Discussion
Loading...

Discussion

  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
Paco Hope #resist
@paco@infosec.exchange  ·  activity timestamp 3 weeks ago

So, at Amazon, we have a huge ecosystem of internal systems that have all sorts of goofy names and weird interdependencies. A colleague of mine left, I inherited a bunch of his technical assets, and now I have to go around shutting things down, deleting things, etc. But the process is always like:

  1. I get an email "You are the owner of Frobulator Bob1 and it hasn't been baselined in 90 days." Ok. I know Frobulators. This is Bob's old Frobulator. Let me just go to FrobulatorHub and delete it.
  2. "Error: Frobulator Bob1 cannot be deleted because it is still associated with 3 Gronks: g1, g2, g3". Fine. I've used Gronks but I've never deleted one. How do you do that?
  3. Gronks g2 and g3 delete just fine. But I get "Error: Gronk g1 is still commissioned. Decommission it before deleting it." Dammit. How do you decommission Gronks? I go look up the docs.
  4. "As of 2017, Gronks are the new way of managing all your Splorts in one easy place." What the hell are Splorts? I've never even heard of them. Gronk g1 has just 1 Splort in it: s5. I click delete.
  5. "Error: Splort s5 is a legacy Splort that cannot be deleted via Gronks management. Visit the old Splort Fleet page to delete s5." The "new" version launched in 2017, but I have to use the "old" system to delete this thing.
  6. I find s5 on the old Splort Fleet page and delete it.
  7. I go back to Gronks to "decommission" g1. The "decommission" button is greyed out. I look up their FAQ. "FAQ 73: I deleted all my Splorts, why can't I decommission my Gronk?" And the answer is "Splorts may take up to 48 hours to delete. Wait until their status shows as UNGLUNKED in Splort Fleet, then try your delete again."
  8. I go back to Splort Fleet. s5 is in status "UNWINDING." What does that mean!? How many statuses are there? Where is that on the journey to UNGLUNKING? Before? After? Why can't we say "deleting" and "deleted"?

So I give up.

A week later I get another email "You still haven't baselined your Frobulator Bob1 and if you don't do it right now, we will page your director and send an email to your mother." Fuck it. I click the 'baseline' button and everyone stops nagging me.

...90 days later...

I get another email and I just click 'baseline' and move on.

Years later it's like "Paco, why do you have a fleet of 34 Gronks? Most people have 1 or 2" Don't ask me, man. I just work here.

  • Copy link
  • Flag this post
  • Block
Paco Hope #resist
@paco@infosec.exchange replied  ·  activity timestamp 3 weeks ago

And now I have found an S3 bucket with 15M objects in it. That's not that much in the grand scheme of things. I am sure lots of people have bigger buckets. But deleting that many is a pain. The credentials I'm issuing are valid for 60 minutes. And one deletion process seems to do about 1000 objects per API call and about 1 API call/second. If that's accurate, it'll take about 4 hours.

S3 rate limits are per bucket, not per connection or per account. And they're about 3300 per second. So I'm nowhere near that limit. I just have 3 processes all running deleting as much as they can. I only have to do it once, so I'm not bothering to automate it.
#AWS #S3

  • Copy link
  • Flag this comment
  • Block
Mathaetaes
@mathaetaes@infosec.exchange replied  ·  activity timestamp 3 weeks ago

@paco For what it's worth, this is how using AWS feels for everyone. The names aren't always non-descriptive, but they're not always descriptive either. "S3, VPC, Route53". Like, yeah... I know what those are now, but I didn't when I started.

  • Copy link
  • Flag this comment
  • Block
Log in

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.0-rc.3.21 no JS en
Automatic federation enabled
  • Explore
  • About
  • Members
  • Code of Conduct
Home
Login