Hacker News Reader

Hacker News

Comment by BillinghamJ | Hacker News Reader

Full thread

BillinghamJ

Looks to be affecting all regions - at least within the standard aws partition. Not sure about aws-cn and aws-us-gov

View on HN

Not seeing any issues in aws-us-gov.

TIL of aws-us-gov

usually referred to as gov-cloud.

Has it's own version of everything, physically segmented, even for global systems such as IAM.

You have to be a US Citizen to work on it and you need special security clearances.

You might be getting GovCloud and AWS Secret Region confused. I've been told that I can access GovCloud if I cross the border from Canada, despite not being a US Citizen. (This came up in the context of providing FreeBSD AMIs.)

I believe the secret region is just part of GovCloud. Afaik, GovCloud is just the marketing name for aws-us-gov

GovCloud is a separate partition from Secret. Different regulatory framework alignment and customer onboarding.

GovCloud customers only need be a US person or entity, beyond that any further regulatory alignment is up to the customer. AWS does not audit the IAM user base for nationality or any compliance requirements.

Disclaimer: I am an AWS Public Sector Solutions Architect.

Ah it looks to be aws-iso (c2s.ic.gov, top secret) and aws-iso-b (sc2s.sgov.gov, secret)?

So, just to clarify: if a "customer" who happens to employ tens of thousands of people also employs non-US citizens (such as the DoD's foreign national IT contractors), then non-US citizens would have access to GovCloud.

Secret region is not a part of govcloud.

IAM is a global service. So it kind of makes sense that all regions would be affected by an outage.

Well yes but it's entirely possible for it to be locally affected

IAM is seems to be run out of North Virginia (other than Gov Cloud)[0]. However they probably may be doing some magic under the covers to reduce latency across the globe. It would also explain why GovCloud isnt affected.

[0] - https://aws.amazon.com/about-aws/global-infrastructure/regio...

Yeah certainly the existence of credentials etc must be replicated to deal with cross-region connectivity issues etc. - which I guess explains why authentication is still working fine

GovCloud I believe is technically separated in this regard, I don't think IAM credentials can operate across partitions.

Though it does seem to be possible to link the existence of a standard AWS account with GovCloud, the same is not true of the China partition

Gov Cloud is an entirely separate setup, you can't share anything across the two.

IAM is a global service.

Reply on news.ycombinator.com