Hacker News Reader

Comment by iambateman | Hacker News Reader

S3 configuration is awful, full stop. It’s not just that the interface is a disaster and configuration options are full of jargon and access rules are written in JSON.

The problem is that for someone who only periodically uses S3, I’m lost. I’m not lost in other services…Cloudflare, Firebase, Mailgun, and dozens of others somehow manage to allow people to use their service without so much agony.

I’m almost positive my S3 bucket is misconfigured because of how absurdly complex it is.

If you disagree and have spent more than 200 hours working within S3 I submit that it’s because you’re just an expert. I shouldn’t need a certification to upload files and retrieve them securely.

View on HN

S3 isn't a big deal. It could be you're thinking about it wrong.

More specifically, each possible action on a bucket or file has a permission. You have the option of going granular or not, depending on what you want.

S3 can be thought of as a service and an API. It might be easier for you as a dev to look at the api docs and the various options then map that to the UI.

For all services there are possible actions and authorization checks for those actions. It's up to you to allow or disallow the actions you want on a per user basis.

Complicated? Sure, it can be. Welcome to modern computing.

No offense, but spending 200 hours on S3 and if you still don’t understand it, it’s a skill issue.

lol I haven’t spent 200 hours.

I’m just aware of a lot of people who spend a lot of their life working in AWS and then get cranky when everyone isn’t as experty as them. :)

I'm sorry, but this sounds like C++ apologism.

Tech should be simple and fail immediately if used incorrectly. It's a tech issue if the dispersal of customer records is happening frequently enough to be a meme.

S3 does fail safe. The default is to deny access, but the problem is that every so often someone “solves” a problem by granting access broadly rather than learning how the tool works or reading the prominent warnings. This isn’t like C++, it’s more an example of how people don’t consistently respect the ancillary tools they use enough to learn how they work. I’ve seen the same pattern in many other contexts and it always came down to “I need to get my real work done, I don’t have time for this sysadmin stuff!”

You can try to be Rust and refuse such access rules. Yes, I know it sometimes makes sense. Rust rejects perfectly fine codes too. People are really into such things.

Rust has unsafe, too, because the implementers know that they need to work in a messy world. S3 has options for globally blocking public access, there are warnings and tools which continuously audit for things like cross-account access, etc. but they have a lot of customers who legitimately need things like that so there has to be a way to do it, just as Rust allows you to say “I know what I’m doing, call libc!”

Reply on news.ycombinator.com