4 ms·
Other commenters have mentioned you should figure out why they want to do this, which is important. There could be actual, real legal requirements. There could
by andrewf 13y ago
Other commenters have mentioned you should figure out why they want to do this, which is important. There could be actual, real legal requirements. There could be internal policies which are, or aren't, flexible. It could just be an IT department protecting its fiefdom.
There are in-between options.
* Tell them that the software is designed to run on your own infrastructure, and while it could be delivered in a form they could run themselves, it would take a lot of extra time or money.
* Offer to run it yourself, but as an entirely separate instance just for them, without the intermingling of other customer data. You'd basically have a parallel setup inside a different AWS account.
* One big reason they might want to run it themselves, is that if your business goes down, they don't experience immediate disruption. It's not uncommon for a code escrow agreement to exist, which means that if your business becomes insolvent, the client gets a copy of your code, and the right to maintain it themselves. Combine this with a separate AWS account running their instance, and give them administrative and billing access to that AWS instance, and you may address their continuity concerns.
* Tell them that you don't support the software on Windows, or Oracle, and that while they can run it on their own setup, they'll have to do it on top of Linux. (If the IT department just tries to routinely absorb everything, this may give them pause)
* Deliver the software as a virtual applicance. (Require a particular hypervisor - for instance, Github is delivered as a VM that only runs on top of VirtualBox or VMWare. The former isn't recommended for production use for performance reasons)
- jlhonora 13y agoThanks for the suggestions. Our app uses sensitive data (Customer's name, address, etc., 30k new entries/month) and they don't want that to be leaked. Their biggest concern is accessing the webpage and having that data being served through HTTP (We bought an SSL certificate and all our data goes through HTTPS, but still).
- andrewf 13y agoIt looks like a mobile app is part of your solution. How are drivers' phones going to access your servers? I'm really speculating here, but do they want to run the service in a private IP space (inaccessible from the Internet) and have their driver's phones VPN in? If so, maybe you could run a standalone instance of the app in AWS without public IPs, and bridge that to their corporate network using http://aws.amazon.com/vpc/ http://aws.amazon.com/vpc/
- jlhonora 13y agoBingo! Yesterday we came up with a very similar solution. We'll be proposing it as an alternative today, we'll see how it goes. What we'll do is VPN the DB connection to their private servers, and manage the Redis/Mongo (non-sensitive) in the standard AWS stack. We already do it that way now, but using an internal DB server in AWS. Fortunately, they haven't made any comments on the mobile app connection/data storage yet :) . That's a bigger problem I guess, since we need the phone's internal DB to store some data (it needs to work offline). I mean, they are secure enough, but given our client's previous records I don't think they'll share our opinion.