1 1 00:00:00,300 --> 00:00:04,350 Infrastructure as code or IAC. 2 2 00:00:04,350 --> 00:00:06,690 Now, when we talk about infrastructure as code 3 3 00:00:06,690 --> 00:00:08,610 this is a provisioning architecture 4 4 00:00:08,610 --> 00:00:10,710 in which the deployment of resources is performed 5 5 00:00:10,710 --> 00:00:13,170 by scripted automation and orchestration. 6 6 00:00:13,170 --> 00:00:15,300 Now, we mentioned the fact that we use scripted automation 7 7 00:00:15,300 --> 00:00:18,300 and orchestration in cloud computing all the time. 8 8 00:00:18,300 --> 00:00:19,170 And when we do that 9 9 00:00:19,170 --> 00:00:21,540 we're really doing infrastructure as code. 10 10 00:00:21,540 --> 00:00:23,910 Now, this is key to the DevSecOps culture, 11 11 00:00:23,910 --> 00:00:25,800 because it gives our teams the ability 12 12 00:00:25,800 --> 00:00:29,010 to rapidly deploy things within the timeframe 13 13 00:00:29,010 --> 00:00:30,300 of what they're working on. 14 14 00:00:30,300 --> 00:00:32,730 And because they have operations personnel already there 15 15 00:00:32,730 --> 00:00:35,610 and security personnel already there as part of that team 16 16 00:00:35,610 --> 00:00:38,880 it's not any less secure by doing infrastructure as code. 17 17 00:00:38,880 --> 00:00:41,670 In fact, you'll find it's actually more secure. 18 18 00:00:41,670 --> 00:00:43,320 Now, why is it more secure? 19 19 00:00:43,320 --> 00:00:45,930 Well, because it allows for the use of scripted approaches 20 20 00:00:45,930 --> 00:00:48,120 to provisioning infrastructure in the cloud. 21 21 00:00:48,120 --> 00:00:49,380 And the great things about scripts 22 22 00:00:49,380 --> 00:00:50,700 is they don't make mistakes. 23 23 00:00:50,700 --> 00:00:53,640 Once you have a script and you know it's working and secure 24 24 00:00:53,640 --> 00:00:56,130 it's going to run that way every single time. 25 25 00:00:56,130 --> 00:00:57,630 So this is going to allow you to get a lot 26 26 00:00:57,630 --> 00:00:58,860 of those configurations done 27 27 00:00:58,860 --> 00:01:02,010 and the provisioning done in a much more secure manner. 28 28 00:01:02,010 --> 00:01:04,230 Now, when we talk about infrastructure as code 29 29 00:01:04,230 --> 00:01:06,870 it really comes down to three key areas. 30 30 00:01:06,870 --> 00:01:09,540 Part of this is going to be those scripts I just talked about. 31 31 00:01:09,540 --> 00:01:11,190 Part of it's going to be security templates, 32 32 00:01:11,190 --> 00:01:13,020 and part of it is going to be policies. 33 33 00:01:13,020 --> 00:01:15,690 And by applying these three against your infrastructure 34 34 00:01:15,690 --> 00:01:17,490 using this approach you're going to have 35 35 00:01:17,490 --> 00:01:19,680 much more secure infrastructure. 36 36 00:01:19,680 --> 00:01:21,090 Now, when we talk about this 37 37 00:01:21,090 --> 00:01:23,460 we are going to have to think about our orchestration. 38 38 00:01:23,460 --> 00:01:26,280 And if you have robust orchestration where you've tested it 39 39 00:01:26,280 --> 00:01:27,660 and you know it works well, 40 40 00:01:27,660 --> 00:01:29,790 then you can lower your overall IT costs, 41 41 00:01:29,790 --> 00:01:32,520 speed up your deployments, and you can increase security. 42 42 00:01:32,520 --> 00:01:34,440 So this is really a win-win-win. 43 43 00:01:34,440 --> 00:01:36,300 It's all goodness here. 44 44 00:01:36,300 --> 00:01:37,980 Now, one of the things you have to be careful though 45 45 00:01:37,980 --> 00:01:39,810 when you're doing this infrastructure as code, 46 46 00:01:39,810 --> 00:01:42,150 because we're using templates and standardization 47 47 00:01:42,150 --> 00:01:44,730 for everything is people who want to have 48 48 00:01:44,730 --> 00:01:46,410 their special snowflakes. 49 49 00:01:46,410 --> 00:01:48,150 Now, when I talk about special snowflakes 50 50 00:01:48,150 --> 00:01:51,420 you have people who think they just have the best idea 51 51 00:01:51,420 --> 00:01:53,100 and therefore they have to be able to go 52 52 00:01:53,100 --> 00:01:54,510 and create their own infrastructure 53 53 00:01:54,510 --> 00:01:55,860 the way they want to do it. 54 54 00:01:55,860 --> 00:01:57,750 And they don't care about your standardization 55 55 00:01:57,750 --> 00:02:00,630 and your scripting and all the efficiencies you've gained. 56 56 00:02:00,630 --> 00:02:03,150 And so they create something that is a one-off system. 57 57 00:02:03,150 --> 00:02:06,030 Now, when you're a big advocate for using orchestration, 58 58 00:02:06,030 --> 00:02:08,580 and using scripts, and using standardization 59 59 00:02:08,580 --> 00:02:10,920 sometimes you're going to face some friction at work, 60 60 00:02:10,920 --> 00:02:12,660 because somebody thinks they have a better idea 61 61 00:02:12,660 --> 00:02:14,850 and they have this special snowflake system 62 62 00:02:14,850 --> 00:02:16,230 that they just have to have, 63 63 00:02:16,230 --> 00:02:18,420 and they can't use your standard templates. 