Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Control Tower

aws.amazon.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: AWS Control Tower

#41

Post by [deleted] »

marcinzm wrote: post #38
kousikk wrote: post #35

Earlier quoted context omitted.

(Assuming no malicious intent from AWS) One of the reasons this is probably hard is probably because a lot of services didn't start out with having resource constraints. So now if you support something like a "hard-billing-cap", every single service in AWS has to support it. That's a huge stone to move - it could even be in the works today.

There's also no good way for most services to support it since storing data costs money and presumably you don't want AWS to wipe your data when you hit your spending cap.

[deleted]

Re: AWS Control Tower

#42

Post by manigandham »

privateSFacct wrote: post #34
manigandham wrote: post #29

Earlier quoted context omitted.

This is like most other AWS products that end up being an automated bunch of scripts that wire up functionality for you rather than being a full-fledged product. GCP organizations, folders, projects, and IAM system is far better than anything in AWS or Azure.

I find this aspect of aws annoying - it can be hard to cleanup after these products - they litter service accounts and templates everywhere. I tried gcp very early on and struggled to get IAM granularity but perhaps it has improved

As of now, GCP has some updated (more fine-grained) permissions, custom roles and has cleaned up how service accounts are created and used by GCP services. Using orgs/projects to cascade the correct permissions is now much easier.

AWS IAM can still give you more advanced rules but is just hard to manage, especially across lots of accounts.

Re: AWS Control Tower

#43

Post by s14ve »

thomasedwards wrote: post #30

Just tried it on our master account: > You tried to use an account that is a member of an organization in AWS Organizations. To set up your AWS Control Tower landing zone, use an account that is not a member of an organization. Looks like it’s only feasible if you’re starting from scratch.

Have you managed to get it working in the end? I've encountered the same issue.

Re: AWS Control Tower

#44

Post by cthalupa »

argd678 wrote: post #40
marcinzm wrote: post #37

Earlier quoted context omitted.

How would hard limits work? Do all your ec2 instances shut down? Do your s3 buckets and their data get deleted? Do you snapshots and EBS volumes get deleted? There's no way to pause these things since they still costs AWS money.

You don’t let people start up the service if it will exceed a cost quota. For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance, but yeah other usage based services like s3 and network traffic that won’t work.

>but yeah other usage based services like s3 and network traffic that won’t work.

I think this is the major problem. It's conceptually easy to say 'Yeah no more spinning up ec2 instances' or whatever, but the only way to deal with hitting that cap for things like network traffic or storage services is just turning off network access or deleting the files. I can't imagine many businesses are going to go for "hey if you set a cap and you exceed it we fix it by deleting your stuff and taking down network availability." - that's going to be a total nonstarter in so many situations! But that's what would be required to actually set a spending cap on an account.

That sort of decision really needs to be made by a human as it's happening - is the spike in usage legitimate? Is it your customers driving the demand? Is it unwanted traffic? Is it an autoscaling group gone wrong? etc. etc. etc.

My suggestion is setting up CW billing alarms at several thresholds, to try and stay ahead of this before it reaches that point, with paging on the highest threshold where it's about at the point where you'd consider turning things off. Then you should hopefully be able to take care of unexpected expenses before they're problematic, but also ready to engage someone to make the tough decisions instead of just automatically taking yourself down.

Re: AWS Control Tower

#45

Post by marcinzm »

argd678 wrote: post #40
marcinzm wrote: post #37

Earlier quoted context omitted.

How would hard limits work? Do all your ec2 instances shut down? Do your s3 buckets and their data get deleted? Do you snapshots and EBS volumes get deleted? There's no way to pause these things since they still costs AWS money.

You don’t let people start up the service if it will exceed a cost quota. For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance, but yeah other usage based services like s3 and network traffic that won’t work.

> For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance,

Only if you don't use auto-scaling of any kind and you can already set up budgets which will alert you if your usage is expected to go above some thresholds.

Re: AWS Control Tower

#46

Post by privateSFacct »

manigandham wrote: post #42
privateSFacct wrote: post #34

Earlier quoted context omitted.

I find this aspect of aws annoying - it can be hard to cleanup after these products - they litter service accounts and templates everywhere. I tried gcp very early on and struggled to get IAM granularity but perhaps it has improved

As of now, GCP has some updated (more fine-grained) permissions, custom roles and has cleaned up how service accounts are created and used by GCP services. Using orgs/projects to cascade the correct permissions is now much easier. AWS IAM can still give you more advanced rules but is just hard to manage, especially across lots of accounts.

I'll try GCP out again. Their App Engine runtimes also look to have been updated. I use AWS Fargate and like letting someone else worry about some of the nuts and bolts.

Re: AWS Control Tower

#47

Post by dvfjsdhgfv »

marcinzm wrote: post #37
dvfjsdhgfv wrote: post #31

Thank you AWS. In the meantime, if you could offer me just one basic setting that users have been asking for years (hard limit on your spending), it would be even better.

How would hard limits work? Do all your ec2 instances shut down? Do your s3 buckets and their data get deleted? Do you snapshots and EBS volumes get deleted? There's no way to pause these things since they still costs AWS money.

If AWS can't figure out the answers to these questions by themselves, maybe they should ask Microsoft as they implemented it in Azure a long time ago.

Re: AWS Control Tower

#48

Post by dvfjsdhgfv »

cthalupa wrote: post #44
argd678 wrote: post #40

Earlier quoted context omitted.

You don’t let people start up the service if it will exceed a cost quota. For ec2 that should be easy since the cost ticks at a constant rate and can be extrapolated in advance, but yeah other usage based services like s3 and network traffic that won’t work.

>but yeah other usage based services like s3 and network traffic that won’t work. I think this is the major problem. It's conceptually easy to say 'Yeah no more spinning up ec2 instances' or whatever, but the only way to deal with hitting that cap for things like network traffic or storage services is just turning off network access or deleting the files. I can't imagine many businesses are going to go for "hey if yo…

> But that's what would be required to actually set a spending cap on an account.

Nevertheless, that's exactly what people have been asking for several years. See this thread for example (and many others): https://forums.aws.amazon.com/thread.jspa?threadID=58127&sta...

Re: AWS Control Tower

#49

Post by marcinzm »

dvfjsdhgfv wrote: post #48
cthalupa wrote: post #44

Earlier quoted context omitted.

>but yeah other usage based services like s3 and network traffic that won’t work. I think this is the major problem. It's conceptually easy to say 'Yeah no more spinning up ec2 instances' or whatever, but the only way to deal with hitting that cap for things like network traffic or storage services is just turning off network access or deleting the files. I can't imagine many businesses are going to go for "hey if yo…

> But that's what would be required to actually set a spending cap on an account. Nevertheless, that's exactly what people have been asking for several years. See this thread for example (and many others): https://forums.aws.amazon.com/thread.jspa?threadID=58127&sta...

Not really, that thread is asking for a limit on S3 traffic serving (ie: bandwidth used). That doesn't cap the account spend nor does it delete data (and you will continue to be charged for data storage, requests, etc.).

The thread has a limited and reasonable request which is totally separate from account spend limits.

Re: AWS Control Tower

#50

Post by thomasedwards »

s14ve wrote: post #43
thomasedwards wrote: post #30

Just tried it on our master account: > You tried to use an account that is a member of an organization in AWS Organizations. To set up your AWS Control Tower landing zone, use an account that is not a member of an organization. Looks like it’s only feasible if you’re starting from scratch.

Have you managed to get it working in the end? I've encountered the same issue.

No stopped trying – I’m not too worried as I have a Firefox Containers setup to switch between all the accounts.
Post reply on HN