Have lots of AWS accounts • Hacker News Board

Re: Have lots of AWS accounts

#31

Post by simonw » Mon, Oct 03, 2022, 6:29 PM UTC

dijit wrote: post #7

rcrowley wrote: post #5

Earlier quoted context omitted.

Author of the article here: I agree. GCP projects are a better abstraction. I still think AWS is, on balance, a better cloud.

I'd love to hear more about why you think that's the case! Maybe the next blog post?

The killer feature of AWS is that they've broken almost nothing since first launching over 15 years ago. Their commitment to keeping old stuff working is truly amazing.

No other cloud hosting service comes close, because no other cloud service has had 15 years to prove themselves in the same way!

Re: Have lots of AWS accounts

#32

Post by simonw » Mon, Oct 03, 2022, 6:33 PM UTC

moralestapia wrote: post #28

Every serious project I engage on has its own: * domain (obviously) * emails also for every provider I have a different email like (google@domain, twilio@domain, etc...) * credit cards (my bank makes it super easy to just create new ones) * phone no. (I just buy a burner phone) It's a bit of a PITA but the benefits outweigh the cons. I have a clear understanding of how much each of them costs me, for instance. Plus,…

Which bank is that?

Re: Have lots of AWS accounts

#33

Post by 015a » Mon, Oct 03, 2022, 6:34 PM UTC

I would argue that the optimal number of AWS Accounts is Zero.

Re: Have lots of AWS accounts

#34

Post by simonw » Mon, Oct 03, 2022, 6:34 PM UTC

jackconsidine wrote: post #24

I have indeed found that it's difficult to silo access to specific resources with AWS IAM. I use these custom policies a lot, which give write access to a specific S3 Bucket [0], and give sending capabilities for a specific SES Identity [1] respectively: [0] https://koptional.notion.site/IAM-Policy-for-select-S3-Acces... [1] https://koptional.notion.site/IAM-Policy-for-email-sending-o...

I ended up writing a whole custom tool for generating credentials and policies for specific S3 buckets:

- https://s3-credentials.readthedocs.io/

- https://simonwillison.net/2021/Nov/3/s3-credentials/

- https://simonwillison.net/2022/Jan/18/weeknotes/

Re: Have lots of AWS accounts

#35

Post by tomrod » Mon, Oct 03, 2022, 6:35 PM UTC

moralestapia wrote: post #28

Every serious project I engage on has its own: * domain (obviously) * emails also for every provider I have a different email like (google@domain, twilio@domain, etc...) * credit cards (my bank makes it super easy to just create new ones) * phone no. (I just buy a burner phone) It's a bit of a PITA but the benefits outweigh the cons. I have a clear understanding of how much each of them costs me, for instance. Plus,…

For phone, what are your thoughts on something like Google Voice instead?

For emails, how do you handle email? Outlook/Google Workspace? Something else?

Re: Have lots of AWS accounts

#36

Post by traspler » Mon, Oct 03, 2022, 6:36 PM UTC

Havoc wrote: post #9

Isn’t that against terms since it activates a free tier credit?

Multi Account is a normal pattern for AWS. They even have tools to handle that better like AWS Control Tower. Someone from AWS we talked to even mentioned it as a perk (to get the free tier on every account).

Re: Have lots of AWS accounts

#37

Post by jackconsidine » Mon, Oct 03, 2022, 6:36 PM UTC

simonw wrote: post #34

jackconsidine wrote: post #24

I have indeed found that it's difficult to silo access to specific resources with AWS IAM. I use these custom policies a lot, which give write access to a specific S3 Bucket [0], and give sending capabilities for a specific SES Identity [1] respectively: [0] https://koptional.notion.site/IAM-Policy-for-select-S3-Acces... [1] https://koptional.notion.site/IAM-Policy-for-email-sending-o...

I ended up writing a whole custom tool for generating credentials and policies for specific S3 buckets: - https://s3-credentials.readthedocs.io/ - https://simonwillison.net/2021/Nov/3/s3-credentials/ - https://simonwillison.net/2022/Jan/18/weeknotes/

Whoa this is awesome! Wish I knew about this. It's really polished

Re: Have lots of AWS accounts

#38

Post by gw99 » Mon, Oct 03, 2022, 6:37 PM UTC

I disagree with this perspective. You should have multiple accounts but only if your organisation requires it for isolation or data protection reasons and only enough to perform the task.

Every other reason here is because you fucked up. You have poor architecture, poor tagging, poor VPC design, poor IAM policy and role modelling or don't know what you are doing to start with. And some of the stuff doesn't even make sense, particularly the point about EKS upgrades (I run three different versions of EKS in the same account).

There are many negative effects of multiple accounts including billing aggregation is very difficult, having to dig through several accounts worth of Cloudwatch logs, unexpected egress traffic costs and the overall complexity is much higher. If you have to switch to an org account and set up SSO you then have an administrative cost which is immense.

My favourite thing doing is spending 2 days opening support tickets in 10 different accounts to get a limit raised and then tracking the state of all the tickets and limit changes...

Re: Have lots of AWS accounts

#39

Post by GauntletWizard » Mon, Oct 03, 2022, 6:40 PM UTC

dijit wrote: post #3

One of the things I love most about google cloud is that "projects" are easy to create and easy to link to other projects. Roles and service accounts can even reference across projects, though I'm not sure I'd recommend doing that. No more faffing about with special accounts, passwords and difficult to configure shared VPCs, it all becomes so easy. Even managing the different accounts is difficult without browser ext…

One reason to have your roles and service accounts reference cross-project is to give your CI builder access to your artifacts project; Have your prod and dev environments use containers from a third account that serves only as an archive of your build artifacts.

Re: Have lots of AWS accounts

#40

Post by traspler » Mon, Oct 03, 2022, 6:42 PM UTC

At the company I work they just built their „Landing Zone“ as AWS calls it with all the on-prem connectivity, shared VPCs, Product Catalogs, IAM restrictions to the moon and so on and every team gets their own account linked to that one. It‘s an enormous amount of work to get all of that to work nicely together but when it works it‘s very nice and allows for a great way to partition responsibilities. For smaller deployments I think you will be in a mess pretty fast when you start doing cross-account things without enough planning ahead. But per-project accounts? Sure!