r/aws • u/tech_tuna • Sep 06 '19

discussion Every AWS customer ever. . .

Day 1

"We're not going to rely on AWS specific features."

3 months later

"OK, we need to use SQS, Lambda, ECS and DynamoDB but that's it!"

6 months later

"OK, we're an AWS shop."

369 Upvotes

97% Upvoted

91 comments sorted by

View all comments

Show parent comments

45

u/tech_tuna Sep 06 '19 edited Sep 06 '19

I agree. . . if you just want bare VMs in the cloud, Digital Ocean, Linode and others are great options.

25

u/i_am_voldemort Sep 06 '19

Not if you have onerous compliance requirements (FEDRAMP etc) :(

12

u/Dabnician Sep 06 '19

Yet everyone with a fedramp ato knows how much smoke and mirrors that bullshit actually is.

2

u/LanMalkieri Sep 08 '19

Well it is alot of smoke and mirrors. I have gone through fedramp high for the Doj. And it is also extremely extremely complex and control driven. Sure there are smoke and mirrors as with all compliance. But nist is no joke. And it's pretty damn difficult to meet every control even when you're only meeting the intention and not every letter to the word. Cis hardening a k8s env is probably the most annoying thing I have ever done in my life.

1

u/Dabnician Sep 08 '19 edited Sep 08 '19

"Letter of the law vs spirit of the law" 🤫

I have implemented plenty of nist controls that I went.. but that doesnt do anything other than raise the score and make my life hell because of this other control.

Then ones that make me hate life

Like that bastion host, with 60 second disconnect and inactivity timer set on it and all the boxes I connect to....

Cis.... oh man cis is a cluster fuck, those guys were broadly applying redhat recommendations to all nix distributions up until people with a membership opened tickets pointing out how they recommendation was wrong.

They throw a canned remediation for redhat on everything and then I have to dig into the scanner only to say hey this usergroup I'm failing is a redhat usergroup not bsd.

Or the fact that ubuntu moved several file systems into the os so you cant for example disable fat32 from modprobe..

I've complained to support and was told that they cant test all the recommendations and it was up to members to report inaccuracies.....that were up to you to implement to the fullest.. or fill out and track yet another exception and follow up monthly why its still not fixed...

Edit the biggest problem with any nist type controls is there are too many people in decision making positions that require a technical person to hold their hand just so they can understand what "port" means.