Hacker News Reader

Comment by chatmasta | Hacker News Reader

I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog.

Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.

View on HN

On the flipside, being this open might mean that weaknesses come to light because of the increased scrutiny.

It's just like when talking about secure communication, you explain exactly how the public/private key exchange works, what algorithms are used, and how the entire handshake takes place. You don't say "We are keeping those details secret just in case it might aid some hacker".

The added benefit of everybody examining the process and agreeing that it's sound and secure is just too great to give up.

The internal infrastructure of AWS apps are fairly guessable anyway. There are only a limited number of AWS resources and they fit together in predictable ways, VPC - Gateway - ASG - EC2 etc etc.

I think it's really great that they've talked about this, it's quite rare to hear about these kinds of internal migrations, and it's something I do a lot with clients but it's not really glamorous enough to talk about.

Hi vr46, where should I go / what resources should I consult if I want to start learning more about AWS & setting up infrastructure? Thanks!

Hi KurtMueller, get yourself a new AWS account with the free tier, find out exactly which resources ARE NOT included with the free tier, and get down with a simple Terraform file. Terraform code has a one-to-one mapping with AWS resources, so it's easy to follow. One code test that my previous company had was to create a simple load-balanced web server in Ansible or Chef, but you could also do it with Terraform too. Two servers and a load balancer in front, simple but teaches you a lot of fundamental stuff.

Forgive the self promotion but I'm building a subscription video site - http://stackleap.com/ - to teach people how to build and deploy to AWS infrastructure.

The difference between StackLeap and sites like acloud.guru is that I'm focussing on the day to day stuff rather than high level concepts you need to know to pass the certification exams.

I'm hoping to launch a beta in the next few weeks.

I've been very impressed with CloudAcademy - it seems to issue AWS accounts per course/per lab - it guides you through the steps and check whether you completed them by checking the AWS account, and then tears it down at the end.

You might not be ready for that level of integration, but see if you can get a demo or trial.

If our security depended on this information being private then we would be in big trouble.

I would love to go into more details about the environment and some of the things we did to build on top of the default AWS security settings. It was too much information for this post, maybe we will do another one that focuses on security.

The map / description in the blog post probably describes about 50% of all the applications running in AWS that I’ve seen, almost identically.

If they listed out security group and IAM configurations, or how exactly they’re connecting through the bastion, then it would be a little more risky, yes.

CDN in front of S3, LB in front of Multi-Az EC2 and RDS in background plus Redis for caching... this is basically the infrastructure Hello World of an AWS application. From a security perspective, that might be new for script kiddies but probably any random hacker will assume such a setup.

On the other hand, you have a team of X employees who work at the company. I'm sure many of them have access to this map.

By sharing this with the world, you are encouraged to face any vulnerabilities that you may have overlooked.

All this tells me is that they use EC2, Aurora, and other AWS products. What am I supposed to do with that?

I imagine the examples are probably fictional. The only thing you know is that they are using AWS.

No, these are real code snippets. I only masked the account identifiers.

Reply on news.ycombinator.com