Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An AWS account just for getting into other AWS accounts

src-bin.com

Post reply on HN
Print view View original

71–80 of 109 posts

Re: An AWS account just for getting into other AWS accounts

#71

Post by Octabrain »

icedchai wrote: post #19
jagged-chisel wrote: post #12

Earlier quoted context omitted.

Is this humor? I honestly can’t tell.

It's tough to say. The last company I worked for (a self-described "unicorn") literally used one AWS account for everything: dev, test, and prod.

Same in the previous company I worked for. All in one account, spending millions of dolards on it, terrible architecture. From the top of my head: Unecessary peerings everywhere, bad subnet configuration that provoked network conflicts in certain cases, no autoscaling, IAM access based exclusively on keys, no VPN etc And if that wasn't enough, everything was "done" with one of the most terrible examples of "automation" I've ever seen in my whole life: A huge Terraform mono repo with hundreds of files with hundreds of duplicated resource calls (because they didn't even use modules). It took them at least a week for just adding a simple IAM user without breaking anything else and the CD would take hours to finish. An absolute nightmare. As no one else in the company had experience with the cloud, the team managing all I mention was threated as some kind of supreme elite as everyone else though they were doing a great job. Beyond me.

Re: An AWS account just for getting into other AWS accounts

#72

Post by Hikikomori »

diceduckmonk wrote: post #37

What tool do people here use to search across AWS accounts? Disclaimer: we are building a search engine to search for resources across “workspaces”. In AWS, this unit is the Account. In GCP, this unit is the Project.

Python, multiprocessing and boto3 with assume role.

1000+ accounts takes a few minutes.

Re: An AWS account just for getting into other AWS accounts

#73

Post by tedk-42 »

These type of articles make me wanna quit doing anything in IT.

It's not a criticism of the author, more the current state of technology in AWS.

I'd really like to have just 1 AWS account where I can see and do everything there and not keep switching and think about account IDs or which account has what S3 bucket/server whatever.

Re: An AWS account just for getting into other AWS accounts

#75

Post by albert_e »

> Don’t do this! Any principal in your management account, by default, is able to assume the OrganizationAccountAccessRole in each and every one of the accounts created using the organizations:CreateAccount API.

I should note that if you use AWS Control Tower Account Factory to create the member accounts then this role does not get created.

The "Audit" account that is created by Control Tower is probably the best one to serve as the Administrative Access Account

Re: An AWS account just for getting into other AWS accounts

#76

Post by throwawaaarrgh »

scarface74 wrote: post #50
throwawaaarrgh wrote: post #46

Earlier quoted context omitted.

Last I recall, SSMSM gives users root or ec2-user access on the instance? Or does it create new users?

I haven’t thought about this. But I did find this. https://medium.com/@unruly_mood/aws-ssm-sessions-root-non-ro...

So this is the basic problem: it doesn't give strong isolation for many users. Something like goteleport.com is better if you need lots of people to remote into random machines.

Re: An AWS account just for getting into other AWS accounts

#77

Post by deadbunny »

tedk-42 wrote: post #73

These type of articles make me wanna quit doing anything in IT. It's not a criticism of the author, more the current state of technology in AWS. I'd really like to have just 1 AWS account where I can see and do everything there and not keep switching and think about account IDs or which account has what S3 bucket/server whatever.

The really frustrating things is that while AWS make the "Account" their best isolation layer they make managing those accounts with their tooling absolutely awful.

Re: An AWS account just for getting into other AWS accounts

#78

Post by marginalia_nu »

raffraffraff wrote: post #67
datalopers wrote: post #34

Earlier quoted context omitted.

A lot of us are busy solving business needs in smaller companies/startups and don't have the time nor expertise to learn every single AWS service and come up with a justification for utilizing it.

I understand your frustrations with AWS, and I get that solutions for enterprises don't always work for smaller companies, but when someone describes a solution that reduces operational complexity while increasing security, they should get thanks. It's not their fault that AWS has too many services.

I think this is very important and generally poorly understood:

Scaling problems exist both up and down.

In exactly the same way there are solutions that work well in the small but become disproportionately expensive when you scale them up, there are solutions that are cost-effective on a large scale that become prohibitively expensive on a smaller scale.

The latter category includes a large chunk of enterprise-y cloud solutions.

Re: An AWS account just for getting into other AWS accounts

#80

Post by canucklady »

tedk-42 wrote: post #73

These type of articles make me wanna quit doing anything in IT. It's not a criticism of the author, more the current state of technology in AWS. I'd really like to have just 1 AWS account where I can see and do everything there and not keep switching and think about account IDs or which account has what S3 bucket/server whatever.

Same. My current company has the same problem, which is that they continually layer additional complexity onto their previous architectural mistakes to try and mitigate them. This results in a complicated system where different independent parts all interact with each other like a rube goldberg machine. The dynamics of the resulting system become sort of perilous and unknowable, and it paralyzes future changes because nobody can predict the nth order effects.
Post reply on HN