1 00:00:00,330 --> 00:00:04,042 Infrastructure as code or IaC. 2 00:00:04,042 --> 00:00:06,720 Now, when we talk about infrastructure as code, 3 00:00:06,720 --> 00:00:08,640 this is a provisioning architecture 4 00:00:08,640 --> 00:00:10,200 in which the deployment of resources 5 00:00:10,200 --> 00:00:13,170 is performed by scripted automation and orchestration. 6 00:00:13,170 --> 00:00:15,300 Now, we mentioned the fact that we use scripted automation 7 00:00:15,300 --> 00:00:18,300 and orchestration in cloud computing all the time. 8 00:00:18,300 --> 00:00:19,170 And when we do that, 9 00:00:19,170 --> 00:00:21,510 we're really doing infrastructure as code. 10 00:00:21,510 --> 00:00:23,910 Now, this is key to the DevSecOps culture 11 00:00:23,910 --> 00:00:25,800 because it gives our teams the ability 12 00:00:25,800 --> 00:00:27,224 to rapidly deploy things 13 00:00:27,224 --> 00:00:30,300 within the timeframe of what they're working on. 14 00:00:30,300 --> 00:00:32,759 And because they have operations personnel already there 15 00:00:32,759 --> 00:00:35,580 and security personnel already there as part of that team, 16 00:00:35,580 --> 00:00:38,850 it's not any less secure by doing infrastructure as code. 17 00:00:38,850 --> 00:00:41,670 In fact, you'll find it's actually more secure. 18 00:00:41,670 --> 00:00:43,320 Now, why is it more secure? 19 00:00:43,320 --> 00:00:45,960 Well, because it allows for the use of scripted approaches 20 00:00:45,960 --> 00:00:47,970 to provisioning infrastructure in the cloud. 21 00:00:47,970 --> 00:00:49,380 And the great things about scripts 22 00:00:49,380 --> 00:00:50,670 is they don't make mistakes. 23 00:00:50,670 --> 00:00:52,320 Once you have a script and you know 24 00:00:52,320 --> 00:00:53,670 it's working and secure, 25 00:00:53,670 --> 00:00:56,100 it's going to run that way every single time. 26 00:00:56,100 --> 00:00:57,630 So, this is going to allow you to get a lot 27 00:00:57,630 --> 00:00:58,860 of those configurations done 28 00:00:58,860 --> 00:01:01,980 and the provisioning done in a much more secure manner. 29 00:01:01,980 --> 00:01:04,230 Now, when we talk about infrastructure as code, 30 00:01:04,230 --> 00:01:06,870 it really comes down to three key areas. 31 00:01:06,870 --> 00:01:09,540 Part of this is going to be those scripts I just talked about. 32 00:01:09,540 --> 00:01:11,190 Part of it's going to be security templates. 33 00:01:11,190 --> 00:01:13,020 And part of it is going to be policies. 34 00:01:13,020 --> 00:01:15,690 And by applying these three against your infrastructure, 35 00:01:15,690 --> 00:01:16,980 using this approach, 36 00:01:16,980 --> 00:01:19,193 you're going to have much more secure infrastructure. 37 00:01:19,193 --> 00:01:21,090 Now, when we talk about this, 38 00:01:21,090 --> 00:01:23,460 we are going to have to think about our orchestration. 39 00:01:23,460 --> 00:01:25,530 And if you have robust orchestration 40 00:01:25,530 --> 00:01:27,660 where you've tested it and you know it works well, 41 00:01:27,660 --> 00:01:29,790 then you can lower your overall IT costs, 42 00:01:29,790 --> 00:01:32,490 speed up your deployments and you can increase security. 43 00:01:32,490 --> 00:01:34,440 So this is really a win, win, win. 44 00:01:34,440 --> 00:01:36,300 It's all goodness here. 45 00:01:36,300 --> 00:01:37,980 Now, one of the things you have to be careful though 46 00:01:37,980 --> 00:01:39,810 when you're doing this infrastructure as code 47 00:01:39,810 --> 00:01:41,010 because we're using templates 48 00:01:41,010 --> 00:01:43,410 and standardization for everything 49 00:01:43,410 --> 00:01:46,380 is people who want to have their special snowflakes. 50 00:01:46,380 --> 00:01:48,150 Now, when I talk about special snowflakes, 51 00:01:48,150 --> 00:01:50,859 you have people who think they just have the best idea 52 00:01:50,859 --> 00:01:53,130 and therefore they have to be able to go 53 00:01:53,130 --> 00:01:54,510 and create their own infrastructure 54 00:01:54,510 --> 00:01:55,770 the way they want to do it. 55 00:01:55,770 --> 00:01:57,780 And they don't care about your standardization 56 00:01:57,780 --> 00:01:59,973 and your scripting and all the efficiencies you've gained. 57 00:01:59,973 --> 00:02:02,784 And so they create something that is a one-off system. 58 00:02:02,784 --> 00:02:06,030 Now, when you're a big advocate for using orchestration 59 00:02:06,030 --> 00:02:08,580 and using scripts, and using standardization, 60 00:02:08,580 --> 00:02:10,919 sometimes you're going to face some friction at work 61 00:02:10,919 --> 00:02:12,660 because somebody thinks they have a better idea 62 00:02:12,660 --> 00:02:14,820 and they have this special snowflake system 63 00:02:14,820 --> 00:02:16,200 that they just have to have 64 00:02:16,200 --> 00:02:18,390 and they can't use your standard templates. 