Granted, Common Fate, and AWS Functionality with Chris Norman

Chris is a robotics engineer turned cloud security practitioner. From building origami robots for NASA, to neuroscience wearables, to enterprise software consulting, he is a passionate builder at heart. Chris is a cofounder of Common Fate, a company with a mission to make cloud access simple and secure.

Announcer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.

Corey: Let’s face it, on-call firefighting at 2am is stressful! So there’s good news and there’s bad news. The bad news is that you probably can’t prevent incidents from happening, but the good news is that incident.io makes incidents less stressful and a lot more valuable. incident.io is a Slack-native incident management platform that allows you to automate incident processes, focus on fixing the issues and learn from incident insights to improve site reliability and fix your vulnerabilities. Try incident.io, recover faster and sleep more.

Corey: This episode is sponsored in part by Honeycomb. When production is running slow, it’s hard to know where problems originate. Is it your application code, users, or the underlying systems? I’ve got five bucks on DNS, personally. Why scroll through endless dashboards while dealing with alert floods, going from tool to tool to tool that you employ, guessing at which puzzle pieces matter? Context switching and tool sprawl are slowly killing both your team and your business. You should care more about one of those than the other; which one is up to you. Drop the separate pillars and enter a world of getting one unified understanding of the one thing driving your business: production. With Honeycomb, you guess less and know more. Try it for free at honeycomb.io/screaminginthecloud. Observability: it’s more than just hipster monitoring.

Corey: Welcome to Screaming in the Cloud. I’m Corey Quinn. It doesn’t matter where you are on your journey in cloud—you could never have heard of Amazon the bookstore—and you encounter AWS and you spin up an account. And within 20 minutes, you will come to the realization that everyone in this space does. “Wow, logging in to AWS absolutely blows goats.”

Today, my guest, obviously had that reaction, but unlike most people I talked to, decided to get up and do something about it. Chris Norman is the co-founder of Common Fate and most notably to how I know him is one of the original authors of the tool, Granted. Chris, thank you so much for joining me.

Chris: Hey, Corey, thank you for having me.

Corey: I have done podcasts before; I have done a blog post on it; I evangelize it on Twitter constantly, and even now, it is challenging in a few ways to explain holistically what Granted is. Rather than trying to tell your story for you, when someone says, “Oh, Granted, that seems interesting and impossible to Google for in isolation, so therefore, we know it’s going to be good because all the open-source projects with hard to find names are,” what is Granted and what does it do?

Chris: Granted is a command-line tool which makes it really easy for you to get access and assume roles when you’re working with AWS. For me, when I’m using Granted day-to-day, I wake up, go to my computer—I’m working from home right now—crack open the MacBook and I log in and do some development work. I’m going to go and start working in the cloud.

Corey: Oh, when I start first thing in the morning doing development work and logging into the cloud, I know. All right, I’m going to log in to AWS and now I know that my day is going downhill from here.

Chris: [laugh]. Exactly, exactly. I think maybe the best days are when you don’t need to log in at all. But when you do, I go and I open my terminal and I run this command. Using Granted, I ran this assume command and it authenticates me with single-sign-on into AWS, and then it opens up a console window in a particular account.

Now, you might ask, “Well, that’s a fairly standard thing.” And in fact, that’s probably the way that the console and all of the tools work by default with AWS. Why do you need a third-party tool for this?

Corey: Right. I’ve used a bunch of things that do varying forms of this and unlike Granted, you don’t see me gushing about them. I want to be very clear, we have no business relationship. You’re not sponsoring anything that I do. I’m not entirely clear on what your day job entails, but I have absolutely fallen in love with the Granted tool, which is why I’m dragging you on to this show, kicking and screaming, mostly to give me an excuse to rave about it some more.

Chris: [laugh]. Exactly. And thank you for the kind words. And I’d say really what makes it special or why I’ve been so excited to be working on it is that it makes this access, particularly when you’re working with multiple accounts, really, really easy. So, when I run assume and I open up that console window, you know, that’s all fine and that’s very similar to how a lot of the other tools and projects that are out there work, but when I want to open that second account and that second console window, maybe because I’m looking at like a development and a staging account at the same time, then Granted allows me to view both of those simultaneously in my browser. And we do that using some platform sort of tricks and building into the way that the browser works.

