4 ms·
S3 configuration is awful, full stop. It’s not just that the interface is a disaster and configuration options are full of jargon and access rules are written i
by iambateman 2y ago
S3 configuration is awful, full stop. It’s not just that the interface is a disaster and configuration options are full of jargon and access rules are written in JSON.
The problem is that for someone who only periodically uses S3, I’m lost. I’m not lost in other services…Cloudflare, Firebase, Mailgun, and dozens of others somehow manage to allow people to use their service without so much agony.
I’m almost positive my S3 bucket is misconfigured because of how absurdly complex it is.
If you disagree and have spent more than 200 hours working within S3 I submit that it’s because you’re just an expert. I shouldn’t need a certification to upload files and retrieve them securely.
- deleted 2y ago[deleted]
- systemvoltage 2y agoNo offense, but spending 200 hours on S3 and if you still don’t understand it, it’s a skill issue.
- iambateman 2y agolol I haven’t spent 200 hours. I’m just aware of a lot of people who spend a lot of their life working in AWS and then get cranky when everyone isn’t as experty as them. :)
- echelon 2y agoI'm sorry, but this sounds like C++ apologism. Tech should be simple and fail immediately if used incorrectly. It's a tech issue if the dispersal of customer records is happening frequently enough to be a meme.
- acdha 2y agoS3 does fail safe. The default is to deny access, but the problem is that every so often someone “solves” a problem by granting access broadly rather than learning how the tool works or reading the prominent warnings. This isn’t like C++, it’s more an example of how people don’t consistently respect the ancillary tools they use enough to learn how they work. I’ve seen the same pattern in many other contexts and it always came down to “I need to get my real work done, I don’t have time for this sysadmin stuff!”
- rfoo 2y agoYou can try to be Rust and refuse such access rules. Yes, I know it sometimes makes sense. Rust rejects perfectly fine codes too. People are really into such things.
- acdha 2y agoRust has unsafe, too, because the implementers know that they need to work in a messy world. S3 has options for globally blocking public access, there are warnings and tools which continuously audit for things like cross-account access, etc. but they have a lot of customers who legitimately need things like that so there has to be a way to do it, just as Rust allows you to say “I know what I’m doing, call libc!”
- mannyv 2y agoS3 isn't a big deal. It could be you're thinking about it wrong.
- mannyv 2y agoMore specifically, each possible action on a bucket or file has a permission. You have the option of going granular or not, depending on what you want. S3 can be thought of as a service and an API. It might be easier for you as a dev to look at the api docs and the various options then map that to the UI. For all services there are possible actions and authorization checks for those actions. It's up to you to allow or disallow the actions you want on a per user basis. Complicated? Sure, it can be. Welcome to modern computing.