Have lots of AWS accounts
src-bin.com
Have lots of AWS accounts
1–10 of 176 posts
Re: Have lots of AWS accounts
#2AWS gets many things more right, but I think GCP wins on how they handle Projects and Managed Instance Groups for auto-scaling.
Re: Have lots of AWS accounts
#3One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects.
Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that.
No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy.
Even managing the different accounts is difficult without browser extensions such as this one: https://chrome.google.com/webstore/detail/aws-extend-switch-...
Re: Have lots of AWS accounts
#4AWS gets many things more right, but I think GCP wins on how they handle Projects and Managed Instance Groups for auto-scaling.
Easily separating billing accounts is definitely a must.
Re: Have lots of AWS accounts
#5One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…
Author of the article here: I agree. GCP projects are a better abstraction. I still think AWS is, on balance, a better cloud.
Re: Have lots of AWS accounts
#6One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…
I really dislike the Google Cloud way of doing things, for example Projects, Folders and Orgs. There's a dozen different weird paradigms that you have to consider to securely and reliably manage a large number of different projects, accounts, tenants, business units, etc in Google Cloud; if you don't do things "The Google Cloud Way" you are screwed.
AWS is much simpler and more straightforward. You don't have to think about anything to segregate infrastructure, networks, applications, users, data, etc. Just put it in a different account. If someone needs access, you need to explicitly add extra connections/grant that access. You can't just accidentally create one user that implicitly has access to hundreds of accounts.
Honestly the entire security model of Google Cloud is frightening. It's like they wanted to make it easy to expose everything.
Re: Have lots of AWS accounts
#7One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…
Author of the article here: I agree. GCP projects are a better abstraction. I still think AWS is, on balance, a better cloud.
I'd love to hear more about why you think that's the case!
Maybe the next blog post?
Re: Have lots of AWS accounts
#8"Imagine you’re trying to create the kind of isolation necessary to deliver the security, reliability, and compliance that business customers demand in one AWS account."
Got to be my favorite way to describe two nines ever!
Re: Have lots of AWS accounts
#9Isn’t that against terms since it activates a free tier credit?
Re: Have lots of AWS accounts
#10> My favorite way to create a network between all my services hosted in different AWS accounts is to share a VPC from a network account into all my service accounts and use security groups to authorize service-to-service communication. There’s no per-byte tax, zonal architectures are easy to reason about, and security groups work just like you expect.
That's gold advice. I wish AWS RAM supported more services (like AWS EKS).
A small complain: working with AWS SSO is a bit tedious. My current solution is to share my ~/aws/config with everyone so we all have the same profile names and scripts can work for everyone.