Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have lots of AWS accounts

src-bin.com

Post reply on HN
Print view View original

121–130 of 176 posts

Re: Have lots of AWS accounts

#121

Post by thedougd »

pid-1 wrote: post #111
thedougd wrote: post #102

Earlier quoted context omitted.

Why can't the CLI generate the config if I can see all the accounts and roles in the SSO start page? That's a desperately needed feature. I would love to see a browser extension for SSO account tabs if AWS can't solve it natively.

`aws configure sso` does that, but: 1 - You need to do that with each account / role pair 2 - It gives profiles very long names by default ( - ) 3 - It does not set $AWS_PROFILE, so you need to pass ` --profile ` manually So the code is actually there already, they just need to make the experience better.

I imagine most are like me and after doing this once or twice falls back to a text editor.

Re: Have lots of AWS accounts

#122

Post by mattpallissard »

forgomonika wrote: post #49
mattpallissard wrote: post #18

> AWS accounts are the most complete form of isolation on offer. Because it's a pretty brutal namespace. While I usually wind up with separate accounts for multiple reasons, I strongly prefer to get rbac/iam properly implemented in a single account wherever possible.

> I strongly prefer to get rbac/iam properly implemented in a single account wherever possible. This can really help manage complexity but it the more this account grows the riskier it becomes if a bad actor breaks into the account (ranging from fraudsters/hackers to disgruntled employees).

Using accounts as the security boundary is easier to reason about up front but it's rather ham fisted. If you're centrally automating large swaths of infrastructure across many accounts you'll wind up paying for that in the long run.

When a shop smaller, or dealing with multi-tenancy situations, multiple accounts is an easy trade off to make. The account boundary has its place, but it's not for everything.

Some of these scaling pains with hard boundaries have gotten better with awssso and iam features over the years but you still run into them on occasion.

As far as whatever you mean by "breaking into an account". I said originally, "rbac/iam properly implemented". If you fuck that up, it doesn't matter whether or not you have one or multiple accounts.

Having a single account does mean that you have to give anyone the keys to the kingdom or that you don't separate your concerns.

Re: Have lots of AWS accounts

#123

Post by macintux »

atonse wrote: post #14
dijit wrote: post #3

One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…

AWS SSO has made it incredibly easy for us to secure and manage access to (and switch between) all our AWS accounts in the org. I'm a huge fan and recommend it.

I was originally skeptical when we implemented it because for safety reasons I wanted it to be painfully obvious when I was switching contexts.

It's definitely grown on me, but I frequently emphasize to my teammates that I'd much rather they specify their AWS_PROFILE for each command they run, instead of exporting it into their environment. Especially using Windows and setx seems like an open invitation for disaster.

Re: Have lots of AWS accounts

#124

Post by smeagull »

gw99 wrote: post #38

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…

> Every other reason here is because you fucked up.

No. Just No.

This is a guardrail against fucking up. And everybody needs more of those.

The only thing missing that would make this the best thing ever, is AWS having a limit on how much cost an account can generate. But they love making money of people's mistakes, so you can never prevent the infinite downside.

Re: Have lots of AWS accounts

#125

Post by manv1 »

Having multiple accounts reduces the potential blast radius tremendously.

Anyone who hasn't accidentally deleted "stuff" in the wrong account is someone who hasn't been doing production work for long.

One big downside is that it makes sharing resources between accounts more difficult...which I suppose might also be an upside, since that dependency needs to be explicit in the various permissions.

It also makes tooling more awkward.

But, it also allows you to completely automate deployment of consistent environments, providing a IT/CI/Testing nirvana for not that much work.

Re: Have lots of AWS accounts

#126

Post by mongro1 »

Lots of AWS accounts doesn't scale. Accounts are heavy items in terms of governance, manageability and cost. On your way to 100 accounts you'll be rearchitecting security and networking and will find yourself in a strange limbo of architecture models. Once over 100 you'll be drowning in the tech debt of a complex environment with increasing friction.

Accounts can be made lightweight by using shared VPC/subnets but then you'll be in the realm of niche user, hampered by AWS's poor support for RAM service support with poor documentation if you plan on using anything off the highway of bread and butter services.

IMO a balance needs to be struck with sensible boundaries built on business units or ownership. Shared VPC's are inherently unstable and should be avoided where possible. Build a good delegated IAM model and hammer people to use it properly.

Re: Have lots of AWS accounts

#127

Post by Aeolun »

gw99 wrote: post #38

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…

> You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with.

Yeah. So you are saying it’s a great idea for 80% of all companies?

> My favourite thing doing is spending 2 days opening support tickets in 10 different accounts to get a limit raised and then tracking the state of all the tickets and limit changes

I agree this sucks balls though.

Re: Have lots of AWS accounts

#128

Post by rcrowley »

mongro1 wrote: post #126

Lots of AWS accounts doesn't scale. Accounts are heavy items in terms of governance, manageability and cost. On your way to 100 accounts you'll be rearchitecting security and networking and will find yourself in a strange limbo of architecture models. Once over 100 you'll be drowning in the tech debt of a complex environment with increasing friction. Accounts can be made lightweight by using shared VPC/subnets but th…

I’d love to hear more about your experience with shared VPCs. What’s inherently unstable about them?

Re: Have lots of AWS accounts

#129

Post by zeckalpha »

gw99 wrote: post #38

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task. Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make…

> My favourite thing doing is spending 2 days opening support tickets in 10 different accounts to get a limit raised and then tracking the state of all the tickets and limit changes...

Counter intuitively, a single or small N of accounts makes this more likely. With many, have fun, take the safety bars off, it is contained.

Re: Have lots of AWS accounts

#130

Post by cameronh90 »

nijave wrote: post #80
cameronh90 wrote: post #72

Earlier quoted context omitted.

Or you can just use multiple accounts, which makes things a whole bunch easier. Frankly, AWS is just missing a level of abstraction here. Azure has resource groups, Gcloud has projects. An AWS account now is just used instead of those concepts, despite it being heavyweight and awkward to do so.

There's plenty of tools to automate the creation and management of new accounts. The biggest hurdle afaik is there's no automated way to delete an account Azure also has higher-level subscriptions

It does, but account creation is kind of slow, and the whole control tower / SSO / etc. stuff is fairly janky. Clearly Amazon have been trying to make the account a more common level of isolation for some time and it's improving, but it's still not fantastic. Support also still has a minimum monthly pricing and isn't cross-account.
Post reply on HN