AWS doesn’t know who I am
ben11kehoe.medium.com
ben11kehoe.medium.com
What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part.
I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.
Perhaps it's because my account is very old - possibly having been created near the inception of AWS. I have no memory of creating the account.
I thought my personal account was this old already, clearly not.
Clearly the solution to this is for the retail site to support IAM roles.
My account is very old. From the sounds of it, my grievance has been addressed by Amazon but I'm grandfathered on the old system.
At least when I dealt with this mess a couple years ago, AWS support did not have reassuring answers. They claimed they could separate it, but if something went wrong we were on our own without spending large amounts of money on premium support.
Lucky for me most of our resources were already in child AWS accounts and the rest could be migrated, so I was able to create a _new_ top-level AWS account, re-parent the child accounts, and delete the old parent account instead. At least with that process we could create a throwaway child account and test every step before doing it for real with production.
> If your AWS account and Amazon.com retail account share the same login information, updating the email address or password on one of the accounts changes information on the other account.
[0]: https://aws.amazon.com/premiumsupport/knowledge-center/trans...
This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed.
Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then.
Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.
My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard, and done with a lot of care.
All new accounts created today are "decoupled". They are not your Amazon account, and (barring some special internal tools for testing) you cannot make them the same account. But migrating all the existing accounts without causing harm is a messy business.
My own AWS account has the same problem.
I can say for certain that no, it is not something taken seriously.
I (loudly) complained to AWS enterprise support in 2017, 4 years ago, about this issue. Got escalated as high as could possibly be escalated (team leads of IAM calling my cell phone).
4 years later and the issue is unresolved. This is Amazon we’re talking about. There’s very little that can’t be fixed in 4 years.
Generically: Identity is a very hard space. It's one of those things that sounds really simple but the deeper you go the more edge cases you find.
With an complex systems, changing fundamental designs of the system- while users and other systems are currently using that system- is like trying to upgrade the engines on a plane while in flight. Technically possible, with a lot of planning, but any wrong move or bad assumption and you're going to crash.
> never hear about WorkDocs rolling out a feature to the Frankfurt region — unless you’re using WorkDocs in Frankfurt
Personally I'd hate that. Send that info to my work email account for sure, but my private one? No way!
If I'm not currently being paid to think about my job, nothing should be trying to remind me of its existence.
Usually these issues can only get resolved by getting your blog post to HN
In fact, I'd like to see some metrics, a transparency report of false positive blocks/deletions which were reversed.
But indeed, I absolutely do not want my personal projects to be related in any way to my work projects, nor vice versa.
Agreed about wanting to see more transparency.
For every user who gets saved by someone at Google seeing their story on HN or Twitter, how many users stay permabanned because they just aren't social media savvy enough (or lucky enough) to get traction?
I would guess that the majority of false positive bans never get resolved.
The horrifying part was that Google went on to ban every employee's personal account as well because they were "linked" to an account that was banned for TOS violations. Imagine losing access to your email, Android apps, and photo library because a coworker you may not even know broke some TOS.
A Google employee entered the thread and said they were investigating, but notably ignored anyone asking "is it really Google's policy to ban people's personal accounts if their employer gets banned?"
I was pretty happy when my company switched from G Suite to Office 365.
(Amazon allegedly isn't free of these "guilt by association" practices - I've heard stories of people getting permabanned from Amazon because their roommate or family member returned too much stuff, since the delivery address was the same.)
The richest man in the world now controls the idea of your identity.
I will give crayons to every angry third grader willing to color all over that idea until it is unrecognizable.
Real cryptography based identities with derived keys are possible. PGP allows this today. With some organization you could use PGP with twice derived keys for various identities that can be corralled under a single identity. Again, all possible today for the aspiring entrepreneur. What I think will be infinitely tricky is creating an organization that is international to manage them without influence. They can't be beholden to a single nation or continent. Being able to be influenced by any nation would need to be a P1 bug in the corporate architecture. You'd need a stupidly secure facility with offline data gaps, the kind that are proposed for things like SCADA.
Anyway, I've thought about this problem a good bit over the years. I'm interested in others thoughts.
Idea of 'identity for the human' reeks of ghastly surveillance and control. AWS has no business with 'the human', only with client - it's not my family, it's not my friend, it's not a law enforcing state with monopoly for violence.
If anything it just gives me another place where I can't keep work and home separate. I don't want another "Atlassian" where suddenly my work own my account because I had a work email attached to it, and can close it at will.
For the few Google products we use at work, like Calendar, we make sure that people do not register with their existing personal accounts but use their work email address.
https://support.google.com/accounts/answer/1721977?co=GENIE....
That doesn't mean more than one account per person is OK though. Just the reality than more than one person may share a device.
Lots of screenshots around if you google "Google Account Chooser".
Pretty much everyone who works for a company that uses GSuite will be very familiar with it.
Google gives free storage, etc per account. I wonder, if you exceeded that and had a second, how quickly they'd say 'one account per person'?
One possible explanation is that the exit IP for the company has had malware hosted on it, so that IP is getting banned from Google services. If they go home or turn off WiFi on their phones it will probably work.
Fully believable.
