3 ms·

Azure Germany is a separate partition from the rest of Azure - presumably for compliance reasons. This is distinct from AWS, where Frankfurt is just another reg

Azure Germany is a separate partition from the rest of Azure - presumably for compliance reasons. This is distinct from AWS, where Frankfurt is just another region, albeit one with high demand.

Terretta 4y ago
> AWS .. Frankfurt is just another region Unlike GCP and Azure, all AWS regions are (were) partitioned by design. This "blast radius" is (was) fantastic for resilience, security, and data sovereignty. It is (was) incredibly easy to be compliant in AWS, not to mention the ruggedness benefits. AWS customers with more money than cloud engineers kept clamoring for cross-region capabilities ("Like GCP has!"), and in last couple years AWS has been adding some. Cloud customers should be careful what they wish for. If you count on it in the data center, and you don't see it in a well-architected cloud service provider, perhaps it's a legacy pattern best left on the datacenter floor. In this case, at some point hard partitioning could become tough to prove to audit and impossible to count on for resilience. UPDATE TO ADD: See my123's link below, first published 2022-11-16, super helpful even if familiar with their approach. PDF: https://docs.aws.amazon.com/pdfs/whitepapers/latest/aws-fault-isolation-boundaries/aws-fault-isolation-boundaries.pdf https://docs.aws.amazon.com/pdfs/whitepapers/latest/aws-faul...
- my123 4y ago
  Cross-region extensibility points are few and far between. See https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/abstract-and-introduction.html https://docs.aws.amazon.com/whitepapers/latest/aws-fault-iso... for more details.
- EE84M3i 4y ago
  AWS has several different levels of region isolation. There are aws region partitions - general, china, us gov cloud (public), us gov secret and us gov top-secret. Inside a partition, there can be some regions that are opt-in - see https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable https://docs.aws.amazon.com/general/latest/gr/rande-manage.h... My understanding is that opt-in regions are even more isolated inside a specific partition for partition-global services like IAM and maybe some other stuff.
- robertlagrant 4y ago
  > Unlike GCP and Azure, all AWS regions are (were) partitioned by design. This "blast radius" is (was) fantastic for resilience, security, and data sovereignty. It is (was) incredibly easy to be compliant in AWS, not to mention the ruggedness benefits. Could you elaborate on this a little? We use AWS, but are evaluating OCI for certain (very specific) cases, and I'll love to know what questions to ask for comparison purposes.
  - Terretta 4y ago
    You likely won't get anywhere asking Oracle questions, their sales is very good at (not) answering. Here is how partitioned/isolated OCI is by design: https://www.wiz.io/blog/attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access https://www.wiz.io/blog/attachme-oracle-cloud-vulnerability-... While that's fixed, it speaks volumes to the architecture. Very little has changed since 2018: https://www.brightworkresearch.com/how-to-understand-the-problems-with-oracle-cloud/ https://www.brightworkresearch.com/how-to-understand-the-pro... As noted there, I'd argue OCI is more akin to Softlayer/Bluemix than to GCP, Azure, or AWS, but depending on your certain very specific cases OCI may still be appropriate.
- senderista 4y ago
  There is a reason why GCP and Azure have had many more global outages than AWS. Fault isolation always entails some level of inconvenience.
tjungblut 4y ago
Yep, it's run by the Telekom entirely IIRC from my time back at MSFT. Microsoft "just deploys" Azure on it.
option 4y ago
this: compliance plus lack of energy for new datacenter capacity. source: colleague who works at msft. they have a true crisis there and it will get worse.

Azure Germany is a separate partition from the rest of Azure - presumably for compliance reasons. This is distinct from AWS, where Frankfurt is just another region, albeit one with high demand.

Terretta 4y ago

> AWS .. Frankfurt is just another region Unlike GCP and Azure, all AWS regions are (were) partitioned by design. This "blast radius" is (was) fantastic for resilience, security, and data sovereignty. It is (was) incredibly easy to be compliant in AWS, not to mention the ruggedness benefits. AWS customers with more money than cloud engineers kept clamoring for cross-region capabilities ("Like GCP has!"), and in last couple years AWS has been adding some. Cloud customers should be careful what they wish for. If you count on it in the data center, and you don't see it in a well-architected cloud service provider, perhaps it's a legacy pattern best left on the datacenter floor. In this case, at some point hard partitioning could become tough to prove to audit and impossible to count on for resilience. UPDATE TO ADD: See my123's link below, first published 2022-11-16, super helpful even if familiar with their approach. PDF: https://docs.aws.amazon.com/pdfs/whitepapers/latest/aws-fault-isolation-boundaries/aws-fault-isolation-boundaries.pdf https://docs.aws.amazon.com/pdfs/whitepapers/latest/aws-faul...

my123 4y ago
Cross-region extensibility points are few and far between. See https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/abstract-and-introduction.html https://docs.aws.amazon.com/whitepapers/latest/aws-fault-iso... for more details.
EE84M3i 4y ago
AWS has several different levels of region isolation. There are aws region partitions - general, china, us gov cloud (public), us gov secret and us gov top-secret. Inside a partition, there can be some regions that are opt-in - see https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable https://docs.aws.amazon.com/general/latest/gr/rande-manage.h... My understanding is that opt-in regions are even more isolated inside a specific partition for partition-global services like IAM and maybe some other stuff.
robertlagrant 4y ago
> Unlike GCP and Azure, all AWS regions are (were) partitioned by design. This "blast radius" is (was) fantastic for resilience, security, and data sovereignty. It is (was) incredibly easy to be compliant in AWS, not to mention the ruggedness benefits. Could you elaborate on this a little? We use AWS, but are evaluating OCI for certain (very specific) cases, and I'll love to know what questions to ask for comparison purposes.
- Terretta 4y ago
  You likely won't get anywhere asking Oracle questions, their sales is very good at (not) answering. Here is how partitioned/isolated OCI is by design: https://www.wiz.io/blog/attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access https://www.wiz.io/blog/attachme-oracle-cloud-vulnerability-... While that's fixed, it speaks volumes to the architecture. Very little has changed since 2018: https://www.brightworkresearch.com/how-to-understand-the-problems-with-oracle-cloud/ https://www.brightworkresearch.com/how-to-understand-the-pro... As noted there, I'd argue OCI is more akin to Softlayer/Bluemix than to GCP, Azure, or AWS, but depending on your certain very specific cases OCI may still be appropriate.
senderista 4y ago
There is a reason why GCP and Azure have had many more global outages than AWS. Fault isolation always entails some level of inconvenience.

tjungblut 4y ago

Yep, it's run by the Telekom entirely IIRC from my time back at MSFT. Microsoft "just deploys" Azure on it.

option 4y ago

this: compliance plus lack of energy for new datacenter capacity. source: colleague who works at msft. they have a true crisis there and it will get worse.