6 ms·

Cognito: yes, its a complex poorly documented pile of shite. BUT. It does work as a reasonably secure OAUTH2 thingamebob. However I was told by my AWS account

Cognito: yes, its a complex poorly documented pile of shite. BUT. It does work as a reasonably secure OAUTH2 thingamebob. However I was told by my AWS account manager that auth0 was the way forward, and I agree. Cloudformation: Meh, I have about 35k lines of active CF at the moment. Its much of a muchness. Unless you are using parameters with selectors, you are going to have a bad time. Hard linking templates together (I assume thats what nested stacks are) is terrible. I've only briefly used terraform, so I have no idea if its much better. CF _could be_ a lot better. Like compile time validation, not just in time. that would stop a lot of anger when you realise you've spelt a CF parameter wrong(or the value fails validation) but only after you've spent ten minutes for it to spin up. Thats frankly unforgivable. Elasticache: Yes. Its expensive. KINESIS: What a disappointment. Stupid naming conventions, Terrible throttling and throughput. Its just horrific. Whats worse is that they looked at SQS and thought: "this compares favouribly" NATS.io is a great fit for certain usecases (no, kafka is never the answer) LAmbda: I don't actually get this myself. I made a REST api exclusively in lambda. It meant that I could build a working prototype really quickly. Once proven we ported it to fastapi in an autoscale group. The API gateway was heavily integrated into the lambda spinup (controlled in CF) so I really don't see what the issue it. Also it understands swagger, so I struggle to understand the criticism

PaywallBuster 7y ago
Author is making a new lambda for each route. But you can point each route in API Gateway to a different function in the same lambda. Additionally, using serverless framework facilitate local testing too. That solves all the complaints from the author.
- kdidbsbsbd 7y ago
  That only works if your functions require same resources. If you need different memory/cpu power you're unevenly splitting functions where ever
zhdc1 7y ago
I've used Cognito for personal/pet web app projects before. It was good for my use case - quick and cheap user authentication.
- KaiserPro 7y ago
  Oh it can be! but the documentation is utterly pitiful
- crummy 7y ago
  The simpler the better. In my limited experience once we started fleshing out users to admins, managers, and users, in a multi-tenanted environment, we pretty quickly ran up against Cognito limitations which surprised me. (Cognito groups seemed made for this, except they have a limit of 10k groups. We ended up storing a comma-separated list of ids in a custom cognito tag, which seemed awkward.)
user5994461 7y ago
>>> However I was told by my AWS account manager that auth0 was the way forward, and I agree. What do they mean by that? auth0 is a company that sells a variety of authentication solutions (on premise and SaaS) and a variety of authentication libraries/plugins. For example they run the site https://jwt.io/ https://jwt.io/ that anybody who's had to work with JWT tokens would have used at some point.
- KaiserPro 7y ago
  Auth0 sell a bunch of authentication products that are similar/compete with cognito. The difference between cognito and auth0 is that auth0 has documentation, code examples and a decent API guide. Cognito has a poorly documented API, terrible integration guides and even worse debugging options Once you have it going, cognito is grand. To get there, its a huge learning curve
  - dlhavema 7y ago
    The fact that some specific attributes or options cannot change after creation is hard too. Other than that, it's not too bad. But like you said, setting it up takes effort, but a lot of programming is getting to a non trivial hello world.
incognito_limey 7y ago
Why is (no, kafka is never the answer)?
- KaiserPro 7y ago
  Large, painful to configure, high latency and difficult to look after.
  - dominotw 7y ago
    > difficult to look after. Agree with this 100%. But what about hosted kafka solutions? > high latency Not sure I understand this point.
    - incognito_limey 7y ago
      What makes it difficult to look after? Genuinely curious. I've run it in production for years and its been pretty solid.
  - incognito_limey 7y ago
    Not sure I understand the "large" comment. Painful to configure.. have you looked at CP-Ansible: https://github.com/confluentinc/cp-ansible https://github.com/confluentinc/cp-ansible High Latency: Kafka's latency depends on your configuration and infrastructure. It has some of the lowest latency out there when configured correctly. Curios to know why you find it difficult to look after? It's super stable, and is pretty easy to monitor via JMX.
  - isugimpy 7y ago
    Curious to hear more details about your thoughts on this. I've done some pretty significant improvements around my team's use of it in the last few months and can't say I've had this experience. The difficulties with it really, to me, seem to be a case of batteries-not-included, speaking as someone who had never run it prior to last August.
- wdb 7y ago
  What are good Kafka alternatives? There got to be some Go written one somewhere ;)
thanksforfish 7y ago
> compile time validation Oh! I forgot about that mess. Yeah, it takes minutes of deploy time while real resources are spun up to catch some really basic mistakes. Terraform plan catches a lot of issues, but I've seen cases where it misses something.
- alexbanks 7y ago
  I haven't seen a scenario where TF plan AND apply miss something, but I have definitely been in the scenario where a CF stack fails, and then the rollback fails, and then you're stuck with an undeletable resource and can only submit a ticket to AWS.
  - acdha 7y ago
    Ditto on both counts: we stopped using CF after hitting one of those irrecoverable bugs — usually deleting the resources manually and ignoring all the errors deleting the stack would recover after a cycle or two but we hit at least one case where that wasn’t true.
  - ciceryadam 7y ago
    I had a lot of uncatched issues while migrating from tf11 to tf12, as far as I remember it was due to heavy module usage.
debaserab2 7y ago
> CF _could be_ a lot better. Like compile time validation, not just in time. I've recently finished a project using AWS CDK, which seems to do a certain amount of this. Just using TypeScript and having AWS resource interfaces be fully typed goes a long ways for finding a template mistake quickly.
- mxz3000 7y ago
  +1 for CDK. It's the way forward. CloudFormation sucks.
swyx 7y ago
seriously, an AWS account manager told you to use a competitor? is this common? in a normal company salespeople might lose their jobs for saying that.
- coredog64 7y ago
  Amazon doesn’t care what you use as long as you’re staying in their broader ecosystem. I think it comes down to the “more flies with honey” thing. The customer will go on the defensive and shutdown if you tell them they’re stupid.
  - kdidbsbsbd 7y ago
    Rather they're watching what others do on their platform and then make their own products based on it, same as on Amazon.com
- mcherm 7y ago
  > in a normal company salespeople might lose their jobs for saying that. Quite a few times over my career I have had a salesperson (not from Amazon) recommend a competitor over their own product. In every single case my respect for the salesperson shot way up. In at least two cases I can recall this helped them close a sale. A smart salesperson does not do everything possible to push their company's products... a smart salesperson solves their customers' problems.
  - zdragnar 7y ago
    > A smart salesperson does not do everything possible to push their company's products Bingo. A bad product fit means a bad customer experience, which means a bad review or reputation. The smaller the company, the more important referrals are from your customers. Sending a potential customer to a competitor will (potentially) earn goodwill and future referrals. At worst, they might not refer anyone your way, but at least they won't be badmouthing you either. Unfortunately, large companies typically mean large customers, and the people with the buying power aren't the people who will be using the product... so neither party really cares all that much about how well the product fits. This is the old "nobody gets fired for choosing IBM" mentality. The worst is when medium companies think they are big companies, and try to do that to small customers. I once saw a salesperson push hard for something that was very obviously too small to be worth our time, and the project management overhead would have lead to blowing our potential customer's budget out of the water. In the end, they walked away without working with us, and a pretty sour taste in their mouths from the pushiness of the sales guy.
slau 7y ago
I highly recommend cfn-lint [1]. As someone who has been writing CFN for a living for the past few months, it’s a godsend. [1]: https://github.com/aws-cloudformation/cfn-python-lint https://github.com/aws-cloudformation/cfn-python-lint
aprao 7y ago
Doesn't CF with dry-run enabled help with some of the compile-time validation?
runT1ME 7y ago
NATS.io and Kafka seem very different, the former not being able to do at least once guarantees, no?

