4 ms·

Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). I'll probably get dow

by cj 3y ago

Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). I'll probably get downvoted, but isn't global addressing + firewalling basically available by creating a VPC with only public subnets, and using security groups as your firewall? (Best practice is public/private subnets with NAT gateways, but it's probably not impossible to rely only on security groups)

joeig 3y ago
Either Lightsail, or just the default VPC that all AWS accounts come with. If you think your use case needs private/public subnets, NAT, complex routing tables, etc. you can still add that to the default VPC later. A few years ago, when what we now call EC2 classic was a thing, there were no sophisticated networking options at all. I assume VPC and its services were introduced because customers asked for something that feels like traditional datacenter networking.
- steveBK123 3y ago
  This stuff is obviously so hard to use that even the experts don't know wtf they are doing. At a prev shop, they undersized the VPC had sporadic failures of burst compute like spot instances that got spun up by other AWS services (Batch) to work through job queues. Neither the cloud architect or CloudOps lead could resolve this for months, or even temporarily prevent the breaches, until a big VPC resize / reshuffle / migration over a weekend. Probably $1M/year TC between these two guys. Incredible stuff. Felt like on-prem kind of stuff that I was reliably told the cloud solved.
  - pid-1 3y ago
    You totally could undersize an on-prem private network, I don't get how that's an AWS specific issue.
    - steveBK123 3y ago
      Note “ Felt like on-prem kind of stuff that I was reliably told the cloud solved.” That is - why did cloud just give you the foot guns to produce the same bad outcome that took a similarly long time to resolve? Why wasn’t this a click button change with zero interrupt ?
pid-1 3y ago
> Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). Yes. Many services abstract networking. App Runner, for example, even gives you a public URL with HTTPs. Lambda also can do that nowadays. Most managed services just expose endpoints. > I'll probably get downvoted, but isn't global addressing + firewalling basically available by creating a VPC with only public subnets, and using security groups as your firewall? (Best practice is public/private subnets with NAT gateways, but it's probably not impossible to rely only on security groups) I will also disagree with what others are saying. You can keep things simple in AWS if your use case is simple and never care about 99% of what's on the AWS VPC dashboard. If your use case is complex (you need to connect several internal private apps, expose private things behind a single IP / FQDN, do load balancing, use private DNS, connect with other clouds and on-premises, segregate, monitor and authenticate traffic...) then using physical appliances would likely require more hard work and expertise. A fun exercise to folks complaining about AWS complexity: go to Fortinet's web site and try to find out which appliances you should use to secure a small company (~ 100 employees, couple of public internet facing services, couple of internal apps), how much it costs and how can you buy it.
- dilyevsky 3y ago
  Mellanox switch is like $10k a pop. You install Linux on it (sonic) and configure firewall/vip/etc and you’re done. You can pay consultants to do all that once then save on aws cost for next 3 years. 37signals did basically this with same number of staff you can read about it on their blog. It’s not rocket science
  - cjaybo 3y ago
    Well if it’s that simple and 37 signals did it, then obviously everyone should! It’s not like your description is ridiculously reductive, or like 37 signals/dhh have a history of attention seeking behavior that might drive them to make technical decisions on the basis of PR value. Never!
    - dilyevsky 3y ago
fulafel 3y ago
It may be possible (though there are practical impediments as well, such as the poor IPv6 support), but the expectations and culture in the AWS world are so ingrained that you'll be looked at funny and constantly have to defend the "unorthodox" choices.
- nostrebored 3y ago
  They are unorthodox and they’re wrong. If stuff does not need to call your service, put it in a private subnet. It’s not rocket science.

by cj 3y ago

joeig 3y ago

Either Lightsail, or just the default VPC that all AWS accounts come with. If you think your use case needs private/public subnets, NAT, complex routing tables, etc. you can still add that to the default VPC later. A few years ago, when what we now call EC2 classic was a thing, there were no sophisticated networking options at all. I assume VPC and its services were introduced because customers asked for something that feels like traditional datacenter networking.

steveBK123 3y ago
This stuff is obviously so hard to use that even the experts don't know wtf they are doing. At a prev shop, they undersized the VPC had sporadic failures of burst compute like spot instances that got spun up by other AWS services (Batch) to work through job queues. Neither the cloud architect or CloudOps lead could resolve this for months, or even temporarily prevent the breaches, until a big VPC resize / reshuffle / migration over a weekend. Probably $1M/year TC between these two guys. Incredible stuff. Felt like on-prem kind of stuff that I was reliably told the cloud solved.
- pid-1 3y ago
  You totally could undersize an on-prem private network, I don't get how that's an AWS specific issue.
  - steveBK123 3y ago
    Note “ Felt like on-prem kind of stuff that I was reliably told the cloud solved.” That is - why did cloud just give you the foot guns to produce the same bad outcome that took a similarly long time to resolve? Why wasn’t this a click button change with zero interrupt ?

pid-1 3y ago

> Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). Yes. Many services abstract networking. App Runner, for example, even gives you a public URL with HTTPs. Lambda also can do that nowadays. Most managed services just expose endpoints. > I'll probably get downvoted, but isn't global addressing + firewalling basically available by creating a VPC with only public subnets, and using security groups as your firewall? (Best practice is public/private subnets with NAT gateways, but it's probably not impossible to rely only on security groups) I will also disagree with what others are saying. You can keep things simple in AWS if your use case is simple and never care about 99% of what's on the AWS VPC dashboard. If your use case is complex (you need to connect several internal private apps, expose private things behind a single IP / FQDN, do load balancing, use private DNS, connect with other clouds and on-premises, segregate, monitor and authenticate traffic...) then using physical appliances would likely require more hard work and expertise. A fun exercise to folks complaining about AWS complexity: go to Fortinet's web site and try to find out which appliances you should use to secure a small company (~ 100 employees, couple of public internet facing services, couple of internal apps), how much it costs and how can you buy it.

dilyevsky 3y ago
Mellanox switch is like $10k a pop. You install Linux on it (sonic) and configure firewall/vip/etc and you’re done. You can pay consultants to do all that once then save on aws cost for next 3 years. 37signals did basically this with same number of staff you can read about it on their blog. It’s not rocket science
- cjaybo 3y ago
  Well if it’s that simple and 37 signals did it, then obviously everyone should! It’s not like your description is ridiculously reductive, or like 37 signals/dhh have a history of attention seeking behavior that might drive them to make technical decisions on the basis of PR value. Never!
  - dilyevsky 3y ago

fulafel 3y ago

It may be possible (though there are practical impediments as well, such as the poor IPv6 support), but the expectations and culture in the AWS world are so ingrained that you'll be looked at funny and constantly have to defend the "unorthodox" choices.

nostrebored 3y ago
They are unorthodox and they’re wrong. If stuff does not need to call your service, put it in a private subnet. It’s not rocket science.