Corey: Honestly, one of the biggest differences in how you describe what Granted is and how I view it is when you describe it as a CLI application because yes, it is that, but one of the distinguishing characteristics is you also have a Firefox extension that winds up leveraging the multi-container functionality extension that Firefox has. So, whenever I wind up running a single command—assume with a-c’ flag, then I give it the name of my AWS profile, it opens the web console so I can ClickOps my heart’s content inside of a tab that is locked to a container, which means I can have one or two or twenty different AWS accounts and/or regions up running simultaneously side-by-side, which is basically impossible any other way that I’ve ever looked at it.

Chris: Absolutely, yeah. And that’s, like, the big differentiating factor right now between Granted and between this sort of default, the native experience, if you’re just using the AWS command line by itself. With Granted, you can—with these Firefox containers, all of your cookies, your profile, everything is all localized into that one container. It’s actually it’s a privacy features that are built into Firefox, which keeps everything really separate between your different profiles. And what we’re doing with Granted is that we make it really easy to open a specific profiles that correspond with different AWS profiles that you’re using.

So, you’d have one which could be your development account, one which could be production or staging. And you can jump between these and navigate between them just as separate tabs in your browser, which is a massive improvement over, you know, what I’ve previously had to use in the past.

Corey: The thing that really just strikes me about this is first, of course, the functionality and the rest, so I saw this—I forget how I even came across it—and immediately I started using it. On my Mac, it was great. I started using it when I was on the road, and it was less great because you built this thing in Go. It can compile and install on almost anything, but there were some assumptions that you had built into this in its early days that did not necessarily encompass all of the use cases that I use. For example, it hadn’t really occurred to you that some lunatic would try and only use an iPad when they’re on the road, so they have to be able to run this to get federated login links via SSHing into an EC2 instance running somewhere and not have it open locally.

You seemed almost taken aback when I brought it up. Like, “What lunatic would do that?” Like, “Hi, I’m such a lunatic. Let’s talk about this.” And it does that now, and it’s awesome. It does seem to me though, and please correct me if I’m wrong on this assumption slash assessment that this is first and foremost aimed at desktop users, specifically people running Mac on the desktop, is that the genesis of it?

Chris: It is indeed. And I think part of the cause behind that is that we originally built a tool for ourselves. And as we were building things and as we were working using the cloud, we were running things—you know, we like to think that we’re following best practices when we’re using AWS, and so we’d set up multiple accounts, we’d have a special account for development, a separate one for staging, a separate one for production, even internal tools that we would build, we would go and spin up an individual account for those. And then you know, we had lots of accounts. and to go and access those really easily was quite difficult.

So, we definitely, we built it for ourselves first and I think that that’s part of when we released it, it actually a little bit of cause for some of the initial problems. And some of the feedback that we had was that it’s great to build tools for yourself, but when you’re working in open-source, there’s a lot of different diversity with how people are using things.

Corey: We take different approaches. You want to try to align with existing best practices, whereas I am a loudmouth white guy who works in tech. So, what I do definitionally becomes a best practice in the ecosystem. It’s easier to just comport with the ones that are already existing that smart people put together rather than just trying to competence your way through it, so you took a better path than I did.

But there’s been a lot of evolution to Granted as I’ve been using it for a while. I did a whole write-up on it and that got a whole bunch of eyes onto the project, which I can now admit was a nefarious plan on my part because popping into your community Slack and yelling at you for features I want was all well and good, but let’s try and get some people with eyes on this who are smarter than me—which is not that high of a bar when it comes to SSO, and IAM, and federated login, and the rest—and they can start finding other enhancements that I’ll probably benefit from. And sure enough, that’s exactly what happened. My sneaky plan has come to fruition. Thanks for being a sucker, I guess. I mean—[laugh] it worked. I’m super thrilled by the product.

