"The platform is hosted on Amazon Web Services in the UK"... (see the beginning at https://www.cloud.service.gov.uk/features/)
Are there any other cloud providers who have started by reselling another cloud providers products? Even as a reseller they ought to be able to make a decent profit by relying on volume discounts.
For government, yes. The USAF has a common infrastructure provider called Cloud One, built on top of AWS GovCloud. You can try to go to their website at https://aws.cdl.af.mil, but you won't be able to, since it requires a CAC and mutual TLS.
Among the things it gives you on top of AWS:
- CAC authentication, so MFA isn't optional like with vanilla AWS and you don't need separate IAM for human users (at least not the "I") since every user already has an externally provisioned and managed identity
- Air Force managed firewalls, so you can't just choose to be completely open, which vanilla AWS is perfectly happy to allow
- A limited subset of AMIs and managed services that are pre-approved as being sufficiently mature and secure for DoD production use
- Only pre-approved roles and policies, i.e. you can't accidentally create a publicly accessible S3 bucket because the system won't even allow that as an option
And yes, there are economies of scale and volume discounts and what not that have allowed some DoD infrastructure and platform providers to operate without any appropriated spending at least for some period of time, as in they fund themselves entirely by charging other government programs that use them. Platform One was like that I think for at least the first 18 months it existed, but then eventually received its own direct funding.
I doubt the UK government is interested in setting up competing infrastructure.
Having a consistent platform like this also gives them negotiating muscle because if they wanted to up sticks and move completely it is much more feasible.
Do they?
AWS's pricing may be eye watering in a few cases - looking at you egress - but one thing they definitely get right from my PoV is rarely if ever hiking prices
That means bill increases become costlier at scale as the volume discounts are not deep enough in a build vs buy on a pure cost basis (Lock-in, ease of use, reliability, talent reasons apart) at 100's of millions or billions spends governments do not to consider inhousing.
Not really, this is not something we want governments doing.
In Canada, we spent almost $1B on a simple gun registry - the equivalent of a few spreadsheets with a few million records with security overlay, and almost $1B on a Federal Payroll system that doesn't work.
IT, particularly products, is one of those areas where budgets can go over by infinity, it's systematic white collar corruption.
If AWS becomes less than ideal, there's maybe another service provider that can do it.
Even this initiative, while laudable, may not be perfectly operationally ideal.
Just like AWS actually has carved out a special government offering of their services, I believe a host of other providers should as well ...
A PaaS/SaaS customized for a given domain, like a country, that built out basic identity services and privacy features given the local regulatory environment, would be ideal.
Then the gov. can legislate, communicate, provide oversight while risking the fewest dollars doing the trickiest things.
It's not entirely implausible that things can be managed effectively, Sweden has done some amazing things in particular with process and communication. But they are small and special and take 'design' seriously literally as a culture.