Hacker News Reader

Comment by more_corn | Hacker News Reader

Destroying one AZ in one region would not (should not?) take down a single AWS customer. ALB are multi AZ, it's trivial to deploy services across azs. Everyone should be ok.

Although I'm sure AWS has not done a disaster test where they actually bring one down so who knows if regional services would come out unscathed.

How pissed off do you think he's going to be when he learns that not only was the bomb fake, even if he had a bomb it would have amounted to little more than a disaster recovery test?

View on HN

> I'm sure AWS has not done a disaster test

I wouldn't be so sure about that.

Some disaster tests end up being initiated by a typo in a command.

Plenty of AWS customers test bringing down an entire AZ on the regular. I know of 2 large companies that test switching entire regions.

Previously the easiest way to bring down an entire AWS Region involved just waiting for AWS to take down the region on you. They stopped using VA as their guinea pig, but they took it down so many times that many of us started spanning across multiple regions. Only very naive serious users would be in just one region, let alone AZ at this point, so I highly doubt this plan would've taken down 70% of the internet.

In larger regions, single AZs span multiple buildings. He'd have had to basically raze 100 square miles of northern Virginia...

It would make more sense to target internet "backbone" routers, no?

Amazon certainly did DR tests like that, shutting down entire datacenters, back before AWS had AZs. Jesse Robbins used to run them. Once a small tornado from a Hurricane remnant (2005 or 2006 season) took out power completely to one of the smaller east coast datacenters.

I would not be at all surprised if AWS periodically tests bringing down a whole AZ. Facebook has been doing this for years.

And I don't think the three letter agencies are on AWS anyway...

FBI on AWS => https://www.nextgov.com/it-modernization/2018/11/fbis-counte...

CIA on AWS => https://cloud.netapp.com/blog/aws-cvo-blg-aws-govcloud-servi...

NSA on AWS => https://techbeacon.com/security/nsaarmys-inscom-leaks-top-se...

I stand corrected. Then again the NSA one doesn't seem to be an officially sanctioned placing of data, and in the CIA article it says the CIA cloud is not connected to the Internet, and is located on-premise (i.e. CIA headquarters).

Trying to bomb the CIA HQ would be an even more ballsy move...

The idea of using a cloud provider for critical stuff freaks me out but I keep hearing people I respect argue for it (often from an angle of "we can't afford to scale for certain large attacks without this.")

Reply on news.ycombinator.com