News for hackers. Stuff that matters.
Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by SV_BubbleTime on Wednesday July 22, 2020 @11:41AM (#23918184)
> Never make manual permission changes in the console. Everything is done via SCM’d code.

The first time I heard “infrastructure as code” I thought it was some dumb new buzz words, but no, it’s good advice. Your cloud formation, serverless, terraform whatever should be stored in GIT a stack replace is how changes should be made.

I consider the console as read-only.

Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by nitrogen on Wednesday July 22, 2020 @11:54AM (#23918324)
IMO this is code/console dichotomy is a design flaw in most cloud offerings that will haunt the industry for a long time.

The web console should be just another UI for editing the configuration in source control. As an example of why that's important, a UI can give you a warning and use affordances to guide beginners away from dangerous setups. In the case of S3, a slider for basic access level can use colors and show a list of objects that would become world readable or writable at a given level (for that matter why is world writable even an option?). A giant YAML file looks the same whether it's safe or dangerous.

If you really don't want to use a UI, then maybe abstracting a linting layer that feeds the exact same warnings to the UI as to your CI system and text editor would help.

Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by SV_BubbleTime on Wednesday July 22, 2020 @12:29PM (#23918734)
> The web console should be just another UI for editing the configuration in source control.

Should. But isn’t.

So until it is, IaC for production. Console or CLI for development.

Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by vangelis on Wednesday July 22, 2020 @11:56AM (#23918353)
I occasionally spin up things in the AWS console so I can describe them through the CLI and then delete them. IaC is great until you have no idea what the code should be.
Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by wjossey on Wednesday July 22, 2020 @12:27PM (#23918707)
Certainly not discouraging this, so thank you for pointing it out.

I do the same, and sometimes I need to do something manually so that I can grok what configurations I need to define in terraform / whatever other tool I'm using. POC'ing is different than a production or even staging service.