Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS in 2025: Stuff you think you know that's now wrong

lastweekinaws.com

Post reply on HN
Print view View original

31–40 of 284 posts

Re: AWS in 2025: Stuff you think you know that's now wrong

#31

Post by paulddraper »

kbolino wrote: post #30
SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

The problem is that VPC endpoints aren't free. They should be, of course, at least when the destination is an AWS service in the same region. [edit: I'm speaking about interface endpoints, but S3 and DynamoDB can use gateway endpoints, which are free to the same region]

Well yeah that's the point....why route through the public internet.

Re: AWS in 2025: Stuff you think you know that's now wrong

#32

Post by otterley »

SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge.

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...

(Disclaimer: I work for AWS, opinions are my own.)

Re: AWS in 2025: Stuff you think you know that's now wrong

#33

Post by otterley »

kbolino wrote: post #30
SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

The problem is that VPC endpoints aren't free. They should be, of course, at least when the destination is an AWS service in the same region. [edit: I'm speaking about interface endpoints, but S3 and DynamoDB can use gateway endpoints, which are free to the same region]

Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free.

S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access.

(Disclaimer: I work for AWS, opinions are my own.)

Re: AWS in 2025: Stuff you think you know that's now wrong

#34

Post by otterley »

dmart wrote: post #13
SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

VPC endpoints in general should be free and enabled by default. That you need to pay extra to reach AWS' own API endpoints from your VPC feels egregious.

Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free.

S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access.

(Disclaimer: I work for AWS, opinions are my own.)

Re: AWS in 2025: Stuff you think you know that's now wrong

#35

Post by time0ut »

afandian wrote: post #10
SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

Having experienced the joy of setting up VPC, subnets and PrivateLink endpoints the whole thing just seems absurd. They spent the effort of branding private VPC endpoints "PrivateLink". Maybe it took some engineering effort on their part, but it should be the default out of the box, and an entirely unremarkable feature. In fact, I think if you have private subnets, the only way to use S3 etc is Private Link (correct…

You can provision gateway endpoints for S3 and DynamoDB. They are free and considered best practice. They are opt-in though, but easy to enable.

Re: AWS in 2025: Stuff you think you know that's now wrong

#36

Post by kbolino »

paulddraper wrote: post #31
kbolino wrote: post #30

Earlier quoted context omitted.

The problem is that VPC endpoints aren't free. They should be, of course, at least when the destination is an AWS service in the same region. [edit: I'm speaking about interface endpoints, but S3 and DynamoDB can use gateway endpoints, which are free to the same region]

Well yeah that's the point....why route through the public internet.

I doubt the traffic ever actually leaves AWS. Assuming it does make it all the way out to their edge routers, the destination ASN will still be one of their own. Not that the pricing will reflect this, of course.

The other problem with (interface) VPC endpoints is that they eat up IP addresses. Every service/region permutation needs a separate IP address drawn from your subnets. Immaterial if you're using IPv6, but can be quite limiting if you're using IPv4.

Re: AWS in 2025: Stuff you think you know that's now wrong

#37

Post by solatic »

SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

It's a design that is secure by default. If you have no NAT gateway and no VPC Gateway Endpoint for S3 (and no other means of Internet egress) then workloads cannot access S3. Networking should be closed by default, and it is. If the user sets up things they don't understand (like NAT gateways), that's on them. Managed NAT gateways are not the only option for Internet egress and users are responsible for the networks they build on top of AWS's primitives (and yes, it is indeed important to remember that they are primitives, this is an IaaS, not a PaaS).

Re: AWS in 2025: Stuff you think you know that's now wrong

#38

Post by crinkly »

simonw wrote: post #7

S3: "Block Public Access is now enabled by default on new buckets." On the one hand, this is obviously the right decision. The number of giant data breeches caused by incorrectly configured S3 buckets is enormous. But... every year or so I find myself wanting to create an S3 bucket with public read access to I can serve files out of it. And every time I need to do that I find something has changed and my old recipe d…

I just stick CloudFront in front of those buckets. You don't need to expose the bucket at all then and can point it at a canonical hostname in your DNS.

Re: AWS in 2025: Stuff you think you know that's now wrong

#39

Post by rthnbgrredf »

williamdclt wrote: post #18
hnlmorg wrote: post #14

Earlier quoted context omitted.

Not the OP but I’ve had AWS-staff recommend different prefixes even as recently as last year. If key prefixes don’t matter much any more, then it’s a very recent change that I’ve missed.

Might just be that the AWS staff wasn't up to date on this

By the way, that happens quite frequently. I regularly ask them about new AWS technologies or recent changes, and most of the time they are not aware. They usually say they will call back later after doing some research.

Re: AWS in 2025: Stuff you think you know that's now wrong

#40

Post by robertlagrant »

nbngeorcjhe wrote: post #24
tux3 wrote: post #11

Earlier quoted context omitted.

That is price segmentation. People who are price insensitive will not invest the time to fix it People who are probably shouldn't be on aws - but they usually have to for unrelated reasons, and they will work to reduce their bill.

> People who are price insensitive will not invest the time to fix it This just sounds like a polite way of saying "we're taking peoples' money in exchange for nothing of value, and we can get away with it because they don't know any better".

It's more like: we made loads of stuff super cheap but here's where we make some money because it scales with use.
Post reply on HN