3 ms·

AWS account ID == Your IP address. It may be sensitive, but someone needs to know it to get s*$t done. Illustrative example: I had to deal with a third party t

AWS account ID == Your IP address. It may be sensitive, but someone needs to know it to get s*$t done. Illustrative example: I had to deal with a third party that we needed to integrate with because of anti-money laundering procedures a year or two ago. I wanted my team to setup a privatelink with the organization because that's generally more secure than an open sftp port. The company refused citing security reasons to hide their Account Id (it's needed for the role ARN used for reciprocal permissions to PV endpoints). So what did we do? We ended up whitelisting a range of public IPs they use for inbound port 22... Moral of the story: you may think you are a genius for obfuscating your IDs, but you can't really run a business unless people have an address back to you

stingraycharles 3y ago
AWS PrivateLink has another property that generally makes it undesirable for these types of integrations: communication is bidirectional, and IP subnets should not overlap. We (as a vendor ourselves) typically integrate as a VPC Endpoint Service, where communication is unidirectional and our service is exposed as a load balancer’s endpoint within the customer’s VPC.
- EE84M3i 3y ago
  I thought PrivateLink was branding for vpc interface endpoints? There's no ip subject restriction for that because it's basically a proxy. Are you thinking of vpc peering? VPC endpoints seem preferable in this situation.
  - stingraycharles 3y ago
    Oh I apologize, you’re completely correct and I am confusing PrivateLink with VPC peering. Thank you for correcting me.
executesorder66 3y ago
> get s*$t done What were you hoping to achieve with this utterly pointless self-censorship?