Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does anyone else finds AWS and other Amazon services overly complicated?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 148 posts

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#121

Post by appleflaxen »

kruuuder wrote: post #110
stblack wrote: post #82

Earlier quoted context omitted.

I envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.

I also used an S3 bucket for static files. The setup was way more complicated than I expected, and figuring out how to get usage statistics and understanding the cost structure even more so. In the end I moved from S3 to a CDN, super simple to set up and costs went down from 200 USD per month to 5 USD per month. I hope I'll never have to deal with AWS again.

which CDN are you using?

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#122

Post by orf »

BackBlast wrote: post #117
brunooliv wrote: post #19

If you don't use the SDK, how can you judge anything as being "overly complicated"? I mean, I don't know about you, but, last time I checked, signatures, certificates, security and all that stuff IS SUPPOSED to be super complicated because it's a subject with a very high inherent complexity in and of itself. The SDK exists and is well designed to precisely shield you from said complexity. If you deliberately choose n…

Have you ever tried to import the AWS SDK into a front end client? It's huge. Last time I tried it, it added multi MB of JS to my SPA, so I could do a relatively "simple" call using it. Yuck. It did not tree shake cleanly with my build system and I eventually ended up just yanking AWS from the stack entirely.

Did you import the entire SDK, or only the SDK for the service you actually needed?

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#123

Post by devonkim »

yakubin wrote: post #63
gw98 wrote: post #7

Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…

100% this. A couple times I've considered moving my personal website to AWS, but each time I got lost in the documentation trying to keep all the different moving parts in my head. At the end of the day managing a single VPS running debian+nginx+certbot[1] with a Gandi domain is orders of magnitude simpler. [1]: I'm probably going to move that to FreeBSD/OpenBSD with OpenBSD's relayd+httpd+acme-client at some point,…

AWS / systems professional here. I’d use something like Netlify for a personal site instead of the complexities and knobs available when using AWS S3 static site options. AWS bare is the equivalent to me of trying to use Linux From Scratch in 2012 for running a bash script in a cronjob when there’s distributions like Ubuntu out there meant to do a lot of the boring and mostly inconsequential stuff for everyone besides the highly regulated. It’s great for educational reasons but learning and productivity are usually diametrically opposed in use cases.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#124

Post by adaml_623 »

neilv wrote: post #18

You probably want to be using one of the popular libraries to do that. AWS documentation isn't consistently good, and there are lots of decoys. So, if you wound up in some local minima that made it look like you had to implement the signing and such yourself, try a Web search that includes the name of your chosen programming language. (A long time ago, I had to implement the AWS client API from scratch, but that's be…

I like your language of decoys and local minima. It's very easy to follow out of date documentation and find yourself wasting time in a cul-de-sac

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#125

Post by [deleted] »

gw98 wrote: post #7

Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…

[deleted]

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#126

Post by twodave »

There are way better examples than this, such as the checkbox on Elastic Beanstalk that makes you decide whether to give your application a public IP. This checkbox would default to false, and in most sensible configurations would cause Elastic Beanstalk to be unable to reach the application VM. The amount of similar things on AWS (options that literally make the thing unusable if set a certain way) is astronomical, and often for simple things the documentation is non-existent or requires you to custom-configure IAM via xml. Oof.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#127

Post by flamebreath447 »

stblack wrote: post #82
gw98 wrote: post #7

Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…

I envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.

Ah I see you haven’t spent countless hours looking at the management console cost breakdown because management says “our cloud spending is too high”, to then read the highest cost is your “cost savings plan”.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#128

Post by mcqueenjordan »

naasking wrote: post #112
mcqueenjordan wrote: post #32

You HMAC the region so that in case a region is compromised, other regions aren't as well. You HMAC the service so that in case a service is compromised, other services aren't as well, you HMAC the timestamp for obvious reasons (time bound the signature), the outer "aws4_request" HMAC, I'm sure there's a good reason for. Maybe just versioning? Not sure. Also: All of this is handled in the SDKs. Anyone implementing th…

I'm sure there are "reasons" why the HMACs are layered, the question is, does using HMACs actually add useful security properties here, or is this layered HMAC really just a way to generate a cryptographically secure id? If the latter, then can't you just generate that directly rather than needing to gather all of the right information and HMAC it in just the right way?

Sorry, how do you propose to transmit a signature over the wire such that if it were compromised, the blast radius is limited to only the called service within the called region within a finite time window?

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#129

Post by dastbe »

naasking wrote: post #112
mcqueenjordan wrote: post #32

You HMAC the region so that in case a region is compromised, other regions aren't as well. You HMAC the service so that in case a service is compromised, other services aren't as well, you HMAC the timestamp for obvious reasons (time bound the signature), the outer "aws4_request" HMAC, I'm sure there's a good reason for. Maybe just versioning? Not sure. Also: All of this is handled in the SDKs. Anyone implementing th…

I'm sure there are "reasons" why the HMACs are layered, the question is, does using HMACs actually add useful security properties here, or is this layered HMAC really just a way to generate a cryptographically secure id? If the latter, then can't you just generate that directly rather than needing to gather all of the right information and HMAC it in just the right way?

when a request hits the server authenticating you, it has to recreate the signature. aws doesn’t want to provide those services your raw credential because that makes any aws host a very juicy target. instead, they provide the partially evaluated signature including region and service and then they continue the process. this means that if you compromise an ec2 host, the only credentials you get are usable against ec2. the idea is that if you were able to achieve that, you likely don’t even need those credentials to do worse things to ec2.
Post reply on HN