Re:Unbundling AWS
by imglorp on Sunday December 01, 2019 @11:36AM
(#21676216)
> AWS security is so complicated now, at the control plane layer, that hardly anyone understands it.
Yep, and in the context of OP asking to pull out authN and ID, it's a lot clearer how to pop in an alternate DB than IAM. Even pulling out Cognito makes some sense, but not IAM. Notice OP didn't even mention authZ because IAM roles and policies are so intertwined with every AWS service, there's another major disincentive to pulling something out. It seems any pull-out solution will need to wrap IAM such that it will incur treble complexity and performance hits.
Yep, and in the context of OP asking to pull out authN and ID, it's a lot clearer how to pop in an alternate DB than IAM. Even pulling out Cognito makes some sense, but not IAM. Notice OP didn't even mention authZ because IAM roles and policies are so intertwined with every AWS service, there's another major disincentive to pulling something out. It seems any pull-out solution will need to wrap IAM such that it will incur treble complexity and performance hits.
Ideas?