Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I returned to AWS and was reminded why I left

fourlightyears.blogspot.com

Post reply on HN
Print view View original

391–400 of 684 posts

Re: I returned to AWS and was reminded why I left

#391

Post by whazor »

temp8830 wrote: post #231
aurareturn wrote: post #157

Earlier quoted context omitted.

Doesn't Amazon engineering culture have a very engineer-led product culture? Meaning, devs are often responsible for the UX and flow. I remember many years ago we hired a junior developer who just finished his internship at AWS and he showed me the dashboard he shipped all by himself in the summer with no product or designer help. It looked horrible. Some devs have a good product/UX sense but the vast majority are ho…

AWS UX isn't bad because engineers are bad at UX. It's because inside AWS it's every man for himself, and every team for itself. They don't collaborate, they don't talk, they compete to ship everything as quickly and cheaply as possible - quality, usability, and common sense be damned.

AWS UX is bad because there are too many products and features, but also still supported legacy.

Re: I returned to AWS and was reminded why I left

#392

Post by sithadmin »

temp8830 wrote: post #231
aurareturn wrote: post #157

Earlier quoted context omitted.

Doesn't Amazon engineering culture have a very engineer-led product culture? Meaning, devs are often responsible for the UX and flow. I remember many years ago we hired a junior developer who just finished his internship at AWS and he showed me the dashboard he shipped all by himself in the summer with no product or designer help. It looked horrible. Some devs have a good product/UX sense but the vast majority are ho…

AWS UX isn't bad because engineers are bad at UX. It's because inside AWS it's every man for himself, and every team for itself. They don't collaborate, they don't talk, they compete to ship everything as quickly and cheaply as possible - quality, usability, and common sense be damned.

That's not just AWS. That's Amazon generally. All Amazon orgs I've worked for have been like this, and due to the nature of my work, I (and my teams) have been treated like pariahs for daring to suggest that there ought to be even a minimal amount collaboration, shared standards, and cross-pollination on ideas between teams.

Re: I returned to AWS and was reminded why I left

#393

Post by amluto »

Aperocky wrote: post #275
raffraffraff wrote: post #248

I always smile at posts like this. They're right and wrong at the same time. Systems should be "as simple as possible, but no simpler". And thinking that you can gloss over the detail is just going to create more hassle later on. IAM is just complex. I can't think of any implementation of "users, groups, roles, policies, identity providers, oidc" that is truly simple. I'm reminded of a guy I worked with, who fought a…

Some internal perspective - IAM has maybe thousands of options but fundamentally it is "what does this role have access to doing (action + resource)" + "who has access to this role". That is really it from a 10k foot level. IAM is great because it applies internally just like it does externally. The internal AWS team don't get more access than you do, and if we get access to do certain thing on your account to perfor…

> but fundamentally it is "what does this role have access to doing (action + resource)" + "who has access to this role". That is really it from a 10k foot level.

Hahahaha. No, fundamentally it is one input into a huge mess that you cannot actually see or audit from a 10k foot level.

AWS has produced a long, rambling and imprecise description of (some of?) what’s actually going on. You can read it here:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli...

Some of what they’re describing doesn’t even live within the IAM umbrella as far as I can tell. I’m not convinced that a concise, formal and unambiguous specification exists anywhere, even within AWSes own development teams.

I’ve asked LLMs to write AWS “policy”. They get the grammar mostly right. They cannot explain what the effects are in a manner that they will stand by after they search the web for documentation. Since I have never found good documentation despite looking, I can’t personally do any better than the LLMs. I’d love to be pointed at real documentation or specs.

Re: I returned to AWS and was reminded why I left

#394

Post by puelocesar »

faangguyindia wrote: post #8

Why do people even bother with cloud? I’ve a couple of apps doing a few million a day. I am using Hetzner and before that used DigitalOcean. Mind you, for close to a decade. People are unnecessarily complicating stuff, and these clouds can go very expensive very quickly. Recently, I came across a company and they were spending $20k a month on GCP. I am like, are you kidding me, $20K for the kind of stuff you do??? It…

We are having this dilemma right now. I’m not involved in devops, but it’s quite annoying on how slow everything related to our backend is.

I think we spend around 5k in aws, and I’m pretty sure we could be much more performant for a fraction of that price.

The problem is, who is going to setup everything? Hiring someone would for sure cost more than 5k

Re: I returned to AWS and was reminded why I left

#395

Post by Spooky23 »

mrmanner wrote: post #383
jnovek wrote: post #302

Earlier quoted context omitted.

Regardless of whether the metaphor stands up, this is a horrible thing to say. Abuse victims are not responsible for the abuse they receive.

I had the same thought at first, but in context I think the quoted text refers to business relationships. Which makes all the difference.

They're really the same thing. I think of the classic Walmart/Vlasic pickle story.

https://eng121.net/online%20textbook/cause-effect/The%20Wall...

Re: I returned to AWS and was reminded why I left

#396

Post by cryo32 »

tailscaler2026 wrote: post #314

Anyone considering leaving AWS and thinking they'll transfer all their data for free [1], I've got news for you: It's a lie. AWS takes as long as possible (for me it was a month) to respond to the initial DTO request, then require you to submit a multi-page form answering a barrage of questions about why you're leaving, where you're going to, what services you used, and estimated data egress. A week or so later, if t…

If you have a lot of data it's cheaper to lease a Direct Connect line into an AWS zone and suck it out through that.

