Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does anyone else finds AWS and other Amazon services overly complicated?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 148 posts

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#131

Post by naasking »

mcqueenjordan wrote: post #128
naasking wrote: post #112

Earlier quoted context omitted.

I'm sure there are "reasons" why the HMACs are layered, the question is, does using HMACs actually add useful security properties here, or is this layered HMAC really just a way to generate a cryptographically secure id? If the latter, then can't you just generate that directly rather than needing to gather all of the right information and HMAC it in just the right way?

Sorry, how do you propose to transmit a signature over the wire such that if it were compromised, the blast radius is limited to only the called service within the called region within a finite time window?

Is the signature even necessary? As I said, an opaque bearer token is considerably simpler. Generate as many as you need for whatever services you're running to limit the damage of a leak. Set server-side policies for expiration or whatever else.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#132

Post by naasking »

dastbe wrote: post #129
naasking wrote: post #112

Earlier quoted context omitted.

I'm sure there are "reasons" why the HMACs are layered, the question is, does using HMACs actually add useful security properties here, or is this layered HMAC really just a way to generate a cryptographically secure id? If the latter, then can't you just generate that directly rather than needing to gather all of the right information and HMAC it in just the right way?

when a request hits the server authenticating you, it has to recreate the signature. aws doesn’t want to provide those services your raw credential because that makes any aws host a very juicy target. instead, they provide the partially evaluated signature including region and service and then they continue the process. this means that if you compromise an ec2 host, the only credentials you get are usable against ec2…

> when a request hits the server authenticating you, it has to recreate the signature

Authentication doesn't require signatures, that's my point. They often place the burden of getting the security right on the client.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#133

Post by dastbe »

naasking wrote: post #132
dastbe wrote: post #129

Earlier quoted context omitted.

when a request hits the server authenticating you, it has to recreate the signature. aws doesn’t want to provide those services your raw credential because that makes any aws host a very juicy target. instead, they provide the partially evaluated signature including region and service and then they continue the process. this means that if you compromise an ec2 host, the only credentials you get are usable against ec2…

> when a request hits the server authenticating you, it has to recreate the signature Authentication doesn't require signatures, that's my point. They often place the burden of getting the security right on the client.

so you mention bearer tokens in another comment, so i’ll speak to that.

while bearer tokens are simpler, the protection they provide is more limited. for example, a bearer token has no request affinity so if i get your token for service foo from a request you made, i can impersonate you for the lifetime of that token. and it’s much easier to get your token, because it has to live your physical machine to be of any use.

with bearer tokens, the only way to reduce blast radius is to generate more tokens. get a token per-service/region, get a token every 5 minutes, etc. this is possible, but comes at the expense of availability. if the token vendor is down, the impact of the outage is proportional to how frequently and in what situations a caller needs to get a new token.

with signatures and client computation of scoped keys, you’re able to use much longer lived credentials while generating short term credentials only where necessary for that request.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#134

Post by hdjjhhvvhga »

gw98 wrote: post #7

Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…

> I eat well due to this mess but I know it's all so so so wrong.

That's the point - I do this too. I like the fact that AWS jobs pay well. I'm fair and I always point out to my clients that AWS is expensive and it will cost them more in the long run, and the vendor lock-in is considerable - but they don't care as "everybody is doing it." Well, that's fine with me, I also like to eat well.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#135

Post by stblack »

vitorfhc wrote: post #88
stblack wrote: post #82

Earlier quoted context omitted.

I envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.

Hey, is the AWS account you are using inside an organization? If it's then all the billing information should go into the management account. Hope this is the issue and I could help you.

Here's how this is playing out.

* We need a way to serve image files.

* I create an organization account, add an S3 bucket.

* We serve images as our application grows.

* Fast forward a few months, get an email saying, we're at 85% of free-tier limit.

* I invite my boss to the Organization, and make her the financial contact.

* Neither I, nor my boss, have been able to figure out where, or how, to enter a credit card number.

* We continue to get monthly 85% limit emails. Following the link in the email leads nowhere where we could enter the payment info.

* What a completely insane and stupidly opaque UI. Take our money! How?

* Will probably move to a service that's better organized. We're just serving image files, a few hundred per day.

We have both tried and are unable to figure out how to tie payment info to our AWS organization.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#136

Post by moltar »

I’ve been developing for the web since 1998. I also held this belief until about 3 years ago. Then I actually tried to learn AWS and now I just can’t imagine going back to anything before. And I’ve used everything from basic shell scripts to ansible to Docker to K8s to Heroku and everything in between. In the end AWS is a bunch of legos that I love to snap together to create powerful, robust solutions. I encourage you to take a look at AWS CDK.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#137

Post by kruuuder »

appleflaxen wrote: post #121
kruuuder wrote: post #110

Earlier quoted context omitted.

I also used an S3 bucket for static files. The setup was way more complicated than I expected, and figuring out how to get usage statistics and understanding the cost structure even more so. In the end I moved from S3 to a CDN, super simple to set up and costs went down from 200 USD per month to 5 USD per month. I hope I'll never have to deal with AWS again.

which CDN are you using?

bunny.net

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#138

Post by carabiner »

rippercushions wrote: post #49
carabiner wrote: post #5

I did AWS training at the Amazon offices in Seattle for data science. I was blown away by the configuration... I have recompiled linux kernels and configured iptables as a teenager, and this was an entire galaxy of more complexity. It took us 6 hours to the point where some of us had a Jupyter Notebook running. Many people didn't make it though.

Were you doing things the hard way on purpose? It's literally one click to spin up a Jupyter notebook on GCP, arguably less if you use Colab (instant access to shared instances), and I'm sure AWS has a similar service. https://cloud.google.com/vertex-ai-workbench

So, if I remember right, the endgame was to have an automated ML model running as a service on an AWS instance with SageMaker. Part of that involved having a Jupyter setup installed. Don't remember much past that, though.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#139

Post by TheNewsIsHere »

gw98 wrote: post #7

Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…

I recently created a static site at a zone apex without Route53. Everything else just works, well, as you illustrate.

> Play with CloudFormation for 2 days writing oodles of mind numbing YAML and realise that you have to create the ACM cert and CF distribution in a different region to your bucket but that's impossible.

The discrepancies in cross-region support specifically with ACM drives me nuts.

I noped away from Terraform back in 2019. At the time, the state management component was too immature, and it was a little.. lose with credential security.

You may like Ansible far more if you’d like something a bit more declarative, readable, and with “batteries included.” I have a close friend who is an EE and he finds tools like Ansible much more intuitive and enjoyable than Terraform and CloudFormation.

Every tool has its master.

Re: Does anyone else finds AWS and other Amazon services overly complicated?

#140

Post by TheNewsIsHere »

stblack wrote: post #135
vitorfhc wrote: post #88

Earlier quoted context omitted.

Hey, is the AWS account you are using inside an organization? If it's then all the billing information should go into the management account. Hope this is the issue and I could help you.

Here's how this is playing out. * We need a way to serve image files. * I create an organization account, add an S3 bucket. * We serve images as our application grows. * Fast forward a few months, get an email saying, we're at 85% of free-tier limit. * I invite my boss to the Organization, and make her the financial contact. * Neither I, nor my boss, have been able to figure out where, or how, to enter a credit card…

Are you logging in with an Administrator credentialed account _in_ the Organization master account?

Did you give your boss a Billing role in IAM, within the Organization master account?

If so, search for the “Billing” service and Payment Methods will be on the side.

If in doubt, use the root account, but do so only sparingly. You can use it to debug admin and billing permissions.

Post reply on HN