PaywallBuster 7y ago

Author is making a new lambda for each route. But you can point each route in API Gateway to a different function in the same lambda. Additionally, using serverless framework facilitate local testing too. That solves all the complaints from the author.

kdidbsbsbd 7y ago
That only works if your functions require same resources. If you need different memory/cpu power you're unevenly splitting functions where ever

zhdc1 7y ago

I've used Cognito for personal/pet web app projects before. It was good for my use case - quick and cheap user authentication.

KaiserPro 7y ago
Oh it can be! but the documentation is utterly pitiful
crummy 7y ago
The simpler the better. In my limited experience once we started fleshing out users to admins, managers, and users, in a multi-tenanted environment, we pretty quickly ran up against Cognito limitations which surprised me. (Cognito groups seemed made for this, except they have a limit of 10k groups. We ended up storing a comma-separated list of ids in a custom cognito tag, which seemed awkward.)

user5994461 7y ago

>>> However I was told by my AWS account manager that auth0 was the way forward, and I agree. What do they mean by that? auth0 is a company that sells a variety of authentication solutions (on premise and SaaS) and a variety of authentication libraries/plugins. For example they run the site https://jwt.io/ https://jwt.io/ that anybody who's had to work with JWT tokens would have used at some point.

KaiserPro 7y ago
Auth0 sell a bunch of authentication products that are similar/compete with cognito. The difference between cognito and auth0 is that auth0 has documentation, code examples and a decent API guide. Cognito has a poorly documented API, terrible integration guides and even worse debugging options Once you have it going, cognito is grand. To get there, its a huge learning curve
- dlhavema 7y ago
  The fact that some specific attributes or options cannot change after creation is hard too. Other than that, it's not too bad. But like you said, setting it up takes effort, but a lot of programming is getting to a non trivial hello world.

incognito_limey 7y ago

Why is (no, kafka is never the answer)?

