undefined | Better HN

0 pointscyberax7mo ago0 comments

It's worse than that. The entire DNS ultimately depends on literally one box with the signing key for the root zone.

You eventually get services that need to be global. IAM and DNS are such examples, they have to have a global endpoint because they apply to the global entities. AWS users are not regionalized, an AWS user can use the same key/role to access resources in multiple regions.

0 comments

harshaw7mo ago

not quite true - there are some regions that have a different set of AWS users / credentials. I can't remember what this is called off the top of my head.

cyberaxOP7mo ago

These are different AWS partitions. They are completely separate from each other, requiring separate accounts and credentials.

There's one for China, one for the AWS government cloud, and there are also various private clouds (like the one hosting the CIA data). You can check their list in the JSON metadata that is used to build the AWS clients (e.g. https://github.com/aws/aws-sdk-go-v2/blob/1a7301b01cbf7e74e4... ).

j / k navigate · click thread line to collapse

0 comments

harshaw7mo ago

not quite true - there are some regions that have a different set of AWS users / credentials. I can't remember what this is called off the top of my head.

cyberaxOP7mo ago

These are different AWS partitions. They are completely separate from each other, requiring separate accounts and credentials.

j / k navigate · click thread line to collapse