Hacker News Reader

Comment by paulddraper | Hacker News Reader

> Anti-pattern 4: Building an ‘on-prem’ solution in the cloud

It didn't use this as an example, but good heavens how it is that I still have to understand VPC and NAT to use half of the cloud?

10./192. was never a security measure; it was a IPv4 rationing scheme is that IPv6 made obsolete.

AWS made a big deal of the fact that Lambda functions can now be launched in a VPC in less than 15s.

Why are people doing that at all????

Because of bearded network admins that setup their on-prem network in the cloud.

Now networking in the cloud is so complicated, people are turning to FaaS because has a better chance of skipping the morass.

---

P.S. Don't get security groups confused with NAT. AWS had security groups long before its VPC service was even a thing.

View on HN

This ends up tougher than the expected because most Enterprise folks don't deploy entire systems to cloud providers. They deploy some subset, and still need connections back on prem. Instead of abstracting them into APIs, they just spin up DirectConnect or VPN, and boom you have tight coupling and not much more than an extension of on prem.

While 10./192. private addresses in IPv4 were in largely designed to help deal with address space exhaustion, they also are important because organizations can use them without having to own the addresses or register them in any way with IANA (or equivalent) since they are not publicly routable. IPv6 still maintains this feature with unique local addresses, and the entire fc00::/7 address range in IPv6 is allocated to private networks and is not routable on the public internet (not that AWS uses these, any IPv6 address they assign to you is a globally routable address). A lot of stuff just still doesn't support IPv6 yet (RDS for example https://aws.amazon.com/premiumsupport/knowledge-center/rds-i...) so you're options are to either give that endpoint a public address and manage your security groups well, or give it only a private address which gives you the added benefit of the endpoint not being publicly routable (which is a nice second layer of security beyond security groups), downside being the things that need to talk to it must now also live in your private subnet, hence Lambda launching in a VPC.

> A lot of stuff still doesn't support IPv6 yet (RDS for example)

Almost all software (OS's, browsers, databases, load balancers, etc.) supports IPv6.

Some third-party services don't. But that's usually irrelevant to my point. For example, RDS allocates public IPv4 address at no extra cost. In any case, my point is that cloud providers are unwisely shoehorning NAT into everything; citing AWS as a contributing factor just reinforces that.

---

There's no longer any need for local IPs, except so that we can still design 90s-style networks.g

> Why are people doing that at all????

From a security standpoint: because it dramatically improves your security posture. Defense-in-depth is a real thing, and people who care about security use it (the people who pay big bucks).

Reply on news.ycombinator.com