I returned to AWS and was reminded why I left • Hacker News Board

Re: I returned to AWS and was reminded why I left

#681

Post by niutech » Tue, May 19, 2026, 8:11 AM UTC

throwaway2037 wrote: post #575

AJRF wrote: post #572

AWS / GCP / Azure aren't for individuals or small businesses. They won't tell you this anywhere, and they won't stop you from signing up - but they simply do not care one iota about users with anything less than $100k billing per month. They treat big account owners like kings, they fly them out to Formula 1 events, they get 3 day workshops in swanky retreats, because a few k spent on this equals maybe millions of do…

All good points. What do you recommend for the "small potatoes"?

OVH - they are cheaper than AWS and bound by the EU privacy law (GDPR).

Re: I returned to AWS and was reminded why I left

#682

Post by neves » Tue, May 19, 2026, 12:29 PM UTC

tedivm wrote: post #13

> AWS stomped on open source projects - despite the clear desire of projects like Elasticsearch, Redis, and MongoDB not to be cloned and monetized, AWS pushed ahead with OpenSearch, Valkey, and DocumentDB anyway, capturing the hosted-service money after those communities and companies had built the markets; the result was a wave of defensive licenses like SSPL, Elastic License, RSAL, and other source-available models…

As an user, this is what really annoys me:

Crazy sneaky complex billing in which they hit you for data movement within their own systems, double billing you and sometimes triple billing you. Billing footguns and traps are everywhere - you must be a deep expert to avoid them.

IAM - the hideously complex auth and access rules system - this was invented by Lucifer sitting on his burning throne in the ninth level of Hell as the worst possible torment for those who have been sent below for using AWS.

Re: I returned to AWS and was reminded why I left

#683

Post by jtoberon » Wed, May 20, 2026, 1:43 PM UTC

amluto wrote: post #515

Aperocky wrote: post #504

Earlier quoted context omitted.

They are just some slight variation of the fundamental idea. For example resource policy and org SCP are just the same check on a different level (e.g. more of who has access to what). They are attached to Organization and individual resource respectively (vs Account) so they need to exist in a separate place. And then in use they are ALL checked before an access is granted. I don't work for IAM but I worked for seve…

> And then in use they are ALL checked before an access is granted. I know they’re all checked. What don’t know is how the results of those checks are combined to get the final result. As far as I can tell, the result is not something like OR or AND — it seems like it’s something exceedingly complex and that the output of the policy part may be more complex than just a Boolean value. Maybe the underlying implementati…

The output is Allow or Deny. To be Allowed, you need an policy that includes an Allow statement. If you don't have one, then the result is implicit Deny by default. Also, any explicit Deny wins over all Allows. Disclosure: I work on AWS IAM.

Re: I returned to AWS and was reminded why I left

#684

Post by calmbonsai » Thu, May 21, 2026, 12:42 AM UTC

alasano wrote: post #462

calmbonsai wrote: post #415

The AWS UI should be, effectively, read-only for any infrastructure aside from setting up some initial roles and perms to manage all of it through an IAC system. Put more bluntly, if you're using the AWS Console to spin-up/spin-down service instances you're doing it wrong .

I've never enjoyed AWS more than with LLMs managing infra as code through sst.dev

Try Terraform or CDK. I like Terraform scales better, but there are some real foot-gun gotchas with it. You do need "depends_on" https://developer.hashicorp.com/terraform/language/meta-argu... for efficient large-scale deployments and certain networking situations, it's also really awkward with high-level AWS abstractions such as Organizations, but otherwise solid tech.

CDK (atm) as limitations and it's also got a more imperative model. It's touted as being more familiar as it has multiple language support, but I don't think shoehorning declarative context into imperative languages works well.