3 ms·

I really dislike the Google Cloud way of doing things, for example Projects, Folders and Orgs. There's a dozen different weird paradigms that you have to consid

I really dislike the Google Cloud way of doing things, for example Projects, Folders and Orgs. There's a dozen different weird paradigms that you have to consider to securely and reliably manage a large number of different projects, accounts, tenants, business units, etc in Google Cloud; if you don't do things "The Google Cloud Way" you are screwed. AWS is much simpler and more straightforward. You don't have to think about anything to segregate infrastructure, networks, applications, users, data, etc. Just put it in a different account. If someone needs access, you need to explicitly add extra connections/grant that access. You can't just accidentally create one user that implicitly has access to hundreds of accounts. Honestly the entire security model of Google Cloud is frightening. It's like they wanted to make it easy to expose everything.

lbhdc 4y ago
You can still work like that. You just don't have to bother changing your project id, and switch accounts to jump to other projects. I do this for some things I work on where there are account level controls and the accounts cant be shared across projects.
deleted 4y ago
[deleted]
DangitBobby 4y ago
AWS is decidely _not_ simpler here. You've got Stockholm syndrome. What's complicated about making two projects and picking between them? What's complicated about grouping projects under a single organization? What's complicated about grouping projects under a folder? What's complicated about adding someone to a project through IAM? The only way you can fuck that last part up is by granting overly broad permissions (which they warn you when you've done right there in the console). You can safely ignore the existence of Organizations and folders completely if you are so inclined. At least there's a sensible way to set default policies for your organization baked into the platform. Even so, literally 3 hours, tops, and you know everything about these abstractions you could ever care about. I cannot emphasize enough how much easier GCP is to learn and use than AWS.
- 0xbadcafebee 4y ago
  I think it's the other way around :-) In Google Cloud, you have to learn all these concepts and use them as Google intends. Oh, you should create a new Project. But to do that you need an Organization. But to do that you need an Identity Source. But you'll need to choose from x or y and have a domain. But... (all this before creating a billing account, or enabling an API, or... ?!) In AWS, you just have an account. That's it. You can later add-on AWS Organizations if you need to manage a big organization. AWS is simple and composeable, and GCP is advanced and opinionated. Pick your poison.

lbhdc 4y ago

You can still work like that. You just don't have to bother changing your project id, and switch accounts to jump to other projects. I do this for some things I work on where there are account level controls and the accounts cant be shared across projects.

deleted 4y ago

[deleted]

DangitBobby 4y ago

AWS is decidely _not_ simpler here. You've got Stockholm syndrome. What's complicated about making two projects and picking between them? What's complicated about grouping projects under a single organization? What's complicated about grouping projects under a folder? What's complicated about adding someone to a project through IAM? The only way you can fuck that last part up is by granting overly broad permissions (which they warn you when you've done right there in the console). You can safely ignore the existence of Organizations and folders completely if you are so inclined. At least there's a sensible way to set default policies for your organization baked into the platform. Even so, literally 3 hours, tops, and you know everything about these abstractions you could ever care about. I cannot emphasize enough how much easier GCP is to learn and use than AWS.

0xbadcafebee 4y ago
I think it's the other way around :-) In Google Cloud, you have to learn all these concepts and use them as Google intends. Oh, you should create a new Project. But to do that you need an Organization. But to do that you need an Identity Source. But you'll need to choose from x or y and have a domain. But... (all this before creating a billing account, or enabling an API, or... ?!) In AWS, you just have an account. That's it. You can later add-on AWS Organizations if you need to manage a big organization. AWS is simple and composeable, and GCP is advanced and opinionated. Pick your poison.