Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS in 2025: Stuff you think you know that's now wrong

lastweekinaws.com

Post reply on HN
Print view View original

81–90 of 284 posts

Re: AWS in 2025: Stuff you think you know that's now wrong

#81

Post by JCM9 »

Some good stuff here. I wish AWS would just focus on these boring, but ultimately important, things that they’re good at instead of all the current distractions trying to play catch up on “AI.” AWS leadership missed the boat there big time, but that’s OK.

Ultimately AWS doesn’t have the right leadership or talent to be good at GenAI, but they do (or at least used to) have decent core engineers. I’d like to see them get back to basics and focus there. Right now leadership seems panicked about GenAI and is just throwing random stuff at the wall desperately trying to get something to stick. Thats really annoying to customers.

Re: AWS in 2025: Stuff you think you know that's now wrong

#82

Post by otterley »

JoshTriplett wrote: post #78
otterley wrote: post #33

Earlier quoted context omitted.

Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free. S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access. (Disclaimer: I work for AWS, opinions are my own.)

That's fascinating! I hadn't found that in the documentation; everything seems to steer people towards PrivateLink, not gateway endpoints. Would you recommend using VPC Gateway even on a public VPC that has an Internet gateway (note: not a NAT gateway)? Or only on a private VPC or one with a NAT gateway?

I recommend S3 Gateways for all VPCs that need to access S3, even those that already have routes to the Internet. Plus they eliminate the need for NAT Gateway traversal for requests that originate from private subnets.

Re: AWS in 2025: Stuff you think you know that's now wrong

#83

Post by bob1029 »

simonw wrote: post #76
bob1029 wrote: post #69

Earlier quoted context omitted.

I am also assuming that Amazon intends for the Deep Archive tier to be a profitable offering. At $0.00099/gb-month, I don't see how it could be anything other than tape.

I wonder if it's where old S3 hard drives go to die? Presumably AWS have the world's single largest collection of used storage devices - if you RAID them up you can probably get reliable performance out of them for Glacier?

I still don't know if it's possible to make it profitable with old drives in this kind of arrangement, especially if we intend to hit their crazy durability figures. The cost of keeping drives spinning is low, but is double-digit margin % in this context. You can't leave drives unpowered in a warehouse for years on end and say you have 11+ nines of durability.

Re: AWS in 2025: Stuff you think you know that's now wrong

#84

Post by torginus »

SOLAR_FIELDS wrote: post #4

You know what's still stupid? That if you have an S3 bucket in the same region as your VPC that you will get billed on your NAT Gateway to send data out to the public internet and right back in to the same datacenter. There is simply no reason to not default that behavior to opt out vs opt in (via a VPC endpoint) beyond AWS profiting off of people's lack of knowledge in this realm. The amount of people who would want…

If you had an ALB inside the VPC that routed the requests to something that lives inside the VPC, which called the AWS PutObject api on the bucket, would that still be the case?

Re: AWS in 2025: Stuff you think you know that's now wrong

#85

Post by lijok »

simonw wrote: post #76
bob1029 wrote: post #69

Earlier quoted context omitted.

I am also assuming that Amazon intends for the Deep Archive tier to be a profitable offering. At $0.00099/gb-month, I don't see how it could be anything other than tape.

I wonder if it's where old S3 hard drives go to die? Presumably AWS have the world's single largest collection of used storage devices - if you RAID them up you can probably get reliable performance out of them for Glacier?

You don’t raid old drives as it creates cascading failures because recovering from a failed drive adds major wear to other drives

Re: AWS in 2025: Stuff you think you know that's now wrong

#86

Post by themafia »

nodesocket wrote: post #58

I'll add: When doing instance to instance communication (in the same AZ) always use private ips. If you use public ip routing (even the same AZ) this is charged as regional data transfer. Even worse, if you run self hosted NAT instance(s) don't use a EIP attached to them. Just use a auto-assigned public IP (no EIP). NAT instance with EIP - AWS routes it through the public AWS network infrastructure (hairpinning). - Y…

> You get charged $0.01/GB regional data transfer, even if in the same AZ.

My understanding is that transfer gets charged on both sides as well. So if you own both sides you'll pay $0.02/GB.

Re: AWS in 2025: Stuff you think you know that's now wrong

#87

Post by SOLAR_FIELDS »

otterley wrote: post #59
SOLAR_FIELDS wrote: post #44

Earlier quoted context omitted.

The problem is that the default behavior for this is opt-in, rather than opt-out. No one prefers opt-in. So why is it opt-in?

AWS VPCs are secure by default, which means no traffic traverses their boundaries unless you intentionally enable it.

"The door is locked, so instead of suggesting to the end user that they should unlock the door with this key that we know how to give the end user deterministically, we instead tell them to drive across town and back on our toll roads and collect money from it"

This has been a common gotcha for over a decade now: https://www.lastweekinaws.com/blog/the-aws-managed-nat-gatew...

Re: AWS in 2025: Stuff you think you know that's now wrong

#88

Post by hylaride »

darkwater wrote: post #45
otterley wrote: post #32

Earlier quoted context omitted.

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo... (Disclaimer: I work for AWS, opinions are my own.)

I think they know it. They are complaining it's not enabled by default (and so do I).

As others have pointed out, this is by design. If VPCs have access to AWS resources (such as S3, DynamoDB, etc), an otherwise locked down VPC can still have data leaks to those services, including to other AWS accounts.

It's a convenience VS security argument, though the documentation could be better (including via AWS recommended settings if it sees you using S3).

Re: AWS in 2025: Stuff you think you know that's now wrong

#89

Post by icedchai »

SOLAR_FIELDS wrote: post #44
otterley wrote: post #32

Earlier quoted context omitted.

This is the intended use case for S3 VPC Gateway Endpoints, which are free of charge. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo... (Disclaimer: I work for AWS, opinions are my own.)

The problem is that the default behavior for this is opt-in, rather than opt-out. No one prefers opt-in. So why is it opt-in?

If it were opt-out someone would accidentally leave it on and eventually realize that entire systems had been accidentally "backed up" and exfiltrated to S3.
Post reply on HN