In some cases people don't even have the slightest clue.
In this case there is at least an explanation even if it is bad.
PS: I don't hate everything Google do or any employees specifically, I just try to shine a light on the places where they fail like lack of transparency or even basic communication or their abuse of market power to try to kill competing browsers.
They have done good work in other areas it seems like standing up against dragnet surveillance etc.
For a counterexample, consider Apple and how they try to restrict you to a single Apple ID. They want everything to be tied to a single person. Every service you use is tied to your Apple ID.
It just doesn't match the way that people use computers.
For example, I get my computer games and business software billed to the same card, and there's no easy way to change that.
Somehow the app store "helpfully" installed a baby monitor app that I use at home on my work computer.
We set up a Mac as build server in the office. It's shared by multiple people. I need to log in with my personal credentials to download software from the Mac App store.
My girlfriend bought an iPad for the kids to watch TV. It's shared by a couple of people. She had to log in with her Apple ID to set it up, and now her personal iMessages and emails are on it. It's stupid.
Some of these problems can be fixed, but it's really annoying.
My solution: use Linux :)
I use my personal Apple ID for personal things, my work one for work things, and as an admin of our Apple Business Manager account I can create new Apple IDs for anyone in the company as necessary.
To my knowledge Apple doesn't even have a policy of requiring one account, I've certainly been told to set up separate accounts by Apple support teams.
Facebook does have this problem, they have a policy that you must not have separate IDs, they police this heavily with a lot of automated bans, and they also require a Facebook account to do development with Facebook.
Apple considers iPads (and iPhones/Macs) as personal devices. You aren't expected to share an iPad, you're expected to buy an iPad for each user.
Are you upset about the fact that you can’t have multiple isolated user-accounts on an iPhone?
The iPhone was mentioned once, to connect it’s not possible on either iPhone or iPad. This is about the iPad, a completely different class of device, where it makes sense it would be shared, at least within a family, and has nothing to do with personal pizzas.
It'a small point here, but the way you moved the goal post so your analogy applied more really bothered me.
I’m not trying to move the goalposts because I think of my iPad as just a larger iPhone. To me they’re the same.
It’s such an odd dynamic because I see so many families sharing an iPad which isn’t multi-user but then treating laptops as personal.
It would be very awkward, even if you had multiple user accounts. How do you deal with things like notifications on the lock screen for messages, which can be very personal. There is so much personal stuff on my iPad, it would be like sharing a toothbrush. Sure, you could do it, but why would you ever want to ?
Computers have become deeply personal devices, to the point that having to keep personal stuff off them would negate a lot of their utility. Is there still a point to having shared computers ? Do people still do that ? Even my parents, who are in their late 60's and care little about technology both have their own personal laptops.
Sharing a computer doesn't mean keeping personal information off of it, it just means you want a device that respects your personal information and keeps it private (non-readable by other user accounts) by default.
Like Apple isn’t misleading anyone, you know when you buy it that it’s a single user system with all the downsides that entails. It’s fine to say “I think Apple should support multiple users to cover my use-case” but not “how dare Apple not support my use-case.”
How dare my toaster not fit bagels! It’s a conspiracy I tell you to get you to also buy a separate bagel toaster!
Like are people really just blind buying devices without even looking to see if they do what you want them to do? If you’re requirements are “I need a tablet to share between me and my kids” why is an iPad even on the table?
It's like Amazon waiting forever to include Chromecast functionality to sell more Fire Sticks. I understand, but it's still degrading the user experience, and that just grates my cheese.
The result is that people just use web apps like Gmail instead of native apps, because it's a lot easier to sign in and out of services.
Categorically not true. iPads in particular can be set up for multi-user with hand off.
Shared iPad Overview: https://support.apple.com/en-gb/guide/mdm/cad7e2e0cf56/web
Shared iPad for Education: https://developer.apple.com/education/shared-ipad/
Shared iPad for Business (MSFT Intune MDM docs): https://docs.microsoft.com/en-us/mem/intune/enrollment/devic...
Practically not false.
Do you though? Why not just setup a "apps@<yourbiz>.com" and create a new account?
> and now her personal iMessages and emails are on it. It's stupid.
So just turn these services off? They aren't mandatory.
I silo my profiles. I have 4 of them. It’s really hard to do. Everyone encourages you to put all your stuff into a single profile. It’s awful for work life balance and security, but it benefits big tech companies, so that’s why it’s like that.
Do you want separate profiles for your password manager? Pay twice. Do you want separate personal and work windows installs (dual boot)? Pay twice. Etc..
Especially for the literal kids, use a child account. But also use a child account for the work machine so it can use your apps but isn’t your personal messages and photos.
I've never considered creating a fake child account for business use, but I have tried to create some fake Apple IDs for shared devices, so I didn't need to use personal credentials. Unfortunately Apple has blocked these fake accounts from accessing some services, so I had to fall back to using personal accounts.
I thought this was solved with managed Apple IDs? https://support.apple.com/en-us/HT210737
So, I agree. Every service should have separate credentials.
