A few guesses:

a. It just works. No need to download and configure the right version of the SDK.

b. Does not timeout when you close your laptop [I hope!].

c. I works on a Chromebook. Possibly not something you care about, but a historical pain point for the consistency of Google offerings.

a. Which SDK? You mean the ssh client? b. Any custom software is wiped from your account in about an hour, though. Also an SSH re-connect is not that big a deal, IMO. c. There are SSH client Chrome Apps

I guess I still don't see the point but maybe I'm assuming that one is already running a *nix and can either jump into the terminal there or connect a VM in the cloud very easily. The convenience doesn't seem that large.

For B, unless something is actively running it will presumably just freeze the instance and restart it when you return. GCE is pretty quick to do this and for shells that's not disruptive.

I use AWS extensively as well, but really like this product plan.

Ultimately what AWSClassic does is give you a lot of baremetal boxes to drop AMIs on. Google's changing that to the containerized model by offering direct services that are scheduled on hardware. As Kubernetes becomes more and more the primary method for deploying apps on Google's managed services, this approach will pay off more.

But it's worth nothing that for many people this is what Amazon needs to do as well. As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation.

> As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation.

Please. Even for an advanced VPC configuration, you're looking at 1-2 hours tops for setup. If you want point and click, go to Digital Ocean. Complex tools are always going to have a learning curve.

> Please. Even for an advanced VPC configuration, you're looking at 1-2 hours tops for setup.

We use DynamoDB. A lot of it. It is a non-trivial setup to get a dynamic, scaling solution to route traffic efficiently to the DynamoDB endpoints. Our SQS traffic sometimes also experienced extreme latency when we would send large groups of messages.

So forgive me if I greet your derisive tone and silverbacking with skepticism; I've got a product in the market already. I have correspondence from the AWS support explaining that it is in fact very difficult to operate at the scale we want to with some AWS Services that aren't supported, and the S3 connection was also not trivial. This is especially so if you're managing multiple discrete apps that don't coordinate usage or bandwidth spikes, as is common in large enterprise settings. Which is, ultimately, what we're doing.

> Complex tools are always going to have a learning curve.

There is no justification for the current mess that is Amazon's documentation for the VPC feature set. The only reason they get away with it is that AWSClassic is a giant band-aid which will be grandfathered onto customers with scaled products.

Arguing that things like Heroku or Digital Ocean or managed Kubernetes are bad and EC2 is good simply because it uses a hypervisor model instead of a container model is grandstanding and nonsensical, plain and simple.

The startup world has 0 use for this kind of thinking. What matters is how quickly you can deploy, and how efficiently and inexpensively you can scale if you get a hit. Everything else is ego, and useless in this environment.

There are systems that need AWS's model, but they're for specialist products. The vast majority of products can and do deploy in DO or Heroku just fine. And if they're sustaining people and serving customers, who are we to judge?

We'll agree to disagree then.

> There are systems that need AWS's model, but they're for specialist products.

Netflix. Tinder. Reddit. Yelp. Slack. Foursquare.

AWS' model works absolutely fine if you have systems knowledge. If you're looking for a PaaS, its of course not the solution for you. It feels like your comment is "Why doesn't AWS do what it wasn't designed for?"

Netflix, I agree. But what about Tinder, Reddit, Yelp, and Foursquare makes them unsuited to a PaaS? Is this, "It's not fast enough for my EXTREME METAL CLOSENESS?" arguments? Scaling them isn't inherently made easier by AWS. People said the same shit about AWS as opposed to your own data center.

The nice part about Google's approach, it gives you both worlds in an interoperable package. But I suppose you're more interested in the silverbacking than the specific technical arguments.

Another option is to use something like my CFNBuilder[0] to generate AWS CloudFormation templates. It should allow you to create a VPC (with a Bastion box, DNS proxy, NAT instance, etc.) with just a couple of keystrokes. VPCs don't have to be scary. :)

[0] https://github.com/rnhurt/CFNBuilder

The NAT instances are so easy to overwhelm. You have to scale them along with the services you're using if you have significant use of other Amazon services.

