Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS doesn’t know who I am

ben11kehoe.medium.com

Post reply on HN
Print view View original

111–120 of 123 posts

Re: AWS doesn’t know who I am

#111

Post by fairramone »

YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

I have enabled 2FA on my Amazon account and also on my root AWS account. In order to log in to AWS using my root account, I must enter two 2FA responses: one for my Amazon account, the other for my AWS root account. It's weird!

Re: AWS doesn’t know who I am

#112

Post by mvaliente2001 »

I've always thought that AWS conceptual model and implementation is a big mess. Root accounts different from other account, big numbers & ARNs exposed to the user, meaningless names for services, multiple names for same concepts (do I need to say Ireland-1 or is it eu-east-1?). It's inhuman and overly complex. I assume people hasn't revolted because that baroque and unnecessary obfuscation feeds a lot of consultants whose time could have been cut significantly have Amazon had someone to think before implementing such monstrosity.

Re: AWS doesn’t know who I am

#113

Post by LilBytes »

psanford wrote: post #106
LilBytes wrote: post #61

Earlier quoted context omitted.

Change the root user email on your AWS account or the Amazon retail address to something different.

That doesn't work for old accounts. Changing your root email address will also change it for the retail account. This is documented behavior by AWS: https://aws.amazon.com/premiumsupport/knowledge-center/trans...

Thanks for the correction.

I thought my personal account was this old already, clearly not.

Re: AWS doesn’t know who I am

#114

Post by danielheath »

Galanwe wrote: post #45
YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I chang…

As you have learned, setting up 2fa for an important service isn’t something to be done lightly.

My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.

Re: AWS doesn’t know who I am

#115

Post by mcharezinski »

mabbo wrote: post #53
YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

Without going into too much detail, this "coupled account" problem is taken very seriously internally (AWS Identity dev, my opinions are my own and I don't speak for the company). There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard , and done with a lot of care. All new accounts created today are "decou…

Could you please share some of the technical challenges about the migration?

Re: AWS doesn’t know who I am

#116

Post by FridayoLeary »

mabbo wrote: post #53
YPPH wrote: post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

Without going into too much detail, this "coupled account" problem is taken very seriously internally (AWS Identity dev, my opinions are my own and I don't speak for the company). There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard , and done with a lot of care. All new accounts created today are "decou…

Is there work on Amazon.com itself? Because basically everything there needs fixing. But the filters would be a very good place to begin a sorely needed facelift.

Re: AWS doesn’t know who I am

#117

Post by jiggawatts »

A lot of people are comparing AWS identities to G Suite or Apple ID.

A better, more apples-to-apples comparison would be Azure Active Directory.

A single AAD account enables access to: Azure DevOps, Microsoft 365 collaboration apps, remote desktop logins to servers, virtual desktops, and a bunch of other stuff.

It certainly is very convenient, but the downside is that a global outage of AAD takes down a lot of things all at once.

For example, AAD system-managed identities are used as a type of "service account" in Azure. This means that web apps can lose access to their HTTPS certificates stored in Key Vault because AAD is down, causing massive outages.

In theory, AAD has a "read-only delayed replica" as a fallback, but in practice this hasn't worked.

This is actually one of the core "philosophical" differences between AWS and Azure. The former values completely distinct services with no (or minimal) interdependencies, the latter values integrated, cohesive architectures.

In my experience Azure's approach is more convenient but more fragile. Conversely, AWS is more robust but can be super irritating for end-users.

Re: AWS doesn’t know who I am

#118

Post by nl »

b112 wrote: post #94
nl wrote: post #36

Earlier quoted context omitted.

It's not a violation to have more than one Google Account - there is the (pretty horrible) account switcher for that scenario.

Do you mean the login screen with a list of accounts, used from the browser? Or Android's multiple accounts ability? That doesn't mean more than one account per person is OK though. Just the reality than more than one person may share a device.

A list of logins available in the browser. Here's the support page for it: https://support.google.com/accounts/answer/1721977?co=GENIE....

Lots of screenshots around if you google "Google Account Chooser".

Pretty much everyone who works for a company that uses GSuite will be very familiar with it.

Re: AWS doesn’t know who I am

#119

Post by nl »

skinkestek wrote: post #47
nl wrote: post #39

Earlier quoted context omitted.

That story doesn't seem very believable. Why are other people's personal accounts getting banned too? One possible explanation is that the exit IP for the company has had malware hosted on it, so that IP is getting banned from Google services. If they go home or turn off WiFi on their phones it will probably work.

> That story doesn't seem very believable. Why are other people's personal accounts getting banned too? Fully believable. In some cases people don't even have the slightest clue. In this case there is at least an explanation even if it is bad. PS: I don't hate everything Google do or any employees specifically, I just try to shine a light on the places where they fail like lack of transparency or even basic communica…

The top voted comment on HN at the time thought it wasn't believable either: https://news.ycombinator.com/item?id=17115643

Re: AWS doesn’t know who I am

#120

Post by b112 »

nl wrote: post #118
b112 wrote: post #94

Earlier quoted context omitted.

Do you mean the login screen with a list of accounts, used from the browser? Or Android's multiple accounts ability? That doesn't mean more than one account per person is OK though. Just the reality than more than one person may share a device.

A list of logins available in the browser. Here's the support page for it: https://support.google.com/accounts/answer/1721977?co=GENIE.... Lots of screenshots around if you google "Google Account Chooser". Pretty much everyone who works for a company that uses GSuite will be very familiar with it.

These urls are blocked for me, but, from what you've said, it's about maintenance in paid gsuite, which doesn't mean more than one account per user.

Google gives free storage, etc per account. I wonder, if you exceeded that and had a second, how quickly they'd say 'one account per person'?

Post reply on HN