3 ms·
I know there are complexities involved, but auth is one of those things that needs to be very insulated from single region issues. How long was Okta not workin
by tyingq 5y ago
I know there are complexities involved, but auth is one of those things that needs to be very insulated from single region issues. How long was Okta not working for customers?
- kache_ 5y agoIf you only knew how bad modern software infrastructure really was
- tyingq 5y agoYeah, for a similar vendor, it's interesting to read this page and look at the diagram: https://auth0.com/availability-trust https://auth0.com/availability-trust And then read this tweet: https://twitter.com/auth0/status/1471159935597793290 https://twitter.com/auth0/status/1471159935597793290 Edit: Ah, seems they picked us-west-1 and us-west-2 as the two regions..."In this case, we use two AWS regions: us-west-2 (our primary) and us-west-1 (our failover)."[1] So bit by a double-region failure. [1] https://auth0.com/blog/auth0-architecture-running-in-multiple-cloud-providers-and-regions/ https://auth0.com/blog/auth0-architecture-running-in-multipl...
- crescentfresh 5y agoNow that Okta bought Auth0 what's the developer experience like I wonder? I imagine the infrastructure of the two products are still completely isolated. But is it still a separate product you can use for identity management or are new customers forced to use Okta?
- User23 5y agoIt's still running on a Perl script I wrote over a decade ago.
- tw04 5y agoSomeone should tell Amazon... IAM is single homed to us-east-1 AFAIK.
- dastbe 5y ago(I used to work at aws) The control API (i.e. adding/removing roles, modifying policies, etc.) is available out of us-east-1. However, the bits of IAM that relate to distributing credentials to instances/tasks/lambdas and STS are all regionalized and isolated.
- dboreham 5y agoSo...parent is correct.
- dastbe 5y agono, because most applications don't have an online dependency for creating roles and modifying policies. what they do typically have an online dependency for is provisioning credentials from those roles, which is architected to be regionally independent.
- t0mas88 5y agoNot really. The parts that can take your app down are distributed.
- sharpy 5y agoDisclaimer: Former AWS engineer, never worked on IAM directly. AWS is divided into multiple partitions. For the vast majority of users, there is one partition - the regular commercial - other partitions being China, GovCloud, etc. Within each partition, there is a primary region that needs to be available for creation/mutation of credentials and policies. However, that data is replicated to other regions within the partition. That means the use of credentials that exist does NOT depend on the primary region being available. The replication is something that is closed monitored, and SLA breaches will result in pages.
- drooby 5y agoLooks like about 45 mins
- activitypea 5y agoSeconded
- deleted 5y ago[deleted]
- abruzzi 5y agoCisco Duo SSO/MFA was also out this morning during the AWS outage. I guess usable redundancy for these services is a difficult problem.