Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS mistakes to avoid

cloudonaut.io

Post reply on HN
Print view View original

71–80 of 276 posts

Re: AWS mistakes to avoid

#71

Post by brianwawok »

nodesocket wrote: post #41
misiti3780 wrote: post #24

Another, somewhat obvious one: Be extremely careful when using public customized AMIs, a lot of times ~/.ssh/authorized_hosts contains public keys and this is obviously a huge security problem

Yeah, I almost feel like AWS should clear the contents of authoried_keys for each user when you make an AMI public. That of course is bound to break some things, but prevents security oversights.

I would be more worried about a backdoored sshd in a public ami. At least authorized_keys is a known place to check.

Re: AWS mistakes to avoid

#72

Post by querulous »

nzoschke wrote: post #65
jacques_chester wrote: post #47

Earlier quoted context omitted.

As an alternative, Cloud Foundry already drives AWS, as well as Azure, vSphere and OpenStack. Those coming from Heroku will find most of what they want, including buildpacks. Those who want to skip buildpacks can use docker images instead. Disclaimer: I work for Pivotal, who donate the majority of the engineering effort to CF.

Convox member here. CloudFoundry is a really solid platform, but there is a very important distinction between CloudFoundry and Convox. Convox is a very thin layer on top of "raw" AWS. It gives you a PaaS abstraction but behind the scenes is well configures VPC, ECS, Kinesis, Lambda, KMS, etc. For those of us with no need to run on multiple clouds, using pure AWS is simpler, cheaper and more reliable than a middlewar…

how does convox scale when moving to non-trivial aws scenarios? if i have three autoscale groups running seven different apps with associated kinesis streams, s3 buckets, elasticache, rds and elasticsearch instances how cleanly does convox handle this? what about monitoring and reporting?

Re: AWS mistakes to avoid

#73

Post by autotune »

tedmiston wrote: post #44
zerotosixty wrote: post #7

You know what I've realized that's really important. More AWS tutorials is really needed. There's numerous of new programmers who want to learn AWS, but can't finish building anything because they get buried in documentation. I find there are a lot of high-level abstracted tutorials, but for the new services, there aren't a lot of detailed tutorials. For instance, an implemented cognito->gateway->lambda->dynamodb is…

I definitely agree that better tutorials and/or a simpler interface would makes AWS more accessible and user friendly. A YC S15 startup, Convox ( http://convox.com/ ), aims to "make AWS as easy as using Heroku." It looks really promising.

There are also quite a few Ansible core modules for EC2 if you're looking for a uniform way to manage your resources outside of the AWS GUI, although to be honest I'm not sure if that's "easier" so much as more flexible. Still solves the problem with mistake #1.

Re: AWS mistakes to avoid

#74

Post by davidbarker »

nzoschke wrote: post #60
tedmiston wrote: post #44

Earlier quoted context omitted.

I definitely agree that better tutorials and/or a simpler interface would makes AWS more accessible and user friendly. A YC S15 startup, Convox ( http://convox.com/ ), aims to "make AWS as easy as using Heroku." It looks really promising.

Convox member here. Thanks for the shout out. This is definitely a goal of Convox: to remove as much AWS complexity as possible. Our approach matches this guide to a tee. We are using CloudFormation to set up a private app cluster, as well as to create and update (deploy) apps. We are also using ASGs. The instance utilization point is spot on too. The fist thing convox does to make this easy is a single command to re…

I hadn't heard of Convox before, but it sounds interesting.

I'd like to use AWS more, but each time I tried to get into it I felt overwhelmed. I currently use PagodaBox a lot, which is great (most of the time) because it handles a lot of the complexity for me, but it can often be expensive. How does Convox compare to PagodaBox?

Re: AWS mistakes to avoid

#75

Post by inopinatus »

voltagex_ wrote: post #67

I find IAM particularly difficult to use - I feel like there should be a button to create a user/group that can do only X, Y, Z. I realise policy templates get most of the way there but I still had to go and read the syntax for them because DescribeRegions wasn't in the list I needed. I'm also not sure how to make the jump from exporting AWS_ACCESS_KEY_ID and having my instances automatically request the permissions…

If your code is using the AWS SDK then you don't need to export an access key for your running code. Just create an EC2 Service Role in IAM with the policy you want attached to the role; then launch the instance with that role, to get automatic temporary credentials.

Refs: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use... http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles...

Re: AWS mistakes to avoid

#76

Post by cheeseprocedure »

voltagex_ wrote: post #67

I find IAM particularly difficult to use - I feel like there should be a button to create a user/group that can do only X, Y, Z. I realise policy templates get most of the way there but I still had to go and read the syntax for them because DescribeRegions wasn't in the list I needed. I'm also not sure how to make the jump from exporting AWS_ACCESS_KEY_ID and having my instances automatically request the permissions…

> I'm also not sure how to make the jump from exporting AWS_ACCESS_KEY_ID and having my instances automatically request the permissions they need - STS?

Check out instance profiles. This feature allows any AWS API-aware application to request credentials on demand, eliminating key management/rotation:

docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

Re: AWS mistakes to avoid

#77

Post by 20years »

zerotosixty wrote: post #7

You know what I've realized that's really important. More AWS tutorials is really needed. There's numerous of new programmers who want to learn AWS, but can't finish building anything because they get buried in documentation. I find there are a lot of high-level abstracted tutorials, but for the new services, there aren't a lot of detailed tutorials. For instance, an implemented cognito->gateway->lambda->dynamodb is…

acloud.guru has some pretty decent video tutorials. It was easier for me to start with those tutorials before diving into the AWS documentation.

Re: AWS mistakes to avoid

#78

Post by autotune »

zerotosixty wrote: post #7

You know what I've realized that's really important. More AWS tutorials is really needed. There's numerous of new programmers who want to learn AWS, but can't finish building anything because they get buried in documentation. I find there are a lot of high-level abstracted tutorials, but for the new services, there aren't a lot of detailed tutorials. For instance, an implemented cognito->gateway->lambda->dynamodb is…

There's a tutorial on the AWS Labs GitHub that goes through this exact scenario: https://github.com/awslabs/api-gateway-secure-pet-store.

Re: AWS mistakes to avoid

#79

Post by wise_young_man »

nzoschke wrote: post #68
peterwaller wrote: post #16

I like CloudFormation. Unfortunately it is very unwieldy to write CloudFormation templates directly, and we're not about to start using the AWS CFN GUI editor! It seems like the assembly of the AWS ecosystem. Does anyone else have a favourite hammer for this particular nail? I'd love to have something better than our home-baked solution, but I'm yet to find anything which doesn't introduce other flaws, such as an inc…

I am asking this question often. We are using very advanced CloudFormation in the open source Convox platform. https://github.com/convox/rack I have touched every corner of CF including lots of Custom Resources. Right now we are using the golang template tools and tests to generate our templates. But I have lots of needs and ideas for improving this. A CF template compiler and simulator should be possible, giving us…

One of the things that I thought would be neat is an open source CloudFormation that could work for multiple cloud vendors, possibly using a driver pattern.

Also, you might want to update your HN profile with contact info.

Post reply on HN