Hacker News new | past | comments | ask | show | jobs | submit login

Ever worked in government? You won't get (full) admin access there, either.

I thought it was good practice to have strong separation between Dev and Production, and I'm pretty sure you're meant to create AWS keys+accounts with less-than-root access for day-to-day work.




Yes. I create separate roles for different ec2 instances, Lambda expressions, etc. based on least privilege.

With AWS databases - except for DynamoDB - you still use traditional user names/passwords most of the time. Those are stored in ParameterStore and encrypted with keys that not every service has access to. Of course key access is logged.

There is a difference between the root account and an administrator account.

Day to day work on the console is configuring resources.

Even if you do have strong separation -in our case separate VPCs, someone has to have access to administer it. We don't have a separate "network operations" department.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: