5 ms·
Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if
by anonu 6y ago
Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
- dragonwriter 6y ago> Aren't there protections in AWS For this, in general, the answer is: (1) yes, IAM permissions, and (2) yes, if you configure them, and they often have a cost. > Wouldn't AWS step in and help a company like Cisco if something horrible went wrong? If Cisco asked, probably. But some things are inherently non-trivial to recover from once you've allowed them to happen. AWS can help, but they aren't magic.
- WrtCdEvrydy 6y agoDeletion Protection is amazing, but the true way to fix this is to use IAM roles, and groups. Remove the user that is being terminated from the group and 'voila', it is safe.
- deleted 6y ago[deleted]
- user5994461 6y agoSet the termination protection flag on critical instances (like databases), then they cannot be deleted programmatically. This works really really well.
- dragonwriter 6y ago> Set the termination protection flag on critical instances (like databases), then they cannot be deleted programmatically. Well, not accidentally, but the flag itself can be cleared programmatically, so protected instances can definitely still be maliciously deleted programmatically, if the actor has sufficient access.
- user5994461 6y agoOh really? I thought the only way was to go to the web UI and and select instances to remove the flag.
- dragonwriter 6y agoQuick googling found CLI instructions (for both the generic and powershell CLIs), and those are just wrappers around the APIs.