Re:AWS IAM user cost consumptiom
by QuinnyPig on Wednesday January 04, 2023 @04:26PM
(#34251935)
For a variety of reasons.
* Many deployments are done via roles, not IAM users.
* That pesky "jenkins" user is not in fact "John Enkins" but is in fact a CI/CD system.
* The model breaks down entirely once you get past a certain level of complexity. Shared resources (CloudWatch Logs, CloudTrail events, oh god the NAT gateways) get really hard to slice up in easily agreeable ways; cross-account access becomes a nightmare to track costs across.
* Most relevant of all: the system wasn't designed to do this from the start, and there's a mountain of technical debt to dig out from under before it could be done.
Re:AWS IAM user cost consumptiom
by playingalong on Wednesday January 04, 2023 @04:12PM
(#34251715)
Because the service would need to remember for its whole lifetime who created it. And the next thing people would ask to be able to donate resources to someone else
And here we land with the tagging system. Most of the AWS resources accept tags. And you could have a tag called owner. And then tools like Cost Explore can break down the costs for you by Owner.
The only thing you need to do yourself is to have a system or convention to enforce/encourage all resources to be tagged.
Re:AWS IAM user cost consumptiom
by version_five on Wednesday January 04, 2023 @04:18PM
(#34251813)
There is a YC company called Vantage that does AWS cost analysis that I see posting on here sometimes. They may have some thoughts and a perspective on if / how it is possible
Re:AWS IAM user cost consumptiom
by QuinnyPig on Wednesday January 04, 2023 @04:27PM
(#34251951)
Indirectly for some use cases; take the resource ID and find out what created it via the CloudTrail management event that gets logged when the thing was created.
And here we land with the tagging system. Most of the AWS resources accept tags. And you could have a tag called owner. And then tools like Cost Explore can break down the costs for you by Owner. The only thing you need to do yourself is to have a system or convention to enforce/encourage all resources to be tagged.