3 ms·

But how can we trust the DIY stuff meet compliance and hold the right security bar? It’s much easier to do with AWS. Or maybe as a startup, to-C website you do

• mattmcknight 5y ago
  I think the complexity can lead to its own set of security risks, as people just keep opening permissions wider until things connect.
  • unclebucknasty 5y ago
    That's actually a really good point. Out of the box, it's hard to screw up because things are pretty locked down. It's really in attempting to open things up that the security risk comes in if people aren't explicitly aware of exactly what they're opening. EDIT: and this isn't necessarily difficult to grok. A lot of what you'll use from the network side is security groups, and they are straightforward. /EDIT There are also actually some bad patterns in the AWS Console UI that don't help here. For instance, despite all the warnings they place on S3 buckets about making things public, they still allow you to appear to change subobjects to private. In a traditional hierarchical directory structure, the more granular subobject settings would override, but not so with S3. If you didn't know that, then you've just shot yourself in the foot.
  • whoevercares 5y ago
    Great and interesting point. I believe the solution is to have “security by default” Infra-as-code construct and some static analyzer