6 ms·
New AWS Directory Service
- mijndert 12y agoThis is really great news for AWS environments where compliance and user account management are an issue.
- uxp 12y agoThis is precisely the struggle that I've been having to deal with lately. Though, does anyone know if this works with OpenDirectory?
- nailer 12y agoIt's nice to see bridges being made to corporate. AWS allowing AD auth or Chrome supporting security policies. We might dislike a lot of these technologies but if ever we're to replace them it won't be by a rip and replace, but rather a slow migration.
- craigmccaskill 12y agoAmazon is systematically adding service upon service to their offering. I'll be interested to see where this ends up once they're all tightly integrated and working together.
- im_dario 12y agoSkynet, obviously.
- awjr 12y agoWell, when we looked at moving stuff to the 'cloud', Amazon offers so so much. In effect Amazon can provide a vendor lock-in through the range of services (and their quality) it provides. That is in no way a bad thing, but just shows how other 'cloud' providers need to keep playing catch-up. It's also an architecture consideration for the way we develop. Yes you want to use this Amazon feature, but if you do, moving to another provider becomes harder (e.g. we're looking to use SQS, but know if we moved provider I'd need to implement my own solution for that, probably mq rabbit). To rehash a classic phrase: "Nobody ever got fired for buying Amazon."
- spacefight 12y agoSince when is vendor lock-in a "in no way a bad thing"?
- simonpantzare 12y ago"Lock-in through the range of services" is key. You can go all-in on AWS and use RDS, Directory Service, EMR and still be able to move off AWS and use the open source systems beneath. Granted, there are services like S3 that are proprietary but on the other hand you can move to something Riak CS that provides API compatibility with S3.
- rhizome 12y agoSince a big AWS selling point is headcount savings from outsourcing systems expertise, you would ideally be hiring an infrastructure engineer to implement the RabbitMQ, or at least to smooth the way.
- nnx 12y agoSQS works fine when used from other hosting providers (or even from client-side JavaScript for that matter - with the right IAM token).
- ochoseis 12y agoAnyone think a remote directory service would work well if a lot of your infrastructure is hosted elsewhere? I wonder if latency would become an issue. Also, how hard is it to set up/care/feed a basic directory service? I've toyed with FreeIPA which was easy (http://www.freeipa.org/page/Main_Page http://www.freeipa.org/page/Main_Page, based on 389 DS). I actually did not realize Samba now includes a directory service and might check that out.
- jon-wood 12y agoI can't say for certain, but I'd think a lot of this is actually built on top of OpenLDAP, with Samba just providing the compatibility layer for Windows clients.
- mcnully 12y agohere is what it looks like: amazon.com
- ldng 12y agoWell, a lot of concept we expect from a computer OS apply to distributed system. AWS, in a few years, might end up to look like less a IaaS and more as a PaaS platform, a Linux distrib for cluster if you wish. That is you could treat AWS/any cloud as a distributed OS for clusters with VM/containers as processes/threads and services as packages. It's more or less already roughly the case. Well, IMHO, it's the maturation path for the cloud I can imagine.
- justicezyx 12y agoWhen I left Amazon, I thought Google has no trouble to easily beat Amazon with its strong tech stack. Gradually I learnt that companies are different. If one company does one thing good, that usually means another company cannot easily catch up, even with obvious advantages. Now I seriously doubt how long will it takes for Google to be a meaningful competitor to AWS...
- jpeg_hero 12y agoNice. Basically RDS but for Samba. Box = cloud msft file sharing? Now amazon going after the directory?
- gortok 12y agoThis article does not mention handling directory services between short lived EC2 instances and SQL Server. Right now the guidance is to use SQL Server Auth; but Windows Auth would be far better to use, especially in these circumstances.
- riffraff 12y agodoes this mean I can create LDAP-backed ssh login for my EC2 boxes without the hassle of actually running OpenLDAP?
- btucker 12y agoThat was what I wanted to know, too. Ever since IAM launched, I've been wanting to authenticate ssh against it. Sadly, the docs all seem to specifically say EC2 instances running windows.
- jcberleur 12y agothere is no mention of integrating with IAM but they do mention optional RADIUS support, which means you probably have to configure ssh yourself
- bdunbar 12y agoI'm not able to spin up an instance to test with this week .. but if my linux hosts -inside- my network can auth to my corporate AD (and they can!) I don't know why an AWS EC2 instance would be different. Add the software, configure, and presto?
- topherTopher 12y agoIt looks to me like it's Samba-based. I'm poking around with it to see if we can get linux machines to use it for ssh auth.
- topherTopher 12y agoHere's a walk-through on how to get linux auth with the new AWS directory service. https://jumpcloud.com/blog/authenticating-linux/ https://jumpcloud.com/blog/authenticating-linux/
- dstaheli 12y agoPlaying catch-up with Microsoft Azure's existing services. Nice to see the competition. http://azure.microsoft.com/en-us/services/active-directory/ http://azure.microsoft.com/en-us/services/active-directory/
- zackangelo 12y agoI didn't see any reference to it in the documentation, but I wonder if they'll provide an HTTP API for authenticating against these directories (or providing delegated auth services when connected to an on-premise AD instance).
- PaulHoule 12y agoI'm amazed they haven't done this already.
- thspimpolds 12y agoThe question I have is can I use this as a central auth system the other way. AD is expensive as crap, but if this is self-healing and self-backup, then its a good idea for us. Frankly anything is better than Open directory
- topherTopher 12y agoTo me it looks like the directory is ONLY exposed within the VPC. So that would mean you can't auth from servers that live in other clouds or on prem.
- cthalupa 12y agoHow about via VPN into the VPC?
- toomuchtodo 12y agoWhat would be the rational for choosing this over say, Google Apps authentication?
- jcjames 12y agoPrimarily to manage Windows accounts on Windows EC2 instances. Google Apps authentication covers websites via OAuth and OpenID, but not local user accounts on systems like Windows, Linux, and OS X.
- deleted 12y ago[deleted]
- topherTopher 12y agoIt's looking to me like you add users either through their "Simple AD" exporter, or you have to use "Active Directory Administration Tools"... there's no way to add my users etc. directly into their directory? http://docs.aws.amazon.com/directoryservice/latest/adminguide/directory_management.html http://docs.aws.amazon.com/directoryservice/latest/adminguid...
- swehner 12y agoSomewhere there is no progress. Stagnation.
- bdunbar 12y agoExplain?