Hacker News Reader

Comment by scarface74 | Hacker News Reader

What is the purpose of Vault if you’re already on AWS?

Even though I prefer CloudFormation, Terraform is quite popular. As far as Consul and Nomad, they are both nice for on prem infrastructure - I’ve used both - but once you’re on either AWS or Azure, the native solutions are a lot less of a hassle and Nomsd (sadly) will never get the mindshare of k8s.

View on HN

You don't want to pay $1/month to store a single secret. You want a nicer workflow for creating ephemeral users and tokens than AWS themselves have. You want to do on-the-fly encryption of all sorts of things. You want a real PKI without every bit of know-how.

1$ per secret a month sounds extremely cheap considered on how much does it host to run vault

You can run vault on a single t3.medium backed by s3 with auto unseal and get pretty decent performance.

If you don’t care about silly things like high availability and reliability. Hashicorp even recommends a cluster of three.

https://www.vaultproject.io/docs/concepts/ha/

And what business at scale is optimizing over 0.25 per secret and doesn’t care about HA?

It’s 0.25 cent per month to use the Secrets Manager and you can store multiple key/value pairs per secret. If you’re not using the automatic key rotation, you can store a “SecretString” in parameter store for free for low volume usage or for higher volume It’s close to free.

Besides with vault you now need to set up a cluster for HA. But is your time worth nothing?

As far as users and tokens. That’s what Cognito is for for external users or associating your AD with IAM roles for internal users.

.. if you're in more than one cloud, and want a singular solution.

This is pretty rare, and it's getting rarer.

Clouds are successfully locking people in volume discounts, proprietary technology (like AWS Aurora), and non-transferrable configuration tasks.

I agree that cloud-agnostic tooling should exist, but as a for-profit company trying to find a large customer base, it's not a big market.

AWS Aurora is not “proprietary”. It’s basically a fork of Mysql/Postgres with a more performant storage layer.

Even if you're right about that, it doesn't refute my overall point that clouds are seeking to create lock-in and succeeding to some degree.

Once you’re at any scale, you’re already de facto locked in. “Infrastructure has weight”. It’s a major undertaking to migrate infrastructure once you e spent time creating data, setting up a hybrid network infrastructure, training, going through compliance, DNS entries, configuration, load balancers, validation and regression testing, etc.

The typical large corporation depends on so much third party software and so many services, it’s a pain and costly to migrate from any of them.

You can’t imagine how much coupling companies can do to something as simple as WorkDay.

I wish all of the idealists who want to maintain “cloud independence” would do a thought experiment and set up a realistic project plan and budget to migrate their infrastructure to another platform even if they didn’t use any proprietary offerings.

And then take that plan to their CTO and see where he wouid place it on the list of priorities for their company and do a realistic cost/benefit and risk analysis.

Then call my Fortune 100 bank rare. Everything we do is going with a multi-cloud strategy where it makes sense, especially around secrets management and infrastructure as code.

OK: it’s rare. You actually proved it’s rare by telling me that it’s a large bank and a Fortune 100 company.

Most people are neither banks nor Fortune 100 firms.

Why do you prefer CloudFormation?

It’s the “native” solution. All of AWS’s examples and getting started guides use CF. Also you can find examples for anything for CF on places like Github.

You have access to the “easy button”. AWS business support if there is something you just don’t get.

SAM, CodeStar,Elastic Beanstalk, etc all use CF and you can modify the templates.

Reply on news.ycombinator.com