4 ms·

Rant: I'm glad the author called out GCP as well, but the idea that it's the user's fault for granting too many permissions is absurd. Has the author tried doin

Rant: I'm glad the author called out GCP as well, but the idea that it's the user's fault for granting too many permissions is absurd. Has the author tried doing this at scale? Try a super simple example: I want a user to have access to query a schema in BigQuery. Can you guess the magic combo of permissions that is going to take? Because the documentation is not going to correctly tell you. Thus after spending way too much time trying to get it done one ends up widely over-permissioning to just get the damn thing to work. You could argue their model is sound and it's just that how they aggregated permissions into roles is absurd or even just argue that they need better defined roles and I would accept that, but still it's quite frustrating as is. I mean just look at the length of the reference: https://cloud.google.com/iam/docs/understanding-roles https://cloud.google.com/iam/docs/understanding-roles

systemvoltage 4y ago
Yea I am not a fan of the Cloud and many of its complexities but if I have to be honest, when you have 5k employees working on AWS resources: yes, this complexity is actually requested by customers. It was built to meet their granular needs. Same thing with policies. To the author of the article: AWS is too complex? Then it is not for you. That said, various cloud providers have different levels of complexity and it is definitely up for debate and criticism.
- SkyPuncher 4y ago
  The problem is all of these providers should have simple roll ups.
  - insanitybit 4y ago
    Roll ups have their own problems. In particular, you really don't want them changing over time. I have banned all of the "managed policies" at my company because AWS is free to add new permissions and you have no way of knowing.
    - SkyPuncher 4y ago
      Well that can be solved with versioning. Rollups can simply be a suggested collection of permissions. When they change, view a diff, and accept what you need.
- makeitdouble 4y ago
  > AWS is too complex? Then it is not for you. But then neither are GCP and Azure. I only know three other decently reliable cloud providers from there, but you also won’t get as much community support nor legal adjustment like GCP does for EU hosting. You might be right, but that only further explains why it’s such a pain at this point.
  - deleted 4y ago
    [deleted]
  - systemvoltage 4y ago
    One of the core value propositions of Linode/DigitalOcean is exactly this – reduce complexity but that also comes with reduced flexibilty and features. The fact that Linode/DigitalOcean exists and relies on this core tenant is a testament to quite the reverse: AWS/GCP/Azure are complex to meet the needs of their customers or they wouldn't allow Linode/DigitalOcean to exist and consequently absorb their customers. They both co-exist on the axis of complexity. In some ways, it is a loose proof/evidence that AWS/GCP/Azure is complex to serve their customers, not because of incompetence or some other reason.
  - lukewiwa 4y ago
    AWS has its lightsail range of products which offers exactly this. A much more simplified and opinionated set of products and much fewer knobs to turn.
- saurik 4y ago
  This resonates in an interesting way; like, I remember thinking S3 and then EC2 were pretty inspired simple concepts, and then they just kept getting more and more complicated over the years. I feel like if I were to start using them today as the sole engineer I am I'd be really daunted by the extreme complexity they've seemingly added. In particular, VPC to me looks like an over-engineered mess designed to replicate the historical baggage of network hardware and addressing when all they really needed to do was add nested security groups (as well as allow multiple security groups, which they did finally do at some point) and call it a day, but if you are some ridiculously large company that has a million legacy network engineers and want to build some super complicated stack of domains I guess you like doing it with virtual hardware? But it sucks because cloud (very much "to me") was the thing that allowed small teams--or even one sole bad-ass engineer--to rapidly build scalable infrastructure, NOT something that would be used by giant companies to build empires :(.
twelve40 4y ago
if I understand correctly, the author is an infosec auditor who reviews security of those aws/gcp setups for their job? Then their job is the opposite of an engineer: the engineer is desperately trying to get shit done without managing IAM madness fulltime (hence admin admin everything), an auditor cannot give two craps about usability on the other hand, and will try to impose an idealistic model of perfectly tuned, strictly as-needed-basis permissions with no regard to how much time it would take to work them out in practice, and to maintain, because that's not their job.

systemvoltage 4y ago

Yea I am not a fan of the Cloud and many of its complexities but if I have to be honest, when you have 5k employees working on AWS resources: yes, this complexity is actually requested by customers. It was built to meet their granular needs. Same thing with policies. To the author of the article: AWS is too complex? Then it is not for you. That said, various cloud providers have different levels of complexity and it is definitely up for debate and criticism.

SkyPuncher 4y ago
The problem is all of these providers should have simple roll ups.
- insanitybit 4y ago
  Roll ups have their own problems. In particular, you really don't want them changing over time. I have banned all of the "managed policies" at my company because AWS is free to add new permissions and you have no way of knowing.
  - SkyPuncher 4y ago
    Well that can be solved with versioning. Rollups can simply be a suggested collection of permissions. When they change, view a diff, and accept what you need.
makeitdouble 4y ago
> AWS is too complex? Then it is not for you. But then neither are GCP and Azure. I only know three other decently reliable cloud providers from there, but you also won’t get as much community support nor legal adjustment like GCP does for EU hosting. You might be right, but that only further explains why it’s such a pain at this point.
- deleted 4y ago
  [deleted]
- systemvoltage 4y ago
  One of the core value propositions of Linode/DigitalOcean is exactly this – reduce complexity but that also comes with reduced flexibilty and features. The fact that Linode/DigitalOcean exists and relies on this core tenant is a testament to quite the reverse: AWS/GCP/Azure are complex to meet the needs of their customers or they wouldn't allow Linode/DigitalOcean to exist and consequently absorb their customers. They both co-exist on the axis of complexity. In some ways, it is a loose proof/evidence that AWS/GCP/Azure is complex to serve their customers, not because of incompetence or some other reason.
- lukewiwa 4y ago
  AWS has its lightsail range of products which offers exactly this. A much more simplified and opinionated set of products and much fewer knobs to turn.
saurik 4y ago
This resonates in an interesting way; like, I remember thinking S3 and then EC2 were pretty inspired simple concepts, and then they just kept getting more and more complicated over the years. I feel like if I were to start using them today as the sole engineer I am I'd be really daunted by the extreme complexity they've seemingly added. In particular, VPC to me looks like an over-engineered mess designed to replicate the historical baggage of network hardware and addressing when all they really needed to do was add nested security groups (as well as allow multiple security groups, which they did finally do at some point) and call it a day, but if you are some ridiculously large company that has a million legacy network engineers and want to build some super complicated stack of domains I guess you like doing it with virtual hardware? But it sucks because cloud (very much "to me") was the thing that allowed small teams--or even one sole bad-ass engineer--to rapidly build scalable infrastructure, NOT something that would be used by giant companies to build empires :(.

twelve40 4y ago

if I understand correctly, the author is an infosec auditor who reviews security of those aws/gcp setups for their job? Then their job is the opposite of an engineer: the engineer is desperately trying to get shit done without managing IAM madness fulltime (hence admin admin everything), an auditor cannot give two craps about usability on the other hand, and will try to impose an idealistic model of perfectly tuned, strictly as-needed-basis permissions with no regard to how much time it would take to work them out in practice, and to maintain, because that's not their job.