Hacker News new | ask | show | jobs
by bashtoni 1713 days ago
I think this question misses the point. Few organisations use just S3 - they use the entire AWS ecosystem, of which S3 plays a central part. The biggest blocker for most enterprises is probably AWS IAM integration.

With S3 I can write a bucket policy that references roles that can be assumed by instances, Lambda functions, people via SSO etc.

With R2, I now need to worry about how to securely distribute credentials to access the buckets, how to rotate those credentials, how to ensure they don't leak. It's perfectly do-able, but it means AWS are always going to have the upper hand.

I'm excited to see some real competition in this space, but switching to R2 has some significant blockers at present. If I was working for Cloudflare on this product, I'd be focusing my effort on how to make integrating R2 with AWS services as simple as possible. I definitely think it's do-able, but it's going to need a team all of its own.
2 comments
axelthegerman 1713 days ago
Fair point, my previous organization also used IAM extensively and I don't know how we could have fulfilled our compliance requirements without it.

That being said, in that case you pay what you get for. S3 is not just storage, it's integrated with the rest of the AWS ecosystem.

But if you write a small service/product that just needs to store and transfer a lot of data 1) IAM is not needed and almost more a burden but 2) you can have it cheaper elsewhere e.g. R2 now

link
RNCTX 1712 days ago
I think you overestimate the number of people who want to so lock themselves into a particular provider that they would use that provider's auth systems.

There are lots of different use cases for lots of different things. Since Cloudflare doesn't have the compute-type services that AWS has, rather is more specifically aimed at web-serving type services, I think their design here makes a lot of sense.

As a user that Cloudflare would target (someone who works on web sites and web-based apps), IAM is an annoyance to me that I would gladly not use on AWS if I could just toggle it off and replace it with a simpler permissions system.

link