Hacker News Reader

Comment by percept | Hacker News Reader

I often wonder about the implications of having the U.S. government (increasingly) running in Amazon's cloud...

You aren't the only one thinking about this. While government certainly does leverage the cloud for certain applications, there are many govt agencies which will never go near it. But, they still want the features of object storage, the clear API, the ability to scale up and distribute the storage easily. I work for a large company that builds and sells "private cloud" infrastructure, and many governments, banks, insurance companies, etc do not want their data out there on public networks or public cloud, even if it is encrypted. They already have IT staff, they have existing data centers, they can handle dropping in new gear and in the long run it will be cheaper for many workloads. The S3 API has become the standard, and other vendors are now implementing it (at least a subset) on their boxes, so you can use applications like Cloudberry against an EMC Atmos or Hitachi HCP, or write 3rd party applications against the S3 API and just change the endpoint as necessary.

This will change over the next decade. James is correct, the costs are simply dropping too fast. The existing constituencies like IT departments with existing data centers will increasingly have a hard time justifying their budgets. This will become more true as new applications that are designed for a cloud environment are written. The only applications I have seen that are really cheaper are 100% CPU bound workloads and there aren't very many of those in real life.

I have a hard time seeing the military and intelligence communities ever putting their data and computing up on Amazon. DMV, Social Security, and police records? Presidential archives? What about concerns such as regulatory compliance? Patient records from hospitals that must comply with HIPAA, and compliance with Sarbanes-Oxley regulation for financial records? Strategy and design documents from multinational corporations? I don't deny that data and compute will continue to move to the cloud over the next decade, but there are some things which may never make that transition.

AWS is HIPAA compliant (http://aws.amazon.com/compliance/). The CIA selected AWS for a large ($600MM) buildout. Strategy and design documents are already in the cloud organically via OneDrive, DropBox and Google Drive. NASDAQ does sell Sarbox compliance as a key feature of its cloud product but I have a hard time seeing how in the long run that will really differentiate.

The reality is that AWS is likely not any less secure than legacy IT infrastructure. It also provides great primitives for writing more secure applications.

Not just the government, probably most of the sites you visit in one way or another link to Amazon. Look at how many sites go down when there's an AWS outage.

What does this mean for personal privacy when most of the services you use are backed by one platform?

This line of thought works with CDNs too.

You make it sound like there is one shared database for everything. AWS does a great job of internal firewalling and separation.

"AWS outage" can mean various things, but there are and have been AZ-wide outages, and given the difficulties of replication and redundancy, there are services which are located (or reliant on -- even if unintentionally) a single AZ.

So yes, much online infrastructure _does_ have AWS dependencies. Sometimes (by way of secondary services) in ways that the operators of the service itself may not be directly aware.

Reply on news.ycombinator.com