AWS Config vs. AWS OpsWorks vs. Lacework

It's really good if your infrastructure services is all in AWS, that means everything could be audited and monitored using AWS config. You also can create alarms to notify you or your team about any changes on your AWS resources which is very useful to prevent abuse if you have a fairly large team. It's also very useful whenever some third party wants to audit your AWS resources, if you have a fairly comprehensive AWS config configured, the auditing process will be easy since they only need to look at your AWS config setup.

Incentivized

Where you already have some Chef recipes to build your application boxes and are happy to run directly on VMs, OpsWorks really shines. It won't do anything too complex for you, so it only really works well for simple stacks (load balancers, application layers, database layers). If you want to do more complex infrastructure, Cloudformation or Terraform are probably worth looking at.

Incentivized

Lacework is well suited for behavioral analysis. One thing to consider thought is in the early stages there will be quite a bit of noise generated by Lacework. There will be a higher volume alerts generated initially - until a good baseline is generated. Overall Lacework is good with alert handling - integration with Slack is good.

Incentivized

• The ability to track changes in AWS is paramount, AWS config allows you to do this
• Allows the auditing of an AWS account
• Can view history of an account that has AWS config enabled

Incentivized

• connect between serveral AWS services (EC2, RDS, ELB)
• easy configuration management deployment via Chef

Incentivized

• Easy to set-up the agent in cloud workloads.
• Easy integration with ticketing and messaging tools.
• Detailed visibility of all our container workloads across multiple accounts.

Incentivized

• It's only AWS, no third party.
• Not the most intuitive interface, but with a little getting used to it is OK.

Incentivized

• Getting up and running with OpsWorks is a very technical and potentially time-consuming process. You need to know the ins and outs of Chef/Puppet if you really want to get into it and there isn't a convenient way to test out the environment locally so debugging can be time-consuming.
• To take advantage of some of the newer AWS instance types you need to be running on a VPC, which again is a pain if you don't have a DevOps team.
• The error logs and monitoring metrics in OpsWorks are pretty basic and haven't changed much over the years.

Incentivized

• UI can be complicated and hard to know where to click to find information.
• Ability to create and manage cases or tickets from events that trigger.

Would rate lower for other workloads but for AWS workloads its simple to set up, cost effective and customisable. Primary use case is compliance from a governance perspective.

Incentivized

Unless you pay for a pricey support package getting support on OpsWorks will be pretty slow. Documentation is also relatively limited and sometimes hard to follow when compared to competitors. Generally, we've been able to get the answers we need from OpsWorks support when we run into problems but don't expect rapid responses.

Incentivized

I do not know or have used any other product in AWS cloud space that matches what AWS Config provides. We have some custom built monitoring and governance, however that is there because AWS Config does not provide it currently.

Incentivized

OpsWorks isn't really a direct competitor to Terraform/Cloudformation, but it does allow you to do some of the more simple things on offer quite quickly and effectively. Opsworks was used for this reason, along with existing internal knowledge of Chef. Along with some of the other services on offer from AWS, it is good to use as a stepping stone along the way when building your systems - or perhaps it would be entirely suitable for a fairly simple project.

Incentivized

Compared to Sysdig Falco (the free open-source IDS), Lacework helps security teams by providing actionable alerts and a user-friendly interface that gives you an overview of all workloads being monitored, and detailed insights into these workloads if needed. Falco requires you to build your own integration and interface around it, including a mechanism to whitelist certain alerts. This made it harder for the security team to focus their time on potential intrusions.

Incentivized

• Enforcing audit requirements
• Easy to set up alerting when there are rule breaches
• Auto remediation reduces the manual policing of such breaches

Incentivized

• very quick way of creating new infrastructure
• low maintenance costs
• easy to create high availability setups thus reducing costs

Incentivized

• Being a FinTech company, financial institutions who partner with us want to know that we are appropriately maintaining a Security, Risk and Compliance program that maintains a level of comfort for their vendor management. Lacework gives us the ability to monitor and maintain a level of security for our infrastructure that puts our partners at ease, reduces the revenue cycle for new partners and opens doors to the future.