3 ms·

Azure seems to be shaping up to be a security joke, there's been a concerning number of cross-account exploits in the last couple of years. AWS isn't perfect,

by 0xy 5y ago

Azure seems to be shaping up to be a security joke, there's been a concerning number of cross-account exploits in the last couple of years. AWS isn't perfect, but you really don't see many exploits on this scale. What is Microsoft doing wrong here?

alexjurkiewicz 5y ago
There's a certain level of tech schaudenfreude when it comes to Microsoft failing. It's hard to say that Azure has more issues than AWS based on gut feel of recent white hat blog post volume.
- spacemanmatt 5y ago
  It's sub-ironic, though. Microsoft has been delivering tech fails for decades.
  - philliphaydon 5y ago
    By that logic so has everyone?
sylens 5y ago
Azure has definitely had a bunch (too many, IMO), but AWS had a similar disclosure around CloudFormation and Glue back in January. https://www.lastweekinaws.com/blog/orca-security-aws-and-the-killer-whale-of-a-problem/ https://www.lastweekinaws.com/blog/orca-security-aws-and-the... That blog post also highlights that AWS may have a tendency to sweep security issues under the rug if there is no customer impact.
philliphaydon 5y ago
I think AWSs very granular permissions using IAM helps. Even tho most people I talk to hate it. I quite like it. Start out with a role with no permissions and open only what’s required for your stuff to work.
- qxmat 5y ago
  I've found that AWS IAM is amazing compared to Azure AD. With AWS you can do per-workload account vending and grant account owners full "AdministratorAccess", because IAM resources are tied to the account. In Azure it's batshit crazy: almost all IAM resources - roles, groups, principals etc - are tied to the overarching AD tenant and not to the AWS Account equivilent, a subscription. In short this means that I, the owner of a subscription (broad powers), cannot add a new IAM role or associate it with a resource for user assignment. It gets worse... Azure AD limits are tenant wide leading to big orgs refusing to add IAM primatives because they might hit a service limit. And the lack of ABAC makes KeyVault almost unusable compared to AWS Secrets Manager. But hey, at least I have system assigned managed identities for SQL logins, that was kinda cool until AWS introduced IAM auth for RDS.

by 0xy 5y ago

alexjurkiewicz 5y ago

There's a certain level of tech schaudenfreude when it comes to Microsoft failing. It's hard to say that Azure has more issues than AWS based on gut feel of recent white hat blog post volume.

spacemanmatt 5y ago
It's sub-ironic, though. Microsoft has been delivering tech fails for decades.
- philliphaydon 5y ago
  By that logic so has everyone?

sylens 5y ago

Azure has definitely had a bunch (too many, IMO), but AWS had a similar disclosure around CloudFormation and Glue back in January. https://www.lastweekinaws.com/blog/orca-security-aws-and-the-killer-whale-of-a-problem/ https://www.lastweekinaws.com/blog/orca-security-aws-and-the... That blog post also highlights that AWS may have a tendency to sweep security issues under the rug if there is no customer impact.

philliphaydon 5y ago

I think AWSs very granular permissions using IAM helps. Even tho most people I talk to hate it. I quite like it. Start out with a role with no permissions and open only what’s required for your stuff to work.

qxmat 5y ago
I've found that AWS IAM is amazing compared to Azure AD. With AWS you can do per-workload account vending and grant account owners full "AdministratorAccess", because IAM resources are tied to the account. In Azure it's batshit crazy: almost all IAM resources - roles, groups, principals etc - are tied to the overarching AD tenant and not to the AWS Account equivilent, a subscription. In short this means that I, the owner of a subscription (broad powers), cannot add a new IAM role or associate it with a resource for user assignment. It gets worse... Azure AD limits are tenant wide leading to big orgs refusing to add IAM primatives because they might hit a service limit. And the lack of ABAC makes KeyVault almost unusable compared to AWS Secrets Manager. But hey, at least I have system assigned managed identities for SQL logins, that was kinda cool until AWS introduced IAM auth for RDS.