KaiserPro 7y ago
Large, painful to configure, high latency and difficult to look after.
- dominotw 7y ago
  > difficult to look after. Agree with this 100%. But what about hosted kafka solutions? > high latency Not sure I understand this point.
  - incognito_limey 7y ago
    What makes it difficult to look after? Genuinely curious. I've run it in production for years and its been pretty solid.
- incognito_limey 7y ago
  Not sure I understand the "large" comment. Painful to configure.. have you looked at CP-Ansible: https://github.com/confluentinc/cp-ansible https://github.com/confluentinc/cp-ansible High Latency: Kafka's latency depends on your configuration and infrastructure. It has some of the lowest latency out there when configured correctly. Curios to know why you find it difficult to look after? It's super stable, and is pretty easy to monitor via JMX.
- isugimpy 7y ago
  Curious to hear more details about your thoughts on this. I've done some pretty significant improvements around my team's use of it in the last few months and can't say I've had this experience. The difficulties with it really, to me, seem to be a case of batteries-not-included, speaking as someone who had never run it prior to last August.
wdb 7y ago
What are good Kafka alternatives? There got to be some Go written one somewhere ;)

thanksforfish 7y ago

> compile time validation Oh! I forgot about that mess. Yeah, it takes minutes of deploy time while real resources are spun up to catch some really basic mistakes. Terraform plan catches a lot of issues, but I've seen cases where it misses something.

alexbanks 7y ago
I haven't seen a scenario where TF plan AND apply miss something, but I have definitely been in the scenario where a CF stack fails, and then the rollback fails, and then you're stuck with an undeletable resource and can only submit a ticket to AWS.
- acdha 7y ago
  Ditto on both counts: we stopped using CF after hitting one of those irrecoverable bugs — usually deleting the resources manually and ignoring all the errors deleting the stack would recover after a cycle or two but we hit at least one case where that wasn’t true.
- ciceryadam 7y ago
  I had a lot of uncatched issues while migrating from tf11 to tf12, as far as I remember it was due to heavy module usage.

debaserab2 7y ago

> CF _could be_ a lot better. Like compile time validation, not just in time. I've recently finished a project using AWS CDK, which seems to do a certain amount of this. Just using TypeScript and having AWS resource interfaces be fully typed goes a long ways for finding a template mistake quickly.

mxz3000 7y ago
+1 for CDK. It's the way forward. CloudFormation sucks.

swyx 7y ago

seriously, an AWS account manager told you to use a competitor? is this common? in a normal company salespeople might lose their jobs for saying that.

coredog64 7y ago
Amazon doesn’t care what you use as long as you’re staying in their broader ecosystem. I think it comes down to the “more flies with honey” thing. The customer will go on the defensive and shutdown if you tell them they’re stupid.
- kdidbsbsbd 7y ago
  Rather they're watching what others do on their platform and then make their own products based on it, same as on Amazon.com
mcherm 7y ago
> in a normal company salespeople might lose their jobs for saying that. Quite a few times over my career I have had a salesperson (not from Amazon) recommend a competitor over their own product. In every single case my respect for the salesperson shot way up. In at least two cases I can recall this helped them close a sale. A smart salesperson does not do everything possible to push their company's products... a smart salesperson solves their customers' problems.
- zdragnar 7y ago
  > A smart salesperson does not do everything possible to push their company's products Bingo. A bad product fit means a bad customer experience, which means a bad review or reputation. The smaller the company, the more important referrals are from your customers. Sending a potential customer to a competitor will (potentially) earn goodwill and future referrals. At worst, they might not refer anyone your way, but at least they won't be badmouthing you either. Unfortunately, large companies typically mean large customers, and the people with the buying power aren't the people who will be using the product... so neither party really cares all that much about how well the product fits. This is the old "nobody gets fired for choosing IBM" mentality. The worst is when medium companies think they are big companies, and try to do that to small customers. I once saw a salesperson push hard for something that was very obviously too small to be worth our time, and the project management overhead would have lead to blowing our potential customer's budget out of the water. In the end, they walked away without working with us, and a pretty sour taste in their mouths from the pushiness of the sales guy.

slau 7y ago

I highly recommend cfn-lint [1]. As someone who has been writing CFN for a living for the past few months, it’s a godsend. [1]: https://github.com/aws-cloudformation/cfn-python-lint https://github.com/aws-cloudformation/cfn-python-lint

aprao 7y ago

Doesn't CF with dry-run enabled help with some of the compile-time validation?

runT1ME 7y ago

NATS.io and Kafka seem very different, the former not being able to do at least once guarantees, no?