AWS doesn’t know who I am • Hacker News Board

Re: AWS doesn’t know who I am

#121

Post by smt88 » Mon, Aug 23, 2021, 8:43 AM UTC

danielheath wrote: post #114

Galanwe wrote: post #45

Earlier quoted context omitted.

> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I chang…

As you have learned, setting up 2fa for an important service isn’t something to be done lightly. My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.

I'd love to do this, but many services still only support SMS or don't support multiple hardware keys.

Re: AWS doesn’t know who I am

#122

Post by mabbo » Mon, Aug 23, 2021, 1:47 PM UTC

mcharezinski wrote: post #115

mabbo wrote: post #53

Earlier quoted context omitted.

Without going into too much detail, this "coupled account" problem is taken very seriously internally (AWS Identity dev, my opinions are my own and I don't speak for the company). There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard , and done with a lot of care. All new accounts created today are "decou…

Could you please share some of the technical challenges about the migration?

I'm not a spokesperson for the company and really don't feel comfortable saying anything specific about this.

Generically: Identity is a very hard space. It's one of those things that sounds really simple but the deeper you go the more edge cases you find.

With an complex systems, changing fundamental designs of the system- while users and other systems are currently using that system- is like trying to upgrade the engines on a plane while in flight. Technically possible, with a lot of planning, but any wrong move or bad assumption and you're going to crash.

Re: AWS doesn’t know who I am

#123

Post by liquidexil » Mon, Aug 23, 2021, 3:53 PM UTC

I feel like this doesn't consider the massive upside to IAM roles as identities. Once a user is a top-level concept, there will be things that only users can do. When everything is a role, an action can be taken by a user or an autonomous system in the exact same way.

I don't think this was an accident. Internally, Amazon traditionally had very different methods for authenticating and authorizing users versus systems, and it was a massive pain. Switching to IAM roles relieved some massive pain-points.