Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Terraforming 1Password

blog.agilebits.com

Post reply on HN
Print view View original

11–20 of 119 posts

Re: Terraforming 1Password

#11

Post by GhostVII »

djhworld wrote: post #9
geerlingguy wrote: post #7

The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…

Personally I find YAML for cloudformation worse than JSON because of the whitespacing requirements. JSON isn't much better mind, especially once your template reaches to hundreds of lines with nested objects. Recently I've come around to using Troposphere [1] to write cloudformation templates, it's actually very pleasant to use. You just write your infrastructure in python, and it will generate you a template at the…

JSON is a subset of yaml, so if you want to just use JSON it should still work.

Re: Terraforming 1Password

#12

Post by vr46 »

chatmasta wrote: post #2

I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.

The internal infrastructure of AWS apps are fairly guessable anyway. There are only a limited number of AWS resources and they fit together in predictable ways, VPC - Gateway - ASG - EC2 etc etc.

I think it's really great that they've talked about this, it's quite rare to hear about these kinds of internal migrations, and it's something I do a lot with clients but it's not really glamorous enough to talk about.

Re: Terraforming 1Password

#13

Post by Jdam »

geerlingguy wrote: post #6
chatmasta wrote: post #2

I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.

The map / description in the blog post probably describes about 50% of all the applications running in AWS that I’ve seen, almost identically. If they listed out security group and IAM configurations, or how exactly they’re connecting through the bastion, then it would be a little more risky, yes.

CDN in front of S3, LB in front of Multi-Az EC2 and RDS in background plus Redis for caching... this is basically the infrastructure Hello World of an AWS application. From a security perspective, that might be new for script kiddies but probably any random hacker will assume such a setup.

Re: Terraforming 1Password

#14

Post by mterwill »

Interesting blog post, but AgileBits should have communicated planned downtime to their customers via email, which they did not. I’ve been a 1Password user for years and recently switched to their hosted offering. I know a massive infrastructure migration is rare, but that’s all the more reason to be transparent ahead of time.

Re: Terraforming 1Password

#16

Post by curun1r »

Their AWS bill seems like it would be a lot higher than it needs to be. They're spinning up always-on staging, testing and development environments in 3 different regions. I know they've got autoscaling configured, so their production environment should be significantly larger than the others, but it still should be possible to be much more economical while accomplishing all of those non-production workloads.

The whole point of infrastructure-as-code should be the ability to spin up environments on-demand, do work, and then spin down. There's no reason to spin up an always-on shared development environment when developers can easily spin up their own environment when they need to do testing and kill it when they're done. Most development tasks can be tested in a single AZ, let alone region. Similarly, QA shouldn't need an always-on, 3-region setup.

Re: Terraforming 1Password

#18

Post by arusahni »

djhworld wrote: post #9
geerlingguy wrote: post #7

The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…

Personally I find YAML for cloudformation worse than JSON because of the whitespacing requirements. JSON isn't much better mind, especially once your template reaches to hundreds of lines with nested objects. Recently I've come around to using Troposphere [1] to write cloudformation templates, it's actually very pleasant to use. You just write your infrastructure in python, and it will generate you a template at the…

+1 for Troposphere. It reduces the noise from your CF template while bringing the flexibility and ease-of-use of Python. I've also discovered that it's far easier to get new developers spun up on than Terraform.

Re: Terraforming 1Password

#19

Post by blantonl »

curun1r wrote: post #16

Their AWS bill seems like it would be a lot higher than it needs to be. They're spinning up always-on staging, testing and development environments in 3 different regions. I know they've got autoscaling configured, so their production environment should be significantly larger than the others, but it still should be possible to be much more economical while accomplishing all of those non-production workloads. The who…

In cloud development environments, you need to account for multi-AZ deployments and the challenges associated with such.

Re: Terraforming 1Password

#20

Post by blantonl »

mterwill wrote: post #14

Interesting blog post, but AgileBits should have communicated planned downtime to their customers via email, which they did not. I’ve been a 1Password user for years and recently switched to their hosted offering. I know a massive infrastructure migration is rare, but that’s all the more reason to be transparent ahead of time.

What impact did this changeover actually have on you?
Post reply on HN