Comment by lukeschlather
17 hours ago
I'm sure there are absolutely brilliant people working at Azure. I think the overall system is very badly architected and I don't know what it would take to salvage it. Infra security is a lot easier to do when you have a system that has mostly solved it already, and I'm not saying GCP and AWS are perfect, but "security is mostly solved" is a decent description of their systems, I think. Of course it could all fall over tomorrow, but I'd guess that's a lot more true of Azure.
Security may be solved, but IAM is still a nightmare on both GCP and AWS. Nobody understands what all those privileges / actions / conditions / etc. do. Maybe LLMs pretend to.
AWS and GCP both work pretty well if you avoid conditions, which are a nightmare. Azure is like everything is conditions, and also buggy.
They work, but the documentation is overwhelming. With my last GCP project, I ran into security theater folks that didn't like predefined roles and demanded custom roles with dozens and dozens of granular permissions. Do you think they audited all those permissions? Nope. The simpler predefined roles were just not permitted by their checklists.