Live data from Hacker News

AWS doesn’t know who I am

ben11kehoe.medium.com

31–40 of 123 posts

Re: AWS doesn’t know who I am

#31
post #28

Whatever the identity tuple is with Amazon it's deeply confusing. I think it's possible to have: frobiz@example.com password A frobiz@example.com password B Work, and be two different accounts. It's scary.

Because they're namespaced by which AWS account you connect to, same as Slack and many more enterprise products.

You don't have an AWS account. You have an IAM identity and credentials for an AWS account. Except for the root account where what you described is never the case.

Re: AWS doesn’t know who I am

#32
post #29

Earlier quoted context omitted.

It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.

Isn't having more than one Gmail account a violation too?

I don’t think so. We have a family gmail account (mostly for a shared calendar) and Google has explicit ways to use more than one account.

https://support.google.com/accounts/answer/1721977?co=GENIE....

Re: AWS doesn’t know who I am

#33
I'm reading the comments and it looks like many people forgot to read the piece before commenting on it. Yes, separate credentials are good, he states that in the article. That's not what he's asking for either. He's aware of IAM, he's a user, and it's also stated in the article on several occasions.

Re: AWS doesn’t know who I am

#35
post #28

Whatever the identity tuple is with Amazon it's deeply confusing. I think it's possible to have: frobiz@example.com password A frobiz@example.com password B Work, and be two different accounts. It's scary.

Because they're namespaced by which AWS account you connect to, same as Slack and many more enterprise products. You don't have an AWS account. You have an IAM identity and credentials for an AWS account. Except for the root account where what you described is never the case.

I absolutely do think that reasonable ordinary people find this situation confusing. As do password managers. IAM identity is not exactly a widespread understood concept. I doubt if most people entirely "get" the distinction. Google (our instance) pretty much forbids crossbinding like this. I've had non google accounts refused as bootstrap identity in ads and gke because they were just used elsewhere on Google for authorising access.

I'm reluctant to delete duplicate Amazon entries in 1password and bitwarden in case I still need them, for some distinct IAM.

Re: AWS doesn’t know who I am

#36
post #29

Earlier quoted context omitted.

It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.

Isn't having more than one Gmail account a violation too?

It's not a violation to have more than one Google Account - there is the (pretty horrible) account switcher for that scenario.

Re: AWS doesn’t know who I am

#37
post #25

It's good that every service has separate credentials. For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID. It just doesn't match the way that people use computers. For example, I get my computer games and business software billed to the same card, and there's no easy way to chang…

Yes, Apple ID is like a cookie that you can't delete.

My solution: use Linux :)

Re: AWS doesn’t know who I am

#38
post #19
post #10

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account crede…

> I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner. Clearly the solution to this is for the retail site to support IAM roles.

That made me chuckle

Re: AWS doesn’t know who I am

#39

Madness, if you get blocked by aws in one of their accounts. Wave good by to all the other accounts

It's also possible to get your personal GMail account banned after someone at your company breaks Google ToS: https://www.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin... For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.

That story doesn't seem very believable. Why are other people's personal accounts getting banned too?

One possible explanation is that the exit IP for the company has had malware hosted on it, so that IP is getting banned from Google services. If they go home or turn off WiFi on their phones it will probably work.

Re: AWS doesn’t know who I am

#40
Hope you get what you want, but I hope it's an opt-in because I do not want it.

Depending on the service, I probably do not want to be ME + sub-identities. While a good sleuth (or algorithm) with enough data can probably connect me to all the different services I use/manage, I don't necessarily want that information to be public. And if it exists in a database somewhere, it will likely eventually become public.

Post reply on HN