Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I returned to AWS and was reminded why I left

fourlightyears.blogspot.com

Post reply on HN
Print view View original

531–540 of 684 posts

Re: I returned to AWS and was reminded why I left

#531

Post by bkaraaslan »

Aperocky wrote: post #275
raffraffraff wrote: post #248

I always smile at posts like this. They're right and wrong at the same time. Systems should be "as simple as possible, but no simpler". And thinking that you can gloss over the detail is just going to create more hassle later on. IAM is just complex. I can't think of any implementation of "users, groups, roles, policies, identity providers, oidc" that is truly simple. I'm reminded of a guy I worked with, who fought a…

Some internal perspective - IAM has maybe thousands of options but fundamentally it is "what does this role have access to doing (action + resource)" + "who has access to this role". That is really it from a 10k foot level. IAM is great because it applies internally just like it does externally. The internal AWS team don't get more access than you do, and if we get access to do certain thing on your account to perfor…

One thing i would like to see in IAM would be sonething like verb actions, currently, if you want to give least privilage, you have to trial and error your api call until you get it right. Since aws have a very good api definition on all consumers (rest, aws-cli, boto uses same strucyure), i think it would be doable.

I mean something like actions: s3:cp Resource: bucketarn/key

Most of the time, actions are self explanatory and good enough, but i recently gave a developer permission to scale an asg, and it required a lot of unguessable actions, if i were to give "actions: scale" (forgot the correct cli parameter for it), it would make more clean env

Re: I returned to AWS and was reminded why I left

#532

Post by stiray »

Amazon is bad at their blocking of accounts. They blocked mine for no reason (want me to call some USA phone number which I wont) a few years back and I was writing down everything that I would buy at their store, but I bought it elsewhere.

They have lost 3785.90 euros in sales due to their idiotic anti-user war.

Not to mention of all bad reputation that I gave them.

Re: I returned to AWS and was reminded why I left

#533

Post by zsoltkacsandi »

Demiurge wrote: post #398
zsoltkacsandi wrote: post #364

Earlier quoted context omitted.

Interesting to see that some people assumed there are no kill-switch mechanism, and when it turns out they just did not know about it, the (totally valid and factful) comment gets downvoted because it is against their initial assumption. Not what I would have expected on a professional forum.

I do not downvote comments when I disagree, and I think it’s better to explain why I would strongly disagree. Downvoting in this case almost reinforces the notion that the downvoted comment makes such a good point that it causes people to give up on the discourse and just smash the panic downvote button. It’s obvious to me why this is not the case for this comment. The suggestion to setup some kind of IAM policy to s…

> The suggestion to setup some kind of IAM policy to shut things down and stop resource usage is insanely complicated for users who need this kind of feature the most.

We set this up at my last job like in 10 minutes. Complexity is a matter of perspective, and if your job to do this, you have done this many-many times, and you have ready to use infrastructure as code templates.

Yes, AWS is massive, the documentation is huge and makes things inherently complex, but flexible too. You can define what behavior do you want when you exceed your limits. We can argue whether this is obfuscation or complexity or what, but based on my experience AWS optimizes it's product for enterprise-ish companies, that can afford to have SREs who knows exactly what to do in such cases. That is where they have their own training/certification program. For simple use cases there is AWS Lightsail where pricing is simple and easy to understand.

But even if it would be insanely complicated, that is a reason to downvote? HN used to be better than this kind of "I don't like your comment, let's downvote it".

Re: I returned to AWS and was reminded why I left

#534

Post by padjo »

Galanwe wrote: post #324

These arguments against AWS are boring. 99% of the negative comments are along the line of "so i have a dead simple product, I dont know anything about AWS, I logged in and it was super complicated and it seemed pricey". Well guess what, if you have a CRUD website and 100 users you're just not the target. Move on. Some days ago I wanted to sketch a 3D model of my TV remote. I opened blender and what a mess of complic…

But that's not what this article is? The author is clearly a long time AWS user and former evangelist who has soured on it as it has become increasingly bloated.

Re: I returned to AWS and was reminded why I left

#535

Post by pentacent_hq »

lmm wrote: post #506
rpdillon wrote: post #50

Earlier quoted context omitted.

