Lots of people here are saying "just use the SDK." But a good API shouldn't be tightly coupled to a particular client; it should be possible to use the API easily using ordinary REST calls. If such a signature mechanism is necessary for security, it should be vendor-neutral, so that it can be shared by other providers and built into general-purpose HTTP clients.
Does anyone else finds AWS and other Amazon services overly complicated?
101–110 of 148 posts
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#102Earlier quoted context omitted.
> compared to FAANG internal tools, its actually not that bad It's because it is an "internal tool". All services are built on top of aws native.
It's the contrary. An internal service is really good and then it becomes an AWS service. I've even been in 2 teams that have tried to do that and one may succeed in a few years.
In my team, all of our services are built on top of AWS.
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#103hmac is meh.
the real issue with aws is the marketing alienation.
router? switch? proxy? rack? forget all the sane terms for your infrastructure. you will call your router a amazon purple capybara 5 and you will have to like it!
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#104Your complaint isn’t about AWS, it’s about the authentication scheme. I find it to be pretty neat, especially when it’s flexible enough to create signed URLs for any method and send them to third parties. We use that as a basis for service-to-service auth. It’s cool and flexible. But overall this complaint seems pretty shallow. You’d just use the client SDKs they publish, or if you want to really go off the beaten pa…
[deleted]
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#105You HMAC the region so that in case a region is compromised, other regions aren't as well. You HMAC the service so that in case a service is compromised, other services aren't as well, you HMAC the timestamp for obvious reasons (time bound the signature), the outer "aws4_request" HMAC, I'm sure there's a good reason for. Maybe just versioning? Not sure. Also: All of this is handled in the SDKs. Anyone implementing th…
Sounds like OP is having a bit of a Chesterton's Fence moment. It's clearly complicated, but you describe why this is probably implemented the way it is. The scheme reminds me of Macaroons: https://blog.gtank.cc/macaroons-reading-list/
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#106Lots of people here are saying "just use the SDK." But a good API shouldn't be tightly coupled to a particular client; it should be possible to use the API easily using ordinary REST calls. If such a signature mechanism is necessary for security, it should be vendor-neutral, so that it can be shared by other providers and built into general-purpose HTTP clients.
This is somewhat silly. First, it is perfectly straight forward how to do the signature stuff, such that if you really want to, you can.
However, this is akin to asking why it is so hard to write a binary against stdlibs on the machine. It is hard because that isn't really an easy ask. And the solutions we made to make the problem tractable are all nicely encapsulated in the SDK tools that we use. Why skip out on them?
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#107Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…
best part about debuging you HCL/CL is when you cannot delete some resource and it won't tell you why besides "is in use".
I created account after account at first and then had hell deleting them entirely. was still easier than figuring out was using a vpc that had nothing visible attached to it
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#108I did AWS training at the Amazon offices in Seattle for data science. I was blown away by the configuration... I have recompiled linux kernels and configured iptables as a teenager, and this was an entire galaxy of more complexity. It took us 6 hours to the point where some of us had a Jupyter Notebook running. Many people didn't make it though.
Why?
That doesn't make any sense to me. What problems were you running into? Did you need to configure a bunch of super-non-standard stuff or something?
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#109I’ve been using aws for years and still don’t get it. Anytime I need to find logs it takes way too long. Simple things they use their own jargon for instead of just making it straight forward. They just need a “simple” mode that cuts out all of the verbose stuff
> their own jargon
Halleluja, it's not a console, it's a sodding web-page
Re: Does anyone else finds AWS and other Amazon services overly complicated?
#110Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…
I envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.
I also used an S3 bucket for static files. The setup was way more complicated than I expected, and figuring out how to get usage statistics and understanding the cost structure even more so. In the end I moved from S3 to a CDN, super simple to set up and costs went down from 200 USD per month to 5 USD per month. I hope I'll never have to deal with AWS again.