5 ms·
I always wonder about patterns of directly exposing s3. It always seems preferable to me to have that abstracted to a service that only handles file storage and
by gpapilion 6y ago
I always wonder about patterns of directly exposing s3. It always seems preferable to me to have that abstracted to a service that only handles file storage and retrieval. It burdens you with the application logic, but provides you the opportunity for portability and allows you tighter limits on s3 access.
I want to minimize the total number of accounts with AWS access, since a configuration error can expose so much.
- xyzzy_plugh 6y agoSecond this. If you have nuanced usage of AWS, then minting credentials (hopefully through grant-only roles with expiry) on the reg is the way to go, but for so many cases, people don't need AWS access. They need to do <some thing> where it would be trivial to wrap the thing in a safe and sane, auditable manner.