4 ms·

Lots of companies also gets hacked each month for thousands of dollars because some key to S3 with too many privileges gets leaked. The entire system is comple

Lots of companies also gets hacked each month for thousands of dollars because some key to S3 with too many privileges gets leaked. The entire system is completely sinister. The fact that keys pertaining to S3 has anything do with being able to start hundreds of VM's in different parts of the AWS system or do whatever is bad. I've seen companies be ruined by this, and it's in no way obvious how stupid their system is. You have to read huge manuals to know how to "only give access to s3" through a key. Instead of starting with "no access" then adding atomized access you have to understand this extremely complex "json privilege system". Instead of just programming, this is the only allowed IP, the is the only allowed bucket, this is the only allowed service, and my max is 200usd, or something to that effect. Also the fact that a key can start new services that are billable is almost criminal in my mind when people don't even gen an email when it happens - makes zero sense.

ficklepickle 5y ago
> You have to read huge manuals to know how to "only give access to s3" through a key I have to disagree with this. It really is pretty straight forward.[0] [0] - https://objectivefs.com/howto/how-to-restrict-s3-bucket-policy-to-only-one-aws-s3-bucket https://objectivefs.com/howto/how-to-restrict-s3-bucket-poli...
simonw 5y ago
The feature I most want from AWS is a simple way to create credentials that are only allowed to read from or write to a specific S3 bucket. The way you do this at the moment genuinely involves copying and pasting JSON policy documents around! It's horrific. I want this for myself, but more importantly I want it for users of software that I write. I would love to be able to build something that stores a user's data in an S3 bucket that they own (and are billed for directly) - but it's currently just too difficult to talk them through setting up the bucket and creating the right credentials for it.
- quantico 5y ago
  They simply have to be in separate AWS accounts for this to work. To that end, you can provide them with a CloudFormation template that deploys a stack with the necessary configuration.
koolba 5y ago
> Instead of starting with "no access" then adding atomized access you have to understand this extremely complex "json privilege system". Instead of just programming, this is the only allowed IP, the is the only allowed bucket, this is the only allowed service, ... What would that look like if it’s not going to be a series of access permissions and filters represented as JSON? Security is never a simple checkbox and complaints like this about it needing to be simpler need to be backed up with an alternative. I genuinely wonder what alternative there is to the current permissions model. It’s incredibly expressive and doesn’t take that long to understand. People who cannot master it would likely leave some other side door open anyway. > ... and my max is 200usd, or something to that effect. This has been a valid complaint for years. Though to solve it you need to answer what happens to legit resources when your billing cap is reached. Do all your ephemeral serves turn off? Do your EBs volumes all her deleted? Do your S3 objects all disappear?
- kossTKR 5y ago
  Json is great. Their implementation of it, not so much. Way to complex only needing to give permission to a single "thing". And much of the naming makes little sense to new yes. DigitalOceans interface is easier for 90% of people. But to be honest it's years ago that i worked with AWS, but i remember everything being way more complex than it had to be and i had to use days undestanding their enourmous interface and "usersystem". And as long as this is a problem that pops up again and again, something is very wrong with their system i would say. If not creating a simpler interface / user system for regular users then at least give some huge warnings that unless you know what you are doing a key with the wrong JSON means access to all funds on the credit card.

ficklepickle 5y ago

> You have to read huge manuals to know how to "only give access to s3" through a key I have to disagree with this. It really is pretty straight forward.[0] [0] - https://objectivefs.com/howto/how-to-restrict-s3-bucket-policy-to-only-one-aws-s3-bucket https://objectivefs.com/howto/how-to-restrict-s3-bucket-poli...

simonw 5y ago

The feature I most want from AWS is a simple way to create credentials that are only allowed to read from or write to a specific S3 bucket. The way you do this at the moment genuinely involves copying and pasting JSON policy documents around! It's horrific. I want this for myself, but more importantly I want it for users of software that I write. I would love to be able to build something that stores a user's data in an S3 bucket that they own (and are billed for directly) - but it's currently just too difficult to talk them through setting up the bucket and creating the right credentials for it.

quantico 5y ago
They simply have to be in separate AWS accounts for this to work. To that end, you can provide them with a CloudFormation template that deploys a stack with the necessary configuration.

koolba 5y ago

> Instead of starting with "no access" then adding atomized access you have to understand this extremely complex "json privilege system". Instead of just programming, this is the only allowed IP, the is the only allowed bucket, this is the only allowed service, ... What would that look like if it’s not going to be a series of access permissions and filters represented as JSON? Security is never a simple checkbox and complaints like this about it needing to be simpler need to be backed up with an alternative. I genuinely wonder what alternative there is to the current permissions model. It’s incredibly expressive and doesn’t take that long to understand. People who cannot master it would likely leave some other side door open anyway. > ... and my max is 200usd, or something to that effect. This has been a valid complaint for years. Though to solve it you need to answer what happens to legit resources when your billing cap is reached. Do all your ephemeral serves turn off? Do your EBs volumes all her deleted? Do your S3 objects all disappear?

kossTKR 5y ago
Json is great. Their implementation of it, not so much. Way to complex only needing to give permission to a single "thing". And much of the naming makes little sense to new yes. DigitalOceans interface is easier for 90% of people. But to be honest it's years ago that i worked with AWS, but i remember everything being way more complex than it had to be and i had to use days undestanding their enourmous interface and "usersystem". And as long as this is a problem that pops up again and again, something is very wrong with their system i would say. If not creating a simpler interface / user system for regular users then at least give some huge warnings that unless you know what you are doing a key with the wrong JSON means access to all funds on the credit card.