4 ms·

> In order to fully migrate from EC2-Classic to VPC... Whenever I read anything about networking on AWS, I feel glad by having switched to GCP. On Google Cloud

> In order to fully migrate from EC2-Classic to VPC... Whenever I read anything about networking on AWS, I feel glad by having switched to GCP. On Google Cloud, you can put a project into production without having to fumble with networking at all (off course, the options are there if you need it). I feel more productive by only having to split my cloud resources by projects - which is a high-level concept, and a good abstraction - instead of security groups - which is a low-level implementation detail.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
kccqzy 5y ago
Indeed. In a couple places we ended up replicating the GCP project feature in AWS by creating multiple different AWS accounts (not IAM accounts, root accounts). It provided isolation between completely different apps. It was quite heavyweight but the isolation benefit was judged worthwhile.
vishnugupta 5y ago
I completely agree. At this point AWS desperately needs higher level abstractions with sane/safe defaults. They seem to be heading in that direction, example Amplify, but they still have a long way to go. I suspect AWS has now gotten so huge that there is no one PM to take a holistic look and build something to ease the pain of developers. I think a few startups are trying to fill this void.
njonesuk 5y ago
In AWS, accounts within an AWS Organization are roughly analogous to projects within GCP. Most organisations running AWS in production will have tens or hundreds of accounts managed within their Organization. Segregating by security groups hasn't been the recommended approach for years, for this reason amongst others. The accounts and Organization model is a slightly clunkier abstraction than projects, but on the other hand the security boundaries between accounts are harder than those between projects, which has its benefits.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

kccqzy 5y ago

Indeed. In a couple places we ended up replicating the GCP project feature in AWS by creating multiple different AWS accounts (not IAM accounts, root accounts). It provided isolation between completely different apps. It was quite heavyweight but the isolation benefit was judged worthwhile.

vishnugupta 5y ago

I completely agree. At this point AWS desperately needs higher level abstractions with sane/safe defaults. They seem to be heading in that direction, example Amplify, but they still have a long way to go. I suspect AWS has now gotten so huge that there is no one PM to take a holistic look and build something to ease the pain of developers. I think a few startups are trying to fill this void.

njonesuk 5y ago

In AWS, accounts within an AWS Organization are roughly analogous to projects within GCP. Most organisations running AWS in production will have tens or hundreds of accounts managed within their Organization. Segregating by security groups hasn't been the recommended approach for years, for this reason amongst others. The accounts and Organization model is a slightly clunkier abstraction than projects, but on the other hand the security boundaries between accounts are harder than those between projects, which has its benefits.