Chris: [laugh]. I guess it’s a great thing I think that the feedback and particularly something that’s always been really exciting is just seeing new issues come through on GitHub because it really shows the kinds of interesting use cases and the kinds of interesting teams and companies that are using Granted to make their lives a little bit easier.

Corey: When I go to the website—which again is impossible to Google—the website for those wondering is granted.dev. It’s short, it’s concise, I can say it on a podcast and people automatically know how to spell it. But at the top of the website—which is very well done by the way—it mentions that oh, you can, “Govern access to breakglass roles with Common Fate Cloud,” and it also says in the drop shadow nonsense thing in the upper corner, “Brought to you by Common Fate,” which is apparently the name of your company.

So, the question I’ll get to in a second is what does your company do, but first and foremost, is this going to be one of those rug-pull open-source projects where one day it’s, “Oh, you want to log into your AWS accounts? Insert quarter to continue.” I’m mostly being a little over the top with that description, but we’ve all seen things that we love turn into molten garbage. What is the plan around this? Are you about to ruin this for the rest of us once you wind up raising a round or something? What’s the deal?

Chris: Yeah, it’s a great question, Corey. And I think that to a degree, releasing anything like this that sits in the access workflow and helps you assume roles and helps you day-to-day, you know, we have a responsibility to uphold stability and reliability here and to not change things. And I think part of, like, not changing things includes not [laugh] rug-pulling, as you’ve alluded to. And I think that for some companies, it ends up that open-source becomes, like, a kind of a lead-generation tool, or you end up with, you know, now finally, let’s go on add another login so that you have to log into Common Fate to use Granted. And I think that, to be honest, a tool like this where it’s all about improving the speed of access, the incentives for us, like, it doesn’t even make sense to try and add another login for to try to get people to, like, to say, login to Common Fate because that would make your signing process for AWS take even longer than it already does.

Corey: Yeah, you decided that you know, what’s the biggest problem? Oh, you can sleep at night, so let’s go ahead and make it even worse, by now I want you to be this custodian of all my credentials to log into all of my accounts. And now you’re going to be critical path, so if you’re down, I’m not able to log into anything. And oh, by the way, I have to trust you with full access to my bank stuff. I just can’t imagine that is a direction that you would be super excited about diving head-first into.

Chris: No, no. Yeah, certainly not. And I think that the, you know, building anything in this space, and with what we’re doing with Common Fate, you know, we’re building a cloud platform to try to make IAM a little bit easier to work with, but it’s really sensitive around granting any kind of permission and I think that you really do need that trust. So, trying to build trust, I guess, with our open-source projects is really important for us with Granted and with this project, that it’s going to continue to be reliable and continue to work as it currently does.

Corey: The way I see it, one of the dangers of doing anything that is particularly open-source—or that leans in the direction of building in Amazon’s ecosystem—it leads to the natural question of, well, isn’t this just going to be some people say stolen—and I don’t think those people understand how open-source works—by AWS themselves? Or aren’t they going to build something themselves at AWS that’s going to wind up stomping this thing that you’ve built? And my honest and remarkably cynical answer is that, “You have built a tool that is a joy to use, that makes logging into AWS accounts streamlined and efficient in a variety of different patterns. Does that really sound like something AWS would do?” And followed by, “I wish they would because everyone would benefit from that rising tide.”

I have to be very direct and very clear. Your product should not exist. This should be something the provider themselves handles. But nope. Instead, it has to exist. And while I’m glad it does, I also can’t shake the feeling that I am incredibly annoyed by the fact that it has to.

Chris: Yeah. Certainly, certainly. And it’s something that I think about a little bit. I like to wonder whether there’s maybe like a single feature flag or some single sort of configuration setting in AWS where they’re not allowing different tabs to access different accounts, they’re not allowing this kind of concurrent access. And maybe if we make enough noise about Granted, maybe one of the engineers will go and flick that switch and they’ll just enable it by default.

And then Granted itself will be a lot less relevant, but for everybody who’s using AWS, that’ll be a massive win because the big draw of using Granted is mainly just around being able to access different accounts at the same time. If AWS let you do that out of the box, hey, that would be great and, you know, I’d have a lot less stuff to maintain.

