Ask HN: Is GCP harder to use than AWS?

my experience is the opposite. there's a lot of really insecure defaults in gcp, some of which are really hard to override - gcp makes it easier when the default service account that every is ridiculously overpermissioned, and for the longest time you couldnt change the service account in cloudfunctions or app engine, i forget which.

The reason you hear about s3 buckets and not gcs buckets is because usage of s3 is way higher and way older.

I would say yes, Azure AD is more complex, but in a good way.

AWS IAM is interesting in that IAM resources are provisioned within a subscription. You can use IAM as an identity solution, giving everyone a user account and password, but you don't have to. Internally at AWS, we never used IAM users, but instead had an enterprise AD deployment that we used to log in to our computers and internal systems. One of those internal systems kept a list of AWS subscriptions and IAM roles you had access to, and would trade your AD credentials for temporary AWS credentials scoped to a role. It was pretty slick, but it's not inherent to IAM, so you typically need a third party service to do this for you. (At the job I had in between AWS and Microsoft, we used CloudTamer, and before that, we just had to keep track of 20 different username/password pairs.)

AAD on the other hand is a full blown identity platform that incidentally can also be used to log in to Azure. That means it integrates nicely with on-prem AD deployments and, more importantly, lets users log in once and navigate the subscriptions to which their account has been granted access. So it's actually simpler to use if you just need to be able to log in to multiple subscriptions, but you can run into cases where you need to operate on AAD resources in ways that aren't supported through Azure APIs. This primarily comes up if you need to grant a non-Azure permission as part of an Azure deployment. E.g., if you want to give a managed identity permission to read AAD metadata like service principal IDs, you can't do it from within ARM.

It seems like IAM users are really only useful for very small companies or for off-platform access. Anything more than a handful of users and it's probably best offloading your auth to some other federated platform

AD is extremely built out and well established so I guess no surprise Azure leans on it heavily. AD/Kerberos authentication is pretty slick, too

As someone who works on an MLOps platform that allows you to use your own clusters, I have to check multiple cloud providers for testing.

GCP is wonderful compared to AWS. It took me a week to sign up for AWS, including writing an issue and a phone call. It took other colleagues some hacky ways to start to use it, even at the sign-up phase.

Doing something on GCP is pretty straightforward. Creating VMs, Kubernetes clusters, etc. I've had non technical people do it successfully on their own. Live. While observed and under pressure.

AWS? Good lord. That's what I will say about it as I'd rather say good things about a good service than bad things about another.