Hacker News Reader

Comment by p_l | Hacker News Reader

And the level of actual integration of various services varies a lot (I mean, you expect things like IAM to be included if it's AWS service, right? Lol nope) plus then there's stuff that will be documented with something like one paragraph in docs and highly paid support engineers will never find anything internal about it, so you end up building a complete SSO solution for AWS from scratch...

View on HN

AWS sometimes feels like Debian's APT but everything is rewritten in java.

AWS SimpleDB is in Erlang :p

What services aren't currently integrated with IAM / didn't launch with IAM integration?

AWS Quicksight was one, late 2020-early 2021 (which is about 5+ years after acquisition, iirc).

IAM support was essentially useless, you had to create second set of accounts inside Quicksight, with various limitations, and generally it was one hell of a mess.

Also when IAM integration is there it has patchy support for resource condition wildcards and condition keys which are usually not documented

Totally agreed there. Also condition keys have such a high cognitive load; I can never ever remember the exact spelling of them or whether I need StringEqual or StringIsEqualIfExists or whatever other operator. The documentation has tons of prose about what service-specific keys to expect, but nearly 100% of the time when I'm trying to do something non-trivial with IAM, I end up finding the answer on somebody's blog rather than the documentation.

All of this because the policy language and featureset started off simple enough that it was reasonable to describe policies in json. I sort of wish that they would keep the existing policy stuff as-is but have an escape hatch that let us write lua (or JS or eBPF or something) as "policies", and charge us for the compute time.

I recall that there was at least one case where two similar condition keys that by name should work both, only one was appropriate.

But then I actually blew the stack in IAM processing to the point we couldn't start an AWS sagemaker notebook because IAM died while attaching a network interface to EC2...

S3 had poor integration with IAM until a few months ago.

I'm glad we have bucket-owner-enforced now, but the correct time to add it was 10 years ago.

Reply on news.ycombinator.com