Corey: Originally, I had you here to talk about Granted, but I took a glance at what you’re actually building over at Common Fate and I’m about to basically hijack slash derail what probably is going to amount the rest of this conversation because you have a quick example on your site for by developers, for developers. You show a quick Python script that tries to access a S3 bucket object and it’s denied. You copy the error message, you paste it into what you’re building over a Common Fate, and in return, it’s like, “Oh. Yeah, this is the policy that fixes it. Do you want us to apply it for you?”

And I just about fell out of my chair because I have been asking for this explicit thing for a very long time. And AWS doesn’t do it. Their IAM access analyzer claims to. Like, “Oh, just go look at CloudTrail and see what permissions it uses and we’ll build a policy to scope it down.” “Okay. So, it’s S3 access. Fair enough. To what object or what bucket?” “Guess,” is what it tells you there.

And it’s, this is crap. Who thinks this is a good user experience? You have built the thing that I wish AWS had built in natively. Because let’s be honest here, I do what an awful lot of people do and overscope permissions massively just because messing around with the bare minimum set of permissions in many cases takes more time than building the damn thing in the first place.

Chris: Oh, absolutely. Absolutely. And in fact, this—was a few years ago when I was consulting—I had a really similar sort of story where one of the clients that we were working with, the CTO of this company, he was needing to grant us access to AWS and we were needing to build a particular service. And he said, “Okay, can you just let me know the permissions that you will need and I’ll go and deploy the role for this.” And I came back and I said, “Wait. I don’t even know the permissions that I’m going to need because the damn thing isn’t even built yet.”

So, we went sort of back and forth around this. And the compromise ended up just being you know, way too much access. And that was sort of part of the inspiration for, you know, really this whole project and what we’re building with Common Fate, just trying to make that feedback loop around getting to the right level of permissions a lot faster.

Corey: Yeah, I am just so overwhelmingly impressed by the fact that you have built—and please don’t take this as a criticism—but a set of very simple tools. Not simple in the terms of, “Oh, that’s, like, three lines of bash, and a fool could write that on a weekend.” No. Simple in the sense of it solves a problem elegantly and well and it’s straightforward—well, straightforward as anything in the world of access control goes—to wrap your head around exactly what it does. You don’t tend to build these things by sitting around a table brainstorming with someone you met at co-founder dating pool or something and wind up figuring out, “Oh, we should go and solve that. That sounds like a billion-dollar problem.”

This feels very much like the outcome of when you’re sitting around talking to someone and let’s start by drinking six beers so we become extraordinarily honest, followed immediately by let’s talk about what sucks. What pisses you off the most? It feels like this is sort of the low-hanging fruit of things that upset people when it comes to AWS. I mean, if things had gone slightly differently, instead of focusing on AWS bills, IAM was next on my list of things to tackle just because I was tired of smacking my head into it.

This is very clearly a problem space that you folks have analyzed deeply, worked within, and have put a lot of thought into. I want to be clear, I’ve thrown a lot of feature suggestions that you for Granted from start to finish. But all of them have been around interface stuff and usability and expanding use cases. None of them have been, “Well, that seems screamingly insecure.” Because it hasn’t been.

Chris: [laugh].

Corey: It has been effective, start to finish, I think that from a security posture, you make terrific choices, in many cases better than ones I would have made a starting from scratch myself. Everything that I’m looking at in what you have built is from a position of this is absolutely amazing and it is transformative to my own workflows. Now, how can we improve it?

Chris: Mmm. Thank you, Corey. And I’ll say as well, maybe around the security angle, that one of the goals with Granted was to try and do things a little bit better than the default way that AWS does them when it comes to security. And it’s actually been a bit of a source for challenges with some of the users that we’ve been working with with Granted because one of the things we wanted to do was encrypt the SSO token. And this is the token that when you sign in to AWS, kind of like, it allows you to then get access to all of the rest of the accounts.

