 ms·
I would argue the killer feature is actually IAM: technically better than anything any other vendor offers, even if there are a million and one problems with it
by jen20 7y ago
I would argue the killer feature is actually IAM: technically better than anything any other vendor offers, even if there are a million and one problems with it and not a single annoyance has been fixed since 2013.
- jjoonathan 7y agoI could see that. I almost mentioned IAM in my post as a co-killer-feature, but I've only ever witnessed its power in AWS learning material / conferences, not being leveraged IRL, so I decided not to speculate. I'm more dev than ops, so even though I've seen a decent number of AWS environments the fact that they have all used IAM in a clumsy, coarse manner doesn't really mean much. Do you have a feel for how frequently ops manages to actually leverage the fine-grained power features in IAM?
- jen20 7y agoEssentially every large scale environment I’ve seen (as an ex-core maintainer of Terraform, that is quite a few) either does an ok job of this or has projects to do better. The issue I have with IAM is that it is not possible to be sufficiently fine grained - for example I cannot grant an instance permission to read its own tag values but not those of other instances, since the EC2 IAM API is stuck in the state of 85% done at which most AWS services eventually seem to plateau.