Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS bastions and assume-role

engineering.coinbase.com

Post reply on HN
Print view View original

61–68 of 68 posts

Re: AWS bastions and assume-role

#61

Post by StreamBright »

1ba9115454 wrote: post #2

As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…

If your entire security can be circumvented with a single zero day it is called coconut security. The whole point of having multiple layers is to prevent a single zero day able to take down your entire infra.

Re: AWS bastions and assume-role

#62

Post by mentat »

takeda wrote: post #45

I like AWS multiple accounts support it helps securing specific environments, but I don't like that going this route increases the cost. Here are some things I don't like: 1. if you want to use AWS support, you need to purchase it per account, otherwise support will refuse any help that involves anything specific to the account (they will only respond with generic documents) 2. with separate account you need to recre…

If you use the same billing account I'm pretty sure 1 is not true. I only know at higher support levels though it is not a problem for sure.

Re: AWS bastions and assume-role

#64

Post by vacri »

peterwwillis wrote: post #47
1ba9115454 wrote: post #2

As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…

Leave your house's front door unlocked and keep a camera outside trained on the door. For the first week, tell nobody that it is unlocked. For the second week, tell everyone you meet that it is unlocked, and provide a map. On the third week your camera records someone going into the house. Did telling people your house was unlocked make your house less secure? Your house was exactly the same in the first week as the…

> Telling people it was insecure did not make it insecure - it was already insecure.

It's a common tactic for burglars to look for when homeowners are going on holidays. The homeowner being on holiday makes the house less secure, but the information that that particular house is less secure is of benefit to the burglar.

Security isn't a binary state.

Re: AWS bastions and assume-role

#66

Post by takeda »

mentat wrote: post #62
takeda wrote: post #45

I like AWS multiple accounts support it helps securing specific environments, but I don't like that going this route increases the cost. Here are some things I don't like: 1. if you want to use AWS support, you need to purchase it per account, otherwise support will refuse any help that involves anything specific to the account (they will only respond with generic documents) 2. with separate account you need to recre…

If you use the same billing account I'm pretty sure 1 is not true. I only know at higher support levels though it is not a problem for sure.

Well, I don't have access to the root account to see if these accounts are under the same billing account (but best of my knowledge it is), and the support we purchased is Business.

When I had question related to one of account I was told that I will need to open a support ticket on that account, but I couldn't open because they had basic support.

We contacted our TAM and he just shrugged. If this is true that would be great.

Edit: I checked and looks like our account are consolidated until single master one, although we did not purchase support for the master account since nothing is running on it. If there is a way to not have to purchase separate support I would like to know since it could save some money.

Re: AWS bastions and assume-role

#67

Post by cjcampbell »

willejs wrote: post #57
cjcampbell wrote: post #53

Earlier quoted context omitted.

I'm about to evaluate it for my needs. Do you run into any issues with the temporary tokens expiring, e.g., with developers working locally on a web app over a period of a couple hours?

Not really. Its quite straight forward and really just makes it easier to store your creds (on any platform) securely, and enables you to switch roles via profiles in your ~/.aws/config. One thing I would point out is that by default it will timeout the session in 4h and the role in 15m. This means that every 15m you will need to exit your bash shell that aws-vault exec created, or replace the env vars you generated.…

Appreciate the link. Until now, I've used aws-vault with the `exec` command to run CLI tools with a quick return, so the role TTL isn't much of an issue.

I'd like to employ the tool to support local development on a containerized web application. The assume role TTL may prove to be the real issue, so I need to weight the tradeoff of allowing a longer life on the STS keys. I suppose I could set up a profile without a role and override the AWS_PROFILE environment variable within docker-compose. And I know that aws-vault also supports the virtual meta-data service.

Either way, the benefit of something like aws-vault extends beyond security. We've discovered numerous inconsistencies with the profile-based credential handlers in the Java API (https://github.com/aws/aws-sdk-java/issues/803) which beg for a simpler solution in terms of supporting developers.

Re: AWS bastions and assume-role

#68

Post by redwood »

dantiberian wrote: post #7

In Google Cloud, something like this is mostly unnecessary. The project model scopes resources to a particular project within an organisation, rather than all resources being global to the account. This gives a really good first cut at isolating different environments and projects.

Google Cloud does not yet have Org level quotas. Projects can therefore be limiting if powerful building blocks.
Post reply on HN