3 ms·

Just FYI - its really simple to get your limits increased, regardless of the service - just speak to your rep. I have never not had a resource limit increase r

Just FYI - its really simple to get your limits increased, regardless of the service - just speak to your rep. I have never not had a resource limit increase request denied. You can do this as granular as you like...

kstrauser 5y ago
Oh, sure! See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... for more details about the quotas and what you can have them increased to. Still, that doesn't fix the problem - it just defers it. For example, you can ask that the maximum number of managed policies on a user gets bumped from 10 to 20. That sounds like a lot, but if you want to use AWS-managed policies like to set up least-access privileges, you'll be using lots of them like "CloudWatchReadOnlyAccess" and "AmazonEC2ReadOnlyAccess". If you use more than 20 services, the problem's still going to bite you.
- samstave 5y ago
  So.... I have run into this. You can require custom limit policies -- the caveat is that you as a company need to sign something that states that you take full responsibility for the allotment of the service based on you effectively controlling the quota. This is done only through your rep, and with them talking to some internal teams.... Have a good relationship with your rep, and I have never gotten a "no" from Amazon.... Again, this is done through actually talking to them. For example, I was spinning up thousands of instances for some things... and had to take full control of my limits with the agreement that I would pay for that which I spun regardless.... ALTHOUGH, once we had a dev accidentally check in secrets to github, on the 201st repo, which as our paid plan was 200 repos, it automatically mad #201 public - and within an hour we had hundreds of instances lit up in literally every AZ on the globe to mine for some german op.... It took us several hours to kill and close all that... but in the end, AWS just let go of the six-figure bill that would have ensued.... Your project is dope... I just want people to know that limits are soft-set. The only limits that are hard set are the actual number of nodes available for anything in a given AZ/Region -- but their capacity is way beyond what it was a few years ago, so I don't see that as an issue any more. However, again, your tool is dope. --- EDIT: Also, I admit, I have not faced your issue, so aside from mine just being general advice, I do not mean to detract from your post or your release of effort. :-) (also, some of their best reps had moved to GCP a while ago - so I don't know who the current crop of 'best reps' is, else I would connect you.
  - kstrauser 5y ago
    Those are all good points, but it seems at least some of those limits are actually hard. You can have them increased but not removed. And it this case, that probably makes sense: if you could attach 10,000 policies to a user, it could be a pain in the neck for AWS to evaluate them at each action request.
- samstave 5y ago
  AH-- I didnt realize you were requesting/needing a policy object size increase... just qty of an object/thing... My bad.

kstrauser 5y ago

Oh, sure! See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... for more details about the quotas and what you can have them increased to. Still, that doesn't fix the problem - it just defers it. For example, you can ask that the maximum number of managed policies on a user gets bumped from 10 to 20. That sounds like a lot, but if you want to use AWS-managed policies like to set up least-access privileges, you'll be using lots of them like "CloudWatchReadOnlyAccess" and "AmazonEC2ReadOnlyAccess". If you use more than 20 services, the problem's still going to bite you.

samstave 5y ago
So.... I have run into this. You can require custom limit policies -- the caveat is that you as a company need to sign something that states that you take full responsibility for the allotment of the service based on you effectively controlling the quota. This is done only through your rep, and with them talking to some internal teams.... Have a good relationship with your rep, and I have never gotten a "no" from Amazon.... Again, this is done through actually talking to them. For example, I was spinning up thousands of instances for some things... and had to take full control of my limits with the agreement that I would pay for that which I spun regardless.... ALTHOUGH, once we had a dev accidentally check in secrets to github, on the 201st repo, which as our paid plan was 200 repos, it automatically mad #201 public - and within an hour we had hundreds of instances lit up in literally every AZ on the globe to mine for some german op.... It took us several hours to kill and close all that... but in the end, AWS just let go of the six-figure bill that would have ensued.... Your project is dope... I just want people to know that limits are soft-set. The only limits that are hard set are the actual number of nodes available for anything in a given AZ/Region -- but their capacity is way beyond what it was a few years ago, so I don't see that as an issue any more. However, again, your tool is dope. --- EDIT: Also, I admit, I have not faced your issue, so aside from mine just being general advice, I do not mean to detract from your post or your release of effort. :-) (also, some of their best reps had moved to GCP a while ago - so I don't know who the current crop of 'best reps' is, else I would connect you.
- kstrauser 5y ago
  Those are all good points, but it seems at least some of those limits are actually hard. You can have them increased but not removed. And it this case, that probably makes sense: if you could attach 10,000 policies to a user, it could be a pain in the neck for AWS to evaluate them at each action request.
samstave 5y ago
AH-- I didnt realize you were requesting/needing a policy object size increase... just qty of an object/thing... My bad.