They have a problem with their business model, then. License changes to a formerly open source project are costly. The community reacts very strongly when license terms change after they've come to depend on a product, and they should. Why do we apply this standard to MongoDB but not to Apache, Linux, Postgres, or MariaDB? One purpose of an open source license is to allow many providers to provide the service. As I'v…

Selling support/services as the maintainer of an open-source service was never a hard-nosed business proposition in the first place. It's like Amazon undercutting your fire station's bake sale.

This is such a good analogy, thank you!

Re: I returned to AWS and was reminded why I left

#537

Post by cryo32 »

layoric wrote: post #481
cryo32 wrote: post #396

Earlier quoted context omitted.

If you have a lot of data it's cheaper to lease a Direct Connect line into an AWS zone and suck it out through that.

I might be reading the pricing wrong but you have to pay per hour for the port plus per GB transfer? And looks like the cheapest is $0.02 per GB? Is that really the 'cheap' option? That looks fine for a TB or two, but still crazy when getting closer to PBs.

You do but you can actually negotiate discounts with AWS when you get to Direct Connect level. It's only cheaper than the other options. It's never acceptable.

This is why we're slowly and quietly moving back to a couple of cages in a DC. Well we were until the AI companies bought all the fuck RAM and SSDs.

Re: I returned to AWS and was reminded why I left

#538

Post by pseudohadamard »

hedora wrote: post #323
raffraffraff wrote: post #248

I always smile at posts like this. They're right and wrong at the same time. Systems should be "as simple as possible, but no simpler". And thinking that you can gloss over the detail is just going to create more hassle later on. IAM is just complex. I can't think of any implementation of "users, groups, roles, policies, identity providers, oidc" that is truly simple. I'm reminded of a guy I worked with, who fought a…

IAM is unnecessarily bad. I recently had to set a trivial policy, and was doing it correctly. The console kept warning me that I was giving root AWS access to my external application because they want people to use the locked in AWS path, and I was running off cloud. On top of that, they break copy paste on the web console, so you can’t just ctrl-c ctrl-v and then ask Claude to explain their WTF-ery. Instead, you hav…

Agreed on IAM, and TFAs comments that once you see the horrendous complexity in IAM you start seeing it everywhere else in AWS as well. And with IAM, after all the effort you've put in, you can never really tell what is and isn't enabled. If you run your own server you can check permissions, run access-control audit scripts, and so on, and say with a pretty good level of confidence that X is possible and Y isn't. With IAM it's more like "I'm pretty sure I figured out the right silly-walk for X, but I have no way to tell what else might be enabled".

AWS: I came, I saw, I threw up in my mouth a little, I left.

Re: I returned to AWS and was reminded why I left

#539

Post by cryo32 »

tacticus wrote: post #487
cryo32 wrote: post #401

Earlier quoted context omitted.

Nope. We have an incredibly complicated product, a bunch of actual experts and paid up high level enterprise support. It is about 8x more expensive to run it on AWS than it was on actual hardware. And that's using their reference architecture and designs. And the sprawling nature of AWS services and uptake makes it pretty damn hard to get out. We are slowly and quietly migrating everyting to IaaS / kubernetes so we c…

> Edit: also fuck things like Lambda. It's literally the most horrible experience that the universe can muster. Moved most of our lambdas to simple boring http services on top of Go and just leave 20 instances running. Just not having to deal with CloudWatch saved us more money than Lambda could have. imagine if instead of being a tied in to aws special interfaces lambda had shown up as closer to cloud run! Though ho…

It'd still suck compared to a completely boring process you can just run on your desktop by ./'ing the executable and looking at the console output. Then chuck it in kubernetes as a ReplicaSet.

Re: I returned to AWS and was reminded why I left

#540

Post by pseudohadamard »

ray_v wrote: post #416
Galanwe wrote: post #324

These arguments against AWS are boring. 99% of the negative comments are along the line of "so i have a dead simple product, I dont know anything about AWS, I logged in and it was super complicated and it seemed pricey". Well guess what, if you have a CRUD website and 100 users you're just not the target. Move on. Some days ago I wanted to sketch a 3D model of my TV remote. I opened blender and what a mess of complic…

Did blender charge you thousands of dollars when you touched it wrong when you tried to learn to use it? /s

> Did blender charge you thousands of dollars when you touched it wrong

No, but it did press charges. We settled out of court, but my wife left me over the whole affair.

Post reply on HN