AWS strains to make Simple Storage Service not so simple to screw up

Amazon wants you to know that it's not to blame for the data you've exposed though its cloud storage service. AWS Simple Storage Service (S3) is, after all, simple. No doubt you tried to keep your data secure. But let's face it, in the sixteen years S3 has been available, the cloud-based data storage service hasn't been simple …

[captain veg]

well, der

Storage in "the cloud", i.e. "the internet" is all very well, probably convenient, possibly cost-effective, but it requires that somebody be able to access it over the internet. Then it gets hard.

It's USB memory sticks all the way for me. Hmm, maybe encrypted.

-A.

[Dave_A]

Re: well, der

Can't really run an enterprise application off USB sticks ...

[captain veg]

Re: well, der

In my first job we shipped enterprise applications that ran in 30MB of disk and 512KB of RAM. We didn't have USB sticks, but if we had, that would have been unbelievable luxury.

-A.

[Anonymous Coward]

Re: well, der

The first commercial product I wrote ran from an 8K EEPROM and needed about 4K of RAM to use along with (usually) an 800K floppy for storage. 512K would have been unbelievable ;-)

[anothercynic]

Funny that...

... I had my first experience(s) with S3 this year... that interface is utterly, utterly crap. It truly boggles the mind. No wonder newbie admins for S3 cock it up left, right and centre.

[Claptrap314]

Re: Funny that...

I agree that S3's control interface is a huge wreck. (15 months here) What I DON'T agree with is at someone can make the access public "by accident". You have to either be a ******* yourself & either not read or not bother to understand what you are doing, or you do it intentionally.

It's almost a shame that when these things blow up, it's not literally in the face of the culprits.

[ronkee]

Making a bucket private is really simple, it's default.

Adding more complexity and additional controls doesn't actually make it easier, though it can help with compliance tasks like verifying that buckets are still private.

The problem is that connecting to a public bucket is far easier. When security is hard, people work around it.

It's not an easy fix but it's not wildly difficult either, it's just that AWS aren't on the hook for your mistakes (when implementing their broken process) and customers have low standards.

[Dave_A]

Yeah ...

If S3 was as easy to admin as a NetApp filer it would be far more secure....

[Anonymous Coward]

Re: Yeah ...

"as easy to admin as a NetApp filer" ... used to be....

FTFY.

[Snake]

Re: if S3 were as easy to admin....

It's true: with all their (tech) power and resources, AWS UI's are simply an absolute mess. AWS shows to me, IMHO, what programmers will create when they have little concern for end user experience; all the power and ability is there, if you can understand the disaster that passes for "concept in design" and can then comprehend exactly what they are trying to communicate to you within said structural disaster.

It is a design failure and rather than admit that, and create a web UI that makes sense, they either come up with excuses or apply simple overlay patches in hopes of mitigating the UIX failures.

[Robert Grant]

Re: if S3 were as easy to admin....

> AWS shows to me, IMHO, what programmers will create when they have little concern for end user experience

Why do you think it was designed by programmers?

[Snake]

Re: progammers??

"Why do you think it was designed by programmers?"

Well, *some* 11-year old did the coding for that website, didn't they??

[An_Old_Dog]

Re: if S3 were as easy to admin....

Some programmers will create bad UIs, and bad program concepts/organization, just as some programmers create terrible variable- and function- names; their brains just aren't wired for doing it in a sensible, meaningful-to-others fashion.

This is not a new phenomonon. One of DEC's early OSes for the PDP-8 had an account admin program which used the [Escape] / [Alt Mode] key to delete an account! Quite counter-intuitive.

[Robert Grant]

Re: if S3 were as easy to admin....

I don't see how that relates to my question.

[An_Old_Dog]

Re: Yeah ...

Ah, for the days of Novell's inherited rights filters, and the "rights" command to view them.

[OnlyMee]

Re: Yeah ...

It's mostly used as application storage so I think UI management is a pretty secondary concern as long as API is ok.

[yetanotheraoc]

You had an extra word when. "Security is hard, people work around it." Otherwise, your post neatly summarized my thinking as well.

It's not *setting* the security that needs to be made simpler. It's *debugging* which security setting is causing the application to halt (or return no records) that needs to be made simpler. `grep -Fi "auth" security.log` isn't going to cut it for the low code folks. They would rather search for "how do I allow all on amazon s3". It's the "I just need this working now, I'll figure out the security later" mentality that needs to go, but boss is tapping his toes.

[Kevin McMurtrie]

Cursed IAM

Bidirectional grants in IAM, assumed roles, inherited roles, instance roles, deployment/tools roles, global bucket rules, and temporary access tokens. Multiply that by a ton of internal operation codes that no longer match APIs. You can see why an outsourcing company with a tight deadline is simply going to flip the switch to make it public.

Between that and needing to use a multi-part API for streaming uploads, I think the word "simple" might be misused.

[Anonymous Coward]

Re: Cursed IAM

> I think the word "simple" might be misused.

That's a pretty kind way of putting it.

[thejoelr]

Re: Cursed IAM

This is why all the buckets end up public. People encounter the extremely difficult access control blocks and either make mistakes or just grant full access to move onto other tasks. The change sounds more like CYA.

[nijam]

Out of interest (not being a user myself), what do you have to do to "unintentionally expose" data to the internet?

[Pierre 1970]

AWS won't resist too much time before saying: "You are all holding the bucket the wrong way"