Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS in 2025: Stuff you think you know that's now wrong

lastweekinaws.com

Post reply on HN
Print view View original

51–60 of 284 posts

Re: AWS in 2025: Stuff you think you know that's now wrong

#51

Post by sylens »

simonw wrote: post #7

S3: "Block Public Access is now enabled by default on new buckets." On the one hand, this is obviously the right decision. The number of giant data breeches caused by incorrectly configured S3 buckets is enormous. But... every year or so I find myself wanting to create an S3 bucket with public read access to I can serve files out of it. And every time I need to do that I find something has changed and my old recipe d…

The thing to keep in mind with the "Block Public Access" setting is that is a redundancy built in to save people from making really big mistakes.

Even if you have a terrible and permissive bucket policy or ACLs (legacy but still around) configured for the S3 bucket, if you have Block Public Access turned on - it won't matter. It still won't allow public access to the objects within.

If you turn it off but you have a well scoped and ironclad bucket policy - you're still good! The bucket policy will dictate who, if anyone, has access. Of course, you have to make sure nobody inadvertantly modifies that bucket policy over time, or adds an IAM role with access, or modifies the trust policy for an existing IAM role that has access, and so on.

Re: AWS in 2025: Stuff you think you know that's now wrong

#52

Post by otterley »

darkwater wrote: post #45
otterley wrote: post #32

Earlier quoted context omitted.

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo... (Disclaimer: I work for AWS, opinions are my own.)

I think they know it. They are complaining it's not enabled by default (and so do I).

AWS VPCs are secure by default, which means no traffic traverses their boundaries unless you intentionally enable it.

There are many IaC libraries, including the standard CloudFormation VPC template and CDK VPC class, that can create them automatically if you so choose. I suspect the same is also true of commonly-used Terraform templates.

Re: AWS in 2025: Stuff you think you know that's now wrong

#53

Post by hnlmorg »

crinkly wrote: post #38
simonw wrote: post #7

S3: "Block Public Access is now enabled by default on new buckets." On the one hand, this is obviously the right decision. The number of giant data breeches caused by incorrectly configured S3 buckets is enormous. But... every year or so I find myself wanting to create an S3 bucket with public read access to I can serve files out of it. And every time I need to do that I find something has changed and my old recipe d…

I just stick CloudFront in front of those buckets. You don't need to expose the bucket at all then and can point it at a canonical hostname in your DNS.

That’s definitely the “correct” way of doing things if you’re writing infra professionally. But I do also get that more casual users might prefer not to incur the additional costs nor complexity of having CloudFront in front. Though at that point, one could reasonably ask if S3 is the right choice for causal users.

Re: AWS in 2025: Stuff you think you know that's now wrong

#54

Post by hinkley »

otterley wrote: post #32
SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo... (Disclaimer: I work for AWS, opinions are my own.)

Your job depends upon you misunderstanding the problem.

Re: AWS in 2025: Stuff you think you know that's now wrong

#57

Post by hinkley »

amenghra wrote: post #29
nbngeorcjhe wrote: post #24

Earlier quoted context omitted.

> People who are price insensitive will not invest the time to fix it This just sounds like a polite way of saying "we're taking peoples' money in exchange for nothing of value, and we can get away with it because they don't know any better".

Price segmentation happens all the time in pretty much every industry.

There’s an entire Pandora’s box of shitty things that happen in pretty much every industry. I don’t think you want to use that defense.

Re: AWS in 2025: Stuff you think you know that's now wrong

#58

Post by nodesocket »

I'll add: When doing instance to instance communication (in the same AZ) always use private ips. If you use public ip routing (even the same AZ) this is charged as regional data transfer.

Even worse, if you run self hosted NAT instance(s) don't use a EIP attached to them. Just use a auto-assigned public IP (no EIP).

  NAT instance with EIP
    - AWS routes it through the public AWS network infrastructure (hairpinning).
    - You get charged $0.01/GB regional data transfer, even if in the same AZ.

  NAT instance with auto-assigned public IP (no EIP)
    - Traffic routes through the NAT instance’s private IP, not its public IP.
    - No regional data transfer fee — because all traffic stays within the private VPC network.
    - auto-assigned public IP may change if the instance is shutdown or re-created so have automations to handle that. Though you should be using the network interface ID reference in your VPC routing tables.

Re: AWS in 2025: Stuff you think you know that's now wrong

#59

Post by otterley »

SOLAR_FIELDS wrote: post #44
otterley wrote: post #32

Earlier quoted context omitted.

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo... (Disclaimer: I work for AWS, opinions are my own.)

The problem is that the default behavior for this is opt-in, rather than opt-out. No one prefers opt-in. So why is it opt-in?

AWS VPCs are secure by default, which means no traffic traverses their boundaries unless you intentionally enable it.

Re: AWS in 2025: Stuff you think you know that's now wrong

#60

Post by hinkley »

bob1029 wrote: post #25

> Glacier restores are also no longer painfully slow. Wouldn't this always depend on the length of the queue to access the robotic tape library? Once your tape is loaded it should move really quickly: https://www.ibm.com/docs/en/ts4500-tape-library?topic=perfor...

> Once upon a time Glacier was its own service that had nothing to do with S3. If you look closely (hi, billing data!) you can see vestiges of how this used to be, before the S3 team absorbed it as a series of storage classes.

Your assumption holds if they still use tape. But this paragraph hints at it not being tape anymore. The eternal battle between tape versus drive backup takes another turn.

Post reply on HN