Cloud Computing: Mostly fog machines in other people's datacenters

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Cloud Computing: Mostly fog machines in other people's datacenters

Thanks Ants: May 21, 2004; #essereFerrari

Thanks for this thread, I will be watching it intently. My employer is about to rack a bunch of servers in a DC to run hosted services on top of vSphere and I can't help but think they're a decade out of date with how they should be approaching this sort of problem.

# ¿ Feb 20, 2015 20:39

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 16:37

Thanks Ants: May 21, 2004; #essereFerrari

I understand the pet vs cattle distinction, but presumably you need a system to deploy the cattle and manage the configuration templates centrally as well as keeping track of how healthy your cattle are. Are those systems considered pets or are we now seeing projects emerging that amount to cattle managing cattle?

# ¿ Feb 21, 2015 12:15

Thanks Ants: May 21, 2004; #essereFerrari

Bear in mind that your AWS costs aren't just hardware and include staff wages, power and cooling costs, datacenter construction etc.

You can't compare the costs of putting your infrastructure in AWS to just the hardware cost of buying servers without including a load of other costs in your on-premise calculations.

# ¿ Aug 15, 2015 16:00

Thanks Ants: May 21, 2004; #essereFerrari

AWS can offer dedicated hosts now (well, soon):

http://aws.amazon.com/ec2/dedicated-hosts/

I think there was a guy here running a VoIP application and pretty much resigned to running on dedicated hardware. This might be interesting.

# ¿ Oct 8, 2015 09:44

Thanks Ants: May 21, 2004; #essereFerrari

Last week I spent a couple of hours explaining AWS to someone developing web apps, I explained what part EC2, S3, RDS, VPC, Elastic Beanstalk etc. played in the overall solution, showed them some documentation as it related to Wordpress in terms of where to store static content. A pretty good overview I thought.

Today I'm getting emails telling me that Bitnami LAMP stacks are ready to use :eng99:

# ¿ Oct 12, 2015 18:52

Thanks Ants: May 21, 2004; #essereFerrari

Related to the above, I'm struggling with IAM.

Is it possible to give access to a developer to let them create new users but restrict those new users to certain permission levels? I don't want them creating new user account with full admin privileges or granting their own account full access. At the moment they have a policy applied which prevents access to IAM, billing, and some sensitive DNS zones.

# ¿ Oct 14, 2015 14:09

Thanks Ants: May 21, 2004; #essereFerrari

That sounds ideal, I will look into it.

# ¿ Oct 14, 2015 17:19

Thanks Ants: May 21, 2004; #essereFerrari

So I have this so far:

code:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "NotAction": [
                "aws-portal:*modify*",
                "iam:CreatePolicy*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "cloudtrail:DeleteTrail",
                "cloudtrail:StopLogging",
                "cloudtrail:UpdateTrail"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::<redacted>"
            ]
        },
        {
            "Effect": "Deny",
            "Action": [
                "iam:*policy*"
            ],
            "Resource": [
                "arn:aws:iam::aws:policy/AdministratorAccess",
                "arn:aws:iam::<redacted>:policy/PowerUserAccess*",
                "arn:aws:iam::aws:policy/IAMFullAccess"
            ]
        },
        {
            "Effect": "Deny",
            "Action": [
                "iam:*"
            ],
            "Resource": [
                "arn:aws:iam::<redacted>:group/Administrators",
                "arn:aws:iam::<redacted>:user/<redacted>",
                "arn:aws:iam::<redacted>:user/<redacted>"
            ]
        }
    ]
}

Which as far as I can tell is working - users it applies to shouldn't be able to apply pre-existing policies that grant them more access than they have at the moment, they can't create a new policy that grants them that access, and they can't edit the Administrators group to add themselves to it.

I'd like to neaten up the two users at the end though - they are members of the administrators group and the IAM Policy Simulator showed that ChangePassword was still allowed. Is there a way to evaluate group membership in the policy?

Thanks Ants fucked around with this message at 22:32 on Oct 14, 2015

# ¿ Oct 14, 2015 22:14

Thanks Ants: May 21, 2004; #essereFerrari

Use Route 53 for your DNS and use an alias entry?

# ¿ Dec 22, 2015 00:17

Thanks Ants: May 21, 2004; #essereFerrari

Is there an HTTP header you can send to get Chrome to gently caress off with the caching? Phone posting but this seems to be a Chrome thing and not necessarily something that can be resolved in your DNS setup.

# ¿ Dec 22, 2015 01:36

Thanks Ants: May 21, 2004; #essereFerrari

It's the Microsoft Excel of the virtualization stacks.

# ¿ Jan 15, 2016 02:39

Thanks Ants: May 21, 2004; #essereFerrari

Either run the VPN back to your office and terminate client VPN there, or deploy one of the SSL VPN virtual appliances into your VPC.

# ¿ May 20, 2016 22:15

Thanks Ants: May 21, 2004; #essereFerrari

Hardware token and a webcam :getin:

# ¿ Sep 15, 2016 20:11

Thanks Ants: May 21, 2004; #essereFerrari

That's great because it implies that a medical devices company doesn't have any sort of support contract.

# ¿ Mar 1, 2017 08:03

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 16:37

Thanks Ants: May 21, 2004; #essereFerrari

Is it in "Backup vaults (classic)"?

https://portal.azure.com/#blade/HubsExtension/Resources/resourceType/Microsoft.Backup%2FbackupVault

# ¿ May 10, 2017 20:02

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Cloud Computing: Mostly fog machines in other people's datacenters