So, it’s like a pretty—it’s a short-lived token, but it’s a really sensitive one. And you know, by default, it’s just stored in plain text on your disk. So, we dump to a file and, you know, anything that can go and read that, they can go and get it. It’s also a little bit hard to revoke and to lock people out. There’s not really great workflows around that on AWS’s side.

So, we thought, “Okay, great. One of the goals for Granted can be that we will go and store this in your keychain in your system and we’ll work natively with that.” And that’s actually been a cause for a little bit of a hassle for some users, though, because by doing that and by storing all of this information in the keychain, it’s actually broken some of the integrations with the rest of the tooling, which kind of expects tokens and things to be in certain places. So, we’ve actually had to, as part of dealing with that with Granted, we’ve had to give users the ability to opt out for that.

Corey: DoorDash had a problem. As their cloud-native environment scaled and developers delivered new features, their monitoring system kept breaking down. In an organization where data is used to make better decisions about technology and about the business, losing observability means the entire company loses their competitive edge. With Chronosphere, DoorDash is no longer losing visibility into their applications suite. The key? Chronosphere is an open-source compatible, scalable, and reliable observability solution that gives the observability lead at DoorDash business, confidence, and peace of mind. Read the full success story at snark.cloud/chronosphere. That's snark.cloud slash C-H-R-O-N-O-S-P-H-E-R-E.

Corey: That’s why I find this so, I think, just across the board, fantastic. It’s you are very clearly engaged with your community. There’s a community Slack that you have set up for this. And I know, I know, too many Slacks; everyone has this problem. This is one of those that is worth hanging in, at least from my perspective, just because one of the problems that you have, I suspect, is on my Mac it’s great because I wind up automatically updating it to whatever the most recent one is every time I do a brew upgrade.

But on the Linux side of the world, you’ve discovered what many of us have discovered, and that is that packaging things for Linux is a freaking disaster. The current installation is, “Great. Here’s basically a curl bash.” Or, “Here, grab this tarball and install it.” And that’s fine, but there’s no real way of keeping that updated and synced.

So, I was checking the other day, oh wow, I’m something like eight versions behind on this box. But it still just works. I upgraded. Oh, wow. There’s new functionality here. This is stuff that’s actually really handy. I like this quite a bit. Let’s see what else we can do.

I’m just so impressed, start to finish, by just how receptive you’ve been to various community feedbacks. And as well—I want to be very clear on this point, too—I’ve had folks who actually know what they’re doing in an InfoSec sense look at what you’re up to, and none of them had any issues of note. I’m sure that they have a pile of things like, with that curl bash, they should really be doing a GPG check. Yes, yes, fine. Whatever. If that’s your target threat model, okay, great. Here in reality-land for what I do, this is awesome.

And they don’t seem to have any problems with, “Oh, yeah. By the way, sending analytics back up”—which, okay, fine, whatever. “And it’s not disclosing them.” Okay, that’s bad. “And it’s including the contents of your AWS credentials.”

Ahhhh. I did encounter something that was doing that on the back-end once. [cough]—Serverless Framework—sorry, something caught in my throat for a second.

Chris: [laugh].

Corey: No faster way I can think of to erode trust in that. But everything you’re doing just makes sense.

Chris: Oh, I do remember that. And that was a little bit of a fiasco, really, around all of that, right? And it’s great to hear actually around that InfoSec folks and security people being, you know, not unhappy, I guess, with a tool like this. It’s been interesting for me personally. We’ve really come from a practitioner’s background.

You know, I wouldn’t call myself a security engineer at all. I would call myself as a sometimes a software developer, I guess. I have been hacking my way around Go and definitely learning a lot about how the cloud has worked over the past seven, eight years or so, but I wouldn’t call myself a security engineer, so being very cautious around how all of these things work. And we’ve really tried to defer to things like the system keychain and defer to things that we know are pretty safe and work.