Also, it's not clear to me why I should have to do that part on my own. The fact I need to engineer a solution for high volume access to AWS Services (besides S3) in a VPC is stupid. Especially when I can just keep using EC2C and honestly have an easier time of it, while also not having to migrate and rewrite existing infrastructure to become VPC-aware.

You might have chosen the wrong platform for your needs.

So you are now following me around these threads, defending the concept of AWS from all criticism? Even that which has been admitted and promised to be fixed by AWS's support staff?

For someone with 'toomuchtodo' it seems like a very questionable use of time.

Even experienced AWS users have trouble getting VPCs right given the state of the current documentation.

No, no we don't. It's quite easy, and usually it only takes us a few minutes.

It is great if you're not experiencing the problems we are.

If you use AWS services besides S3 it can get very tricky to not overwhelm your egress and not suffer performance issues. Scaling this configuration in an elastic way is certainly not turnkey in the current VPC environment, and probably won't be until Amazon finishes something like the S3 gateway for them.

And the documentation is in a sorry state.

I think GCP's long term strategy is still to move all devops work into Google. They've stated this with GAE for awhile, and this is a logical extension move as part of that strategy for app devs who like to "SSH into their machines".

Like a lot of "cloud services", this is indeed nothing you can't do on your own box, and I imagine tens of thousands of people have done it before and will do it again on AWS. Google has now done it in a way that generalizes for everyone. Aside from what it lists on the page (installing the GC SDK and setting up authentication), Google handles all of the opsy stuff you would need to do on your own.

Running a Linux server and installing / authenticating an SDK is not really that hard, of course, but it's one less thing to worry about when developing an app. That's almost always always a good thing.

I think their long term strategy is to move to a containerized world. The fact that there are managed Kubernetes instances is very telling, because that was a LOT of work.

Another benefit is it's great for doing tutorials or to use when teaching a class. Instead of having to get all the tools and libraries installed locally on everyone's laptops people can just login to the console, fire up the shell and everyone will have the same base environment configured and ready to go.

You can reach your full cloud infrastructure from any browser, all you need to remember is your google password. No need for a terminal or ssh, a regular windows, os x, linux, chromebook or tablet will do. Quite handy.

Handy? That sounds like a security nightmare. Your instances are accessible by simply being able to gain access to the Google account? Even with 2-factor authentication, this is a serious no-no to basic security requirements. A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface.

> A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface.

Maybe if you own the servers.

Since they're Google's or Amazon's servers you have to be able to administer them with some set of Google or Amazon credentials. Otherwise what would you do if sshd crashed?

I understand your point. I host on linode which has Lish (an out-of-bound terminal that gives you command-line access without ssh). I have it turned off normally, but again can be turned on by anyone who gains access to my account with credentials and 2-factor auth. It should take a lot more from an attacker to be able to access your servers.

> Otherwise what would you do if sshd crashed?

Kill that instance, and spin up a new one.

A wise BOFH gave a preso that stuck with me "Treat EC2 instances like cattle. When one strays off the farm, put a bullet in it's head."

Don't treat your cloud machines as special snowflakes. Build infrastructure via script.

How does that add any security? Anyone with access to your root AWS credentials still has your IP addresses and your EBS volumes/snapshots and can do whatever they want.

I wasn't addressing security; I addressed your comment about what do you do if SSHD crashes.

For grins, I wonder how many root AWS creds are tied to Gmail (read: Google) accounts.

This is the trade off I've wrestled with. I've kicked around setting up a Clound9 IDE with access to our environments, so that I can access and repair any of our production environments remotely without needing my laptop.

If a Google account compromised all of the assigned features are available at the web console anyway, having ssh access doesn't add that much risk.