Hacker News Reader

Comment by 0xy | Hacker News Reader

Azure seems to be shaping up to be a security joke, there's been a concerning number of cross-account exploits in the last couple of years.

AWS isn't perfect, but you really don't see many exploits on this scale. What is Microsoft doing wrong here?

View on HN

Azure has definitely had a bunch (too many, IMO), but AWS had a similar disclosure around CloudFormation and Glue back in January. https://www.lastweekinaws.com/blog/orca-security-aws-and-the...

That blog post also highlights that AWS may have a tendency to sweep security issues under the rug if there is no customer impact.

There's a certain level of tech schaudenfreude when it comes to Microsoft failing. It's hard to say that Azure has more issues than AWS based on gut feel of recent white hat blog post volume.

It's sub-ironic, though. Microsoft has been delivering tech fails for decades.

By that logic so has everyone?

I think AWSs very granular permissions using IAM helps. Even tho most people I talk to hate it. I quite like it. Start out with a role with no permissions and open only what’s required for your stuff to work.

I've found that AWS IAM is amazing compared to Azure AD. With AWS you can do per-workload account vending and grant account owners full "AdministratorAccess", because IAM resources are tied to the account. In Azure it's batshit crazy: almost all IAM resources - roles, groups, principals etc - are tied to the overarching AD tenant and not to the AWS Account equivilent, a subscription. In short this means that I, the owner of a subscription (broad powers), cannot add a new IAM role or associate it with a resource for user assignment. It gets worse... Azure AD limits are tenant wide leading to big orgs refusing to add IAM primatives because they might hit a service limit. And the lack of ABAC makes KeyVault almost unusable compared to AWS Secrets Manager. But hey, at least I have system assigned managed identities for SQL logins, that was kinda cool until AWS introduced IAM auth for RDS.

Reply on news.ycombinator.com