Corey: The thing that I also want to call out as well is that your licensing is under the MIT license. This is not one of those, “Oh, you’re required to wind up doing a bunch of branding stuff around it.” And, like some people say, “Oh, you have to own the trademark for all of these things.” I mean, I’m not an expert in international trademark law, let’s be very clear, but I also feel that trademarking a term that is already used heavily in the space such as the word ‘Granted,’ feels like kind of an uphill battle. And let’s further be clear that it doesn’t matter what you call this thing.

In fact, I will call attention to an oddity that I’ve encountered a fair bit. After installing it, the first thing you do is you run the command ‘granted.’ That sets it up, it lets you configure your browser, what browser you want to use, and it now supports standard out for that headless, EC2 use case. Great. Awesome. Love it. But then the other binary that ships with it is Assume. And that’s what I use day-to-day. It actually takes me a minute sometimes when it’s been long enough to remember that the tool is called Granted and not Assume what’s up with that?

Chris: So, part of the challenge that we ran into when we were building the Granted project is that we needed to export some environment variables. And these are really important when you’re logging into AWS because you have your access key, your secret key, your session token. All of those, when you run the assume command, need to go into the terminal session that you called it. This doesn’t matter so much when you’re using the console mode, which is what we mentioned earlier where you can open 100 different accounts if you want to view all of those at the same time in your browser. But if you want to use it in your terminal, we wanted to make it look as really smooth and seamless as possible here.

And we were really inspired by this approach from—and I have to shout them out and kind of give credit to them—a tool called AWSume—they’re spelled A-W-S-U-M-E—Python-based tool that they don’t do as much with single-sign-on, but we thought they had a really nice, like, general approach to the way that they did the scripting and aliasing. And we were inspired by that and part of that means that we needed to have a shell script that called this executable, which then will export things back out into the shell script. And we’re doing all this wizardry under the hood to make the user experience really smooth and seamless. Part of that meant that we separated the commands into granted and assume and the other part of the naming for everything is that I felt Granted had a far better ring to it than calling the whole project Assume.

Corey: True. And when you say assume, is it AWS or not? I’ve used the AWSume project before; I’ve used AWS Vault out of 99 Designs for a while. I’ve used—for three minutes—the native AWS SSO config, and that is just trash. Again, they’re so good at the plumbing, so bad at the porcelain, I think is the criticism that I would levy toward a lot of this stuff.

Chris: Mmm.

Corey: And it’s odd to think there’s an entire company built around just smoothing over these sharp, obnoxious edges, but I’m saying this as someone who runs a consultancy and have five years that just fixes the bill for this one company. So, there’s definitely a series of cottage industries that spring up around these things. I would be thrilled, on some level, if you wound up being completely subsumed by their product advancements, but it’s been 15 years for a lot of this stuff and we’re still waiting. My big failure mode that I’m worried about is that you never are.

Chris: Yeah, exactly, exactly. And it’s really interesting when you think about all of these user experience gaps in AWS being opportunities for, I guess, for companies like us, I think, trying to simplify a lot of the complexity for things. I’m interested in sort of waiting for a startup to try and, like, rebuild the actual AWS console itself to make it a little bit faster and easier to use.

Corey: It’s been done and attempted a bunch of different times. The problem is that the console is a lot of different things to a lot of different people, and as you step through that, you can solve for your use case super easily. “Yeah, what do I care? I use RDS, I use some VPC nonsense, and I use EC2. The end.” “Great. What about IAM?”

Because I promise you’re using that whether you know it or not. And okay, well, I’m talking to someone else who’s DynamoDB, and someone else is full-on serverless, and someone else has more money than sense, so they mostly use SageMaker, and so on and so forth. And it turns out that you’re effectively trying to rebuild everything. I don’t know if that necessarily works.

Chris: Yeah, and I think that’s a good point around maybe while we haven’t seen anything around that sort of space so far. You go to the console, and you click down, you see that list of 200 different services and all of those have had teams go and actually, like, build the UI and work with those individual APIs. Yeah.

Corey: Any ideas as far as what’s next for features on Granted?

