5 ms·

"... they look at me as if I'm mad. The cloud can't lose data." We used to run an ad on reddit that read something like: Your infra is on Amazon AWS and your

• orf 3y ago
  This makes me irate, in a way that’s hard to express. They are not doing it wrong. What’s the threat model you’re saying people are not accounting for? eu-west-1 getting nuked? “AWS” also isn’t a monolithic entity: for all intents and purposes AWS Backup is a separate vendor from AWS RDS, just with a unified billing and management pane. I’d rather use that vendor, integrated with my AWS resources and managed with the same access controls, encryption, billing, etc that I use for everything else than ship it off to a random third party and maintain that connection. Because the risk factor of multiple, isolated and separate AWS teams running different products with different infra having simultaneous large data loss incidents boils down to “nukes”. So maybe people get irate in the same way as they might do with people who say stuff like “the cloud is a scam, why use it when you can host things on servers in a closet?”
  • jacquesm 3y ago
    Interesting comment. So, what would you do if you were called by someone whose cloud account got hacked and wiped? Or whose cloud account got closed because of 'unspecified suspicious activity on your account'? Of course that never happens, right?
    • crazygringo 3y ago
      I feel like we haven't yet come up with the right models and vocabulary to express these kinds of risks, or maybe I just haven't heard it. Especially because your credentials to AWS are likely stored somewhere that would also store your credentials to your separate backup vendor -- so why would two cloud vendors provide any more protection than two products within one cloud vendor? It's clear to me how to model hardware failure, or accidental data loss. It's not clear how to model "hackers gain access to one set of credentials but not another" or "provider closes your account and won't give you your data".
    • nielsole 3y ago
      You can set up your S3 objects to have a mandatory retention period further reducing the risk of a wiped account. https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-retention-date.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-... Also while I have heard many horror stories about suspicious account closures for many vendors, AWS at least currently seems to be on top of their game. I fully agree with your argument, just adding colour to it
  • nprateem 3y ago
    I'll give you an example. An issue with a single data centre can cause multiple AWS APIs in the region to fail across services (I've seen this several times). At that point, if you're only in a single region, you're stuffed. Networking may be affected and you want to spin up in another region, but RDS APIs fail so you can't copy over your backups, for some reasons AMIs won't copy between regions and the R53 control plane APIs fail too, so even if you could bring up a replacement you can't update DNS anyway... These can be planned for and mitigations put in place in advance, but that involves similar reasoning as might lead you to decide multi-cloud to be a safer option.
  • justinclift 3y ago
    If you somehow manage to piss off an Amazon employee (a delivery driver for example), they can screw your entire account. ;)