Unless I sit a myriad of different exams I can't advance my competency to Silver or Gold. This means my MPN default "Partner" benefit is restricted Azure AD Basic and I can't take a parallel Azure DevOps build with me to a new project.
Worst still, if I leave my MS Gold Partner for a start-up I'll lose access to the enterprise elements of Azure AD (SCIM integration, Azure AD Application Proxy etc). If I'm called out to support something I delivered I'll need to absorb the cost of upgrading my Azure AD subscription.
A better, more apples-to-apples comparison would be Azure Active Directory.
A single AAD account enables access to: Azure DevOps, Microsoft 365 collaboration apps, remote desktop logins to servers, virtual desktops, and a bunch of other stuff.
It certainly is very convenient, but the downside is that a global outage of AAD takes down a lot of things all at once.
For example, AAD system-managed identities are used as a type of "service account" in Azure. This means that web apps can lose access to their HTTPS certificates stored in Key Vault because AAD is down, causing massive outages.
In theory, AAD has a "read-only delayed replica" as a fallback, but in practice this hasn't worked.
This is actually one of the core "philosophical" differences between AWS and Azure. The former values completely distinct services with no (or minimal) interdependencies, the latter values integrated, cohesive architectures.
In my experience Azure's approach is more convenient but more fragile. Conversely, AWS is more robust but can be super irritating for end-users.
The benefit to you, the consumer, is deeper connection to the AWS ecosystem. Your contributions can be tracked on a dashboard and added to a virtual resume, so you don't have to list every god damn service and account you've worked with in your resume. You can more easily contact support across accounts and services, forums, etc. If you've ever gone, "shit, in what account/region did I use that one S3 feature before?", you could look it up in your global user history.
It's the same thing as having one GitHub account that lists all your contributions across orgs/repos. You can always create another GitHub account linked to another key/email/identity.
Solving this is a good idea, and can be done without much technical work, but it won't be, because of their business model.
This is what Google already does: all your "stuff" is linked to a Google account across all their products/services, because their bread and butter is knowing who "you" are everywhere, so they can make money off "you".
AWS doesn't care who "you" are because (outside of Amazon Prime) they don't make money off "you", they make money when you pay them. Very different business model. There's effectively no business case to track "you" everywhere, so they're not going to put in the work.
But actually, this could be solved easily with PGP keys and a database of databases. Add your public key to every system that AWS has (or they can add it for you, based on your email address). They can look up your general information in any public key server. And if they need verification of who you are, just send them a signed E-mail or file or something. It would be tedious to do this manually for every service, so they can architect some internal service to map public keys to internal services to hopefully get the human validation part down to just one time.
EXCEPT for the absolutely abysmal "customer service" and "issue resolution" provided by the likes of Amazon, Google, FB, etc. (as if those so-called services even rise to the level of the ordinary defnitions).
IFF they provided real humans, with real time and authority to look into and resolve issues, this might be a good idea.
But since, in the real world, their business model is obviously to provide only the most superficial figment of anything resembling an ability to resolve issues, any such linkage would be absolutely terrifying.
Any inadvertent slipup, or even getting innocently hacked already result in disastrous loss of access to your own data and privs. Just today, there's an HN story of such an unrecoverable loss on FB & Oculus [1]
The only solution in light of these hostile policies on the part of FAANGs and other big tech companies is maximum fragmentation/segmentation/sharding of accounts.
(I've already passed on invitations for an Amazon Biz acct, despite the fact that it might be quite useful for my biz, for exactly these reasons.)
Edit: add ref for [1] https://news.ycombinator.com/item?id=28249977
Binding these personality facets into a single person also has the disadvantage that if my account gets banned in one social context, the repercussions will touch the other contexts too. Will an oversensitive PC/abuse filter on one service ban me from all my Amazon-based access? I don't know, let's YOLO and find out.
http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...
Depending on the service, I probably do not want to be ME + sub-identities. While a good sleuth (or algorithm) with enough data can probably connect me to all the different services I use/manage, I don't necessarily want that information to be public. And if it exists in a database somewhere, it will likely eventually become public.
They should be able to talk to you as a person for marketing or conferences yeah, thats a different thing.
I don't think this was an accident. Internally, Amazon traditionally had very different methods for authenticating and authorizing users versus systems, and it was a massive pain. Switching to IAM roles relieved some massive pain-points.
This also seems like an IT headache. If you tie an identity to some test user, it has to get cleaned up somehow if you leave the job.
frobiz@example.com password A frobiz@example.com password B
Work, and be two different accounts. It's scary.
You don't have an AWS account. You have an IAM identity and credentials for an AWS account. Except for the root account where what you described is never the case.
I'm reluctant to delete duplicate Amazon entries in 1password and bitwarden in case I still need them, for some distinct IAM.
Also AWS isn't exactly for "reasonable ordinary people", it's a tool that requires some minimum amount of training. Yes the concept isn't super widely used for end user applications (although 1Password is a good example of another such "you have an account on an instance, that is unrelated to your account with the same email on another instance" concept). And yeah I do wish password managers would handle that better, but for anything that uses subdomain-level separation (example.1password.com vs amazon's signin.aws.amazon.com with multiple fields), it generally works out fine.
No thanks.