Re: I returned to AWS and was reminded why I left

#397

Post by cyberax »

hedora wrote: post #348
hedora wrote: post #323

Earlier quoted context omitted.

IAM is unnecessarily bad. I recently had to set a trivial policy, and was doing it correctly. The console kept warning me that I was giving root AWS access to my external application because they want people to use the locked in AWS path, and I was running off cloud. On top of that, they break copy paste on the web console, so you can’t just ctrl-c ctrl-v and then ask Claude to explain their WTF-ery. Instead, you hav…

I guess I should also point out that I’ve used AWS at extremely large scale in the past, which is why I’m running this subproject on another cloud. As for simple permissions, go read the UNIX paper. It spends a page or two on their approach and is all you need. Then, read the paper on mapping between NTFS SMB ACLs and NFS. It’s either impossible or undecidable, depending on the deployment. IAM is from the windows acl…

IAM is NOT from any lineage. It has grown organically and is complicated, just as any other policy language. AWS even uses an automatic proof assistant to verify IAM policies.

However, the secret to IAM in AWS is to NOT use IAM. Just create separate AWS accounts for separate services and only share whatever resources are needed. Then you can have dead simple IAM policies because you won't need to do granular permissions ("AWS role X can access database Y").

Re: I returned to AWS and was reminded why I left

#398

Post by Demiurge »

zsoltkacsandi wrote: post #364
zsoltkacsandi wrote: post #195

Earlier quoted context omitted.

You can set up cost-based alerts (actual or forecasted) that send notifications via email or SNS. Based on this you can set up automations, such as applying an IAM policy to prevent further resource creation, shut down resources, etc.

Interesting to see that some people assumed there are no kill-switch mechanism, and when it turns out they just did not know about it, the (totally valid and factful) comment gets downvoted because it is against their initial assumption. Not what I would have expected on a professional forum.

I do not downvote comments when I disagree, and I think it’s better to explain why I would strongly disagree. Downvoting in this case almost reinforces the notion that the downvoted comment makes such a good point that it causes people to give up on the discourse and just smash the panic downvote button. It’s obvious to me why this is not the case for this comment.

The suggestion to setup some kind of IAM policy to shut things down and stop resource usage is insanely complicated for users who need this kind of feature the most. If I’m learning AWS and just added my CC to it, I am the last person to be qualified to setup this kind of an alert and policy from scratch. This needs to be a single text input in the billing page, like it is for countless spend-as-you-go services. When the limit is hit, the service needs to stop the usage at the customers peril, because that’s what they customer requests.

Hope this helps.

Re: I returned to AWS and was reminded why I left

#399

Post by Capricorn2481 »

nemothekid wrote: post #342
Capricorn2481 wrote: post #272

Earlier quoted context omitted.

In completely unrelated pages to where you setup resources, yes. Ec2 pricing is in a random doc disconnected from the AWS console. They absolutely could to you a base price on the ec2 setup page, but they don't. And I have been absolutely surprised by pricing. Services that do almost nothing could cost more than your ec2.

Respectfully, I think this is more of a use case where you aren't the target audience for a service like AWS. I've been working with AWS for nearly 10 years. Many people I know, both small and large, just don't even use the console. If I need to figure out how much a project costs I use the AWS pricing calculator. Having an ec2 pricing on the pricing page is meaningless once you spend any meaningful amount of time in…

I'm a contractor, so my deployment complexity is whatever my current client's complexity is.

> If you just need a VPS provider, there are better, less complex options. I find these complaints kind of like stepping into an F1 car and complaining that the F1 car is deceiving you because theres no fuel gauge

That's fine if you feel that way. The article and following discussion is clearly about the smaller audience, and I think you're underestimating how far up these little problems stack and scale. If a couple grand is a rounding error to you, that's great. Most businesses fall firmly in the place where that would be a problem.

I think there is a value add for large companies on AWS, but for smaller ones, I don't particularly feel like AWS is an F1 car, more like a self driving Tesla that locks you inside when it's on fire. And I find the cavalier attitude that these companies aren't important enough to add the distinction to be exhausting. AWS is being pushed on everyone.

Re: I returned to AWS and was reminded why I left

#400

Post by amluto »

cyberpunk wrote: post #249
raffraffraff wrote: post #248

I always smile at posts like this. They're right and wrong at the same time. Systems should be "as simple as possible, but no simpler". And thinking that you can gloss over the detail is just going to create more hassle later on. IAM is just complex. I can't think of any implementation of "users, groups, roles, policies, identity providers, oidc" that is truly simple. I'm reminded of a guy I worked with, who fought a…

Another point is that while it can be more expensive than self hosting, the savings are dwarfed by the engineering costs. A decent infrastructure engineer working for 2 man months on your “money saving” ovh setup costs you more than you can possibly save by not just using fargate or rds whatever.

How much would you pay for 2 months of infrastructure engineer time? And how many millions / tens of millions / hundreds of millions are you imagining being spent on overpriced AWS services?

(Also, those AWS services are not engineering-free. I tried to migrate a system to RDS once and gave up after quite a few hours when I got to the part of the documentation that suggested that I edit my sql dump using sed to get it into a form that RDS would accept. No, thanks.)

Post reply on HN