Chris: I think that, for us, it’s continuing to work with everybody who’s using it, and with a focus of stability and performance. We actually had somebody in the community raise an issue because they have an AWS config file that’s over 7000 lines long. And I kind of pity that person, potentially, for their day-to-day. They must deal with so much complexity. Granted is currently quite slow when the config files get very big. And for us, I think, you know, we built it for ourselves; we don’t have that many accounts just yet, so working to try to, like, make it really performant and really reliable is something that’s really important.

Corey: If you don’t mind a feature request while we’re at it—and I understand that this is more challenging than it looks like—I’m willing to fund this as a feature bounty that makes sense. And this also feels like it might be a good first project for a very particular type of person, I would love to get tab completion working in Zsh. You have it—

Chris: Oh.

Corey: For Fish because there’s a great library that automatically populates that out, but for the Zsh side of it, it’s, “Oh, I should just wind up getting Zsh completion working,” and I fell down a rabbit hole, let me tell you. And I come away from this with the perception of yeah, I’m not going to do it. I have not smart enough to check those boxes. But a lot of people are so that is the next thing I would love to see. Because I will change my browser to log into the AWS console for you, but be damned if I’m changing my shell.

Chris: [laugh]. I think autocomplete probably should be higher on our roadmap for the tool, to be honest because it’s really, like, a key metric and what we’re focusing on is how easy is it to log in. And you know, if you’re not too sure what commands to use or if we can save you a few keystrokes, I think that would be the, kind of like, reaching our goals.

Corey: From where I’m sitting, you definitely have. I really want to thank you for taking the time to not only build this in the first place, but also speak with me about it. If people want to learn more, where’s the best place to find you?

Chris: So, you can find me on Twitter, I’m @chr_norm, or you can go and visit granted.dev and you’ll have a link to join the Slack community. And I’m very active on the Slack.

Corey: You certainly are, although I will admit that I fall into the challenge of being in just the perfectly opposed timezone from you and your co-founder, who are in different time zones to my understanding; one of you is on Australia and one of you was in London; you’re the London guy as best I’m aware. And as a result, invariably, I wind up putting in feature requests right when no one’s around. And, for better or worse, in the middle of the night is not when I’m usually awake trying to log into AWS. That is Azure time.

Chris: [laugh]. Yeah, no, we don’t have the US time zone properly covered yet for our community support and help. But we do have a fair bit of the world timezone covered. The rest of the team for Common Fate is all based in Australia and I’m out here over in London.

Corey: Yeah. I just want to thank you again, for just being so accessible and, like, honestly receptive to feedback. I want to be clear, there’s a way to give feedback and I do strive to do it constructively. I didn’t come crashing into your Slack one day with a, “You know what your problem is?” I prefer to take the, “This is awesome. Here’s what I think would be even better. Does that make sense?” As opposed to the imperious demands and GitHub issues and whatnot? It’s, “I’d love it if it did this thing. Doesn’t do this thing. Can you please make it do this thing?” Turns out that’s the better way to drive change. Who knew?

Chris: Yeah. [laugh]. Yeah, definitely. And I think that one of the things that’s been the best around our journey with Granted so far has been listening to feedback and hearing from people how they would like to use the tool. And a big thank you to you, Corey, for actually suggesting changes that make it not only better for you, but better for everybody else who’s using Granted.

Corey: Well, at least as long as we’re using my particular byzantine workload patterns in some way, or shape, or form, I’ll hear that. But no, it’s been an absolute pleasure and I really want to thank you for your time as well.

Chris: Yeah, thank you for having me.

Corey: Chris Norman, co-founder of Common Fate, as well as one of the two primary developers originally behind the Granted project that logs you into AWS without you having to lose your mind. I’m Cloud Economist Corey Quinn and this is Screaming in the Cloud. If you’ve enjoyed this podcast, please leave a five-star review on your podcast platform of choice, whereas if you’ve hated this podcast, please leave a five-star review on your podcast platform of choice along with an angry, incensed, raging comment that talks about just how terrible all of this is once you spend four hours logging into your AWS account by hand first.

Corey: If your AWS bill keeps rising and your blood pressure is doing the same, then you need The Duckbill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duckbill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.

Announcer: This has been a HumblePod production. Stay humble.