Re:AWS IAM Policies in a Nutshell
by joseph on Thursday March 23, 2017 @03:30PM
(#13943324)
Who calls that a best practice? If you're a very small company, that might be fine. With thousands of employees and tens or hundreds of applications, you'll run into serious problems if you want to use e.g. VPC peering for shared services. You'll also run into major cost issues if for example you have per-VPC or per-account commercial appliances.
[ Parent
| on HN ]
AWS uses this isolation pattern internally for just about everything, for what it's worth.
That's interesting, because their consultants discourage it for their customers. For companies that want to keep most of their traffic internal, I don't think it's a working model. I suppose Amazon's internally used services are the same ones they expose to customers, so it probably works fine.
Re:AWS IAM Policies in a Nutshell
by openasocket on Thursday March 23, 2017 @08:25PM
(#13945580)
Not the "per region" part, that just seems silly.