I know there are complexities involved, but auth is one of those things that needs to be very insulated from single region issues. How long was Okta not working for customers?
The control API (i.e. adding/removing roles, modifying policies, etc.) is available out of us-east-1. However, the bits of IAM that relate to distributing credentials to instances/tasks/lambdas and STS are all regionalized and isolated.
AWS is divided into multiple partitions. For the vast majority of users, there is one partition - the regular commercial - other partitions being China, GovCloud, etc.
Within each partition, there is a primary region that needs to be available for creation/mutation of credentials and policies. However, that data is replicated to other regions within the partition. That means the use of credentials that exist does NOT depend on the primary region being available. The replication is something that is closed monitored, and SLA breaches will result in pages.
https://auth0.com/availability-trust
And then read this tweet:
https://twitter.com/auth0/status/1471159935597793290
Edit: Ah, seems they picked us-west-1 and us-west-2 as the two regions..."In this case, we use two AWS regions: us-west-2 (our primary) and us-west-1 (our failover)."[1] So bit by a double-region failure.
[1] https://auth0.com/blog/auth0-architecture-running-in-multipl...
What else is everyone using?
Any thoughts on how to future proof this?