Have lots of AWS accounts

Re:Have lots of AWS accounts by scarface74 on Monday October 03, 2022 @06:12PM (#33074422)

Having things “in a VPC” doesn’t help unless you are just using AWS as a glorified Colo. Once you start using AWS native services - many of which aren’t in a VPC, VPC isolation doesn’t help.

Each AWS account also has its own service limits and quotas. One out of control Lambda in the dev “environment” can impact production.

And you don’t have to open support tickets manually. There are APIs to request service limits and you can monitor the progress programmatically.

[ Parent | on HN ]

Re:Have lots of AWS accounts by icedchai on Monday October 03, 2022 @06:22PM (#33074498)

I run into "IT professionals" all the time who don't even realize you can run services without a VPC.

[ Parent | on HN ]

Re:Have lots of AWS accounts by scarface74 on Monday October 03, 2022 @06:27PM (#33074550)

Besides, every time you try to create a “least privileged role” to run infrastructure as code, that role has so many privileges it’s easy for mistakes to cause mistakes in your production “environment” that you meant to only affect your dev “environment”.

And I know I’m probably preaching to the choir. But one of the misconceptions I have to constantly fight is “we run our Lambdas in a VPC for security reasons”. (Lambdas are never “run in” a customer VPC)

[ Parent | on HN ]

Re:Have lots of AWS accounts by icedchai on Monday October 03, 2022 @10:27PM (#33076134)

Yes, I tried arguing with someone that it was actually more secure to run your Lambda without associating it with a VPC. If it doesn't need access to the VPC resources, it shouldn't be "run in" one. What can be more secure than having absolutely no access?

[ Parent | on HN ]

Re:Have lots of AWS accounts by coredog64 on Wednesday October 05, 2022 @12:11AM (#33091138)

cfn_nag has this as a default security rule. So there’s one place to lay blame.

[ Parent | on HN ]