3 ms·

I used to work at Google on Cloud, and am now an AWS customer. Have used both clouds extensively. My comments are mostly backed up by my experience at startups

I used to work at Google on Cloud, and am now an AWS customer. Have used both clouds extensively. My comments are mostly backed up by my experience at startups and are not colored by my experience at Google (too different a beast). GCP is great for teams that are also using GSuite because you can set permissions at the level of a Google Group and have them propagate to individual members. You can, of course, also create groups in AWS but they don't have the same semantics of Google Groups and don't cover the wide range of use cases that Google Groups does. The AWS scopes -> policies -> roles -> resources chain of abstractions is less natural conceptually than GCP's GSuite accounts + service accounts with attached scopes per project. Also the fact that each managed service (GCE, GKE, Cloud Builder) has its own service account that you can attach scopes to is really nice. GCP service accounts just feel more discoverable than AWS IAM roles - I think it's because the number of AWS pre-built roles is so overwhelming. Just some thoughts off the top of my head.

numbsafari 6y ago
I think all of these replies so far capture my thinking. However, I think the simplicity of the GCP IAM model is what I will miss most going back to AWS. I’m sure they exist, but over the last dozen or so years I’ve worked with public cloud offerings across 5 or 6 industries and domains, I haven’t found a use case that can’t be easily implemented in the simpler GCP model. AWS support is really nice. That I miss.
nhoughto 6y ago
Gone deep on IAM in AWS, attempted a similar thing on GCP later for another project, was very surprised how weak GCP IAM was. Top of mind things I found weak/weird: - Basically can’t do least privilege, only want a role to read messages from one pubsub queue? Nope not possible - IAM policies seem bolted on, legacy roles seem much better fit in the ecosystem, but they suck obvs. - different gcp resources have somewhere between very coarse grain to just acceptable iam operations. Might just be GCS that lets you do proper least privileges policies like you would do in AWS. I was very surprised how bad it was, AWS IAM is some black magic shit that is deeply impressive and often taken for granted, even GCP can’t replicate.
- zomglings 6y ago
  Haha, my company is still pretty small and I have very few policies with star-less ARNs. :) But I agree, AWS IAM is some black magic and is very powerful.

numbsafari 6y ago

I think all of these replies so far capture my thinking. However, I think the simplicity of the GCP IAM model is what I will miss most going back to AWS. I’m sure they exist, but over the last dozen or so years I’ve worked with public cloud offerings across 5 or 6 industries and domains, I haven’t found a use case that can’t be easily implemented in the simpler GCP model. AWS support is really nice. That I miss.

nhoughto 6y ago

Gone deep on IAM in AWS, attempted a similar thing on GCP later for another project, was very surprised how weak GCP IAM was. Top of mind things I found weak/weird: - Basically can’t do least privilege, only want a role to read messages from one pubsub queue? Nope not possible - IAM policies seem bolted on, legacy roles seem much better fit in the ecosystem, but they suck obvs. - different gcp resources have somewhere between very coarse grain to just acceptable iam operations. Might just be GCS that lets you do proper least privileges policies like you would do in AWS. I was very surprised how bad it was, AWS IAM is some black magic shit that is deeply impressive and often taken for granted, even GCP can’t replicate.

zomglings 6y ago
Haha, my company is still pretty small and I have very few policies with star-less ARNs. :) But I agree, AWS IAM is some black magic and is very powerful.