64 64 00:02:18,420 --> 00:02:19,710 Now, when that happens, you end up 65 65 00:02:19,710 --> 00:02:21,510 with a special snowflake system. 66 66 00:02:21,510 --> 00:02:23,370 And these snowflake systems or any system 67 67 00:02:23,370 --> 00:02:25,260 that is different from the configuration, 68 68 00:02:25,260 --> 00:02:26,910 that's compared to the standard template 69 69 00:02:26,910 --> 00:02:29,190 within the infrastructure as code architecture. 70 70 00:02:29,190 --> 00:02:32,190 Now, the problem with this is it adds to security problems. 71 71 00:02:32,190 --> 00:02:33,660 It adds to configuration problems 72 72 00:02:33,660 --> 00:02:35,400 and supportability problems. 73 73 00:02:35,400 --> 00:02:37,470 This lack of consistency is going to lead 74 74 00:02:37,470 --> 00:02:40,620 to a lot of issues for you, especially in terms of security 75 75 00:02:40,620 --> 00:02:42,930 and inefficiencies in supporting it. 76 76 00:02:42,930 --> 00:02:45,780 This is because once you have a one-off system, 77 77 00:02:45,780 --> 00:02:48,510 it's unique and it doesn't apply to everything else. 78 78 00:02:48,510 --> 00:02:50,190 Think about if you're in a large environment 79 79 00:02:50,190 --> 00:02:51,150 that's operating in the cloud 80 80 00:02:51,150 --> 00:02:53,310 and you have thousands of virtual machines, 81 81 00:02:53,310 --> 00:02:55,260 and out of those thousands of virtual machines, 82 82 00:02:55,260 --> 00:02:56,640 one is different. 83 83 00:02:56,640 --> 00:02:58,890 When somebody calls up and says something isn't working, 84 84 00:02:58,890 --> 00:03:00,810 you have to figure out is it that one exception, 85 85 00:03:00,810 --> 00:03:03,630 or is it the thousands of others that are all working? 86 86 00:03:03,630 --> 00:03:05,490 And that becomes more of a support issue for you, 87 87 00:03:05,490 --> 00:03:07,770 and it leads to a lot of security headaches. 88 88 00:03:07,770 --> 00:03:09,000 Now the last thing we need to talk 89 89 00:03:09,000 --> 00:03:12,510 about in terms of infrastructure as code is it idempotence. 90 90 00:03:12,510 --> 00:03:14,880 Now, this is a property of infrastructure as code 91 91 00:03:14,880 --> 00:03:17,340 that automation or orchestration action is always 92 92 00:03:17,340 --> 00:03:19,110 going to produce the same result, 93 93 00:03:19,110 --> 00:03:21,630 regardless of the component's previous state. 94 94 00:03:21,630 --> 00:03:24,210 Essentially, every time you give this input 95 95 00:03:24,210 --> 00:03:26,370 you should expect this output. 96 96 00:03:26,370 --> 00:03:28,350 Anytime you call up this script 97 97 00:03:28,350 --> 00:03:30,450 it should be doing these functions, 98 98 00:03:30,450 --> 00:03:32,430 and it should do it every single time. 99 99 00:03:32,430 --> 00:03:34,770 That's why we want to eliminate those special snowflakes, 100 100 00:03:34,770 --> 00:03:36,840 because we want everything to be consistent. 101 101 00:03:36,840 --> 00:03:39,060 Now, by doing this and using carefully developed 102 102 00:03:39,060 --> 00:03:42,210 and tested scripts, we can end up doing orchestration 103 103 00:03:42,210 --> 00:03:43,620 really consistently. 104 104 00:03:43,620 --> 00:03:45,900 We create these runbooks that are going to do all the steps 105 105 00:03:45,900 --> 00:03:48,570 for us, that's what we call a script inside of orchestration 106 106 00:03:48,570 --> 00:03:51,090 and it's going to generate these very consistent builds 107 107 00:03:51,090 --> 00:03:52,650 that have a good security posture 108 108 00:03:52,650 --> 00:03:54,450 and they're within compliance for us. 109 109 00:03:54,450 --> 00:03:56,310 So really what I'm trying to say here is 110 110 00:03:56,310 --> 00:03:58,140 eliminate the special snowflakes. 111 111 00:03:58,140 --> 00:03:59,670 Don't allow them to happen. 112 112 00:03:59,670 --> 00:04:01,980 If somebody wants to have a special snowflake system 113 113 00:04:01,980 --> 00:04:04,620 there should be a really, really good reason for it 114 114 00:04:04,620 --> 00:04:05,570 and it should go really high up 115 115 00:04:05,570 --> 00:04:07,560 in your organization for approval. 116 116 00:04:07,560 --> 00:04:10,260 The default answer should be no special snowflakes. 117 117 00:04:10,260 --> 00:04:13,320 We're all going to use the same templates, the same security, 118 118 00:04:13,320 --> 00:04:15,900 and the same orchestration, because we know it works 119 119 00:04:15,900 --> 00:04:17,460 and it's easier for us to support, 120 120 00:04:17,460 --> 00:04:19,310 and it gives us much better security.