65 00:02:18,390 --> 00:02:19,350 Now, when that happens, 66 00:02:19,350 --> 00:02:21,510 you end up with a special snowflake system. 67 00:02:21,510 --> 00:02:23,370 And these snowflake systems are any system 68 00:02:23,370 --> 00:02:24,861 that is different from the configuration 69 00:02:24,861 --> 00:02:26,880 that's compared to the standard template 70 00:02:26,880 --> 00:02:29,190 within the infrastructure's code architecture. 71 00:02:29,190 --> 00:02:32,220 Now, the problem with this is it adds to security problems. 72 00:02:32,220 --> 00:02:33,630 It adds to configuration problems 73 00:02:33,630 --> 00:02:35,400 and supportability problems. 74 00:02:35,400 --> 00:02:37,470 This lack of consistency is going to lead 75 00:02:37,470 --> 00:02:38,940 to a lot of issues for you, 76 00:02:38,940 --> 00:02:40,620 especially in terms of security 77 00:02:40,620 --> 00:02:42,930 and inefficiencies in supporting it. 78 00:02:42,930 --> 00:02:45,253 This is because once you have a one off system, 79 00:02:45,253 --> 00:02:48,510 it's unique and it doesn't apply to everything else. 80 00:02:48,510 --> 00:02:50,160 Think about if you're in a large environment 81 00:02:50,160 --> 00:02:51,150 that's operating in the cloud 82 00:02:51,150 --> 00:02:53,130 and you have thousands of virtual machines. 83 00:02:53,130 --> 00:02:55,260 And out of those thousands of virtual machines, 84 00:02:55,260 --> 00:02:56,670 one is different. 85 00:02:56,670 --> 00:02:58,890 When somebody calls up and says something isn't working, 86 00:02:58,890 --> 00:03:00,840 you have to figure out, is it that one exception, 87 00:03:00,840 --> 00:03:03,420 or is it the thousands of others that are all working? 88 00:03:03,420 --> 00:03:05,490 And that becomes more of a support issue for you. 89 00:03:05,490 --> 00:03:07,770 And it leads to a lot of security headaches. 90 00:03:07,770 --> 00:03:09,060 Now, the next thing we need talk about 91 00:03:09,060 --> 00:03:12,330 in terms of infrastructure as code is idempotence. 92 00:03:12,330 --> 00:03:14,670 Now, this is a property of infrastructure as code 93 00:03:14,670 --> 00:03:16,560 that automation or orchestration action 94 00:03:16,560 --> 00:03:18,900 is always going to produce the same result 95 00:03:18,900 --> 00:03:21,450 regardless of the component's previous state. 96 00:03:21,450 --> 00:03:24,030 Essentially, every time you give this input, 97 00:03:24,030 --> 00:03:26,160 you should expect this output. 98 00:03:26,160 --> 00:03:27,776 Anytime you call up this script, 99 00:03:27,776 --> 00:03:30,270 it should be doing these functions 100 00:03:30,270 --> 00:03:32,220 and it should do it every single time. 101 00:03:32,220 --> 00:03:34,590 That's why we want to eliminate those special snowflakes 102 00:03:34,590 --> 00:03:36,660 because we want everything to be consistent. 103 00:03:36,660 --> 00:03:38,850 Now, by doing this and using carefully developed 104 00:03:38,850 --> 00:03:40,080 and tested scripts, 105 00:03:40,080 --> 00:03:43,440 we can end up doing orchestration really consistently. 106 00:03:43,440 --> 00:03:44,610 We create these runbooks 107 00:03:44,610 --> 00:03:46,050 that are going to do all the steps for us. 108 00:03:46,050 --> 00:03:48,390 That's what we call a script inside of orchestration. 109 00:03:48,390 --> 00:03:50,533 And it's going to generate these very consistent builds 110 00:03:50,533 --> 00:03:52,440 that have a good security posture 111 00:03:52,440 --> 00:03:54,240 and they're within compliance for us. 112 00:03:54,240 --> 00:03:55,860 So, really what I'm trying to say here 113 00:03:55,860 --> 00:03:57,930 is eliminate the special snowflakes. 114 00:03:57,930 --> 00:03:59,170 Don't allow them to happen. 115 00:03:59,170 --> 00:04:01,770 If somebody wants to have a special snowflake system, 116 00:04:01,770 --> 00:04:04,440 there should be a really, really good reason for it. 117 00:04:04,440 --> 00:04:05,360 And it should go really high up 118 00:04:05,360 --> 00:04:07,380 in your organization for approval. 119 00:04:07,380 --> 00:04:10,080 The default answer should be no special snowflakes. 120 00:04:10,080 --> 00:04:11,514 We're all going to use the same templates, 121 00:04:11,514 --> 00:04:14,490 the same security and the same orchestration, 122 00:04:14,490 --> 00:04:17,279 because we know it works and it's easier for us to support 123 00:04:17,279 --> 00:04:19,649 and it gives us much better security. 124 00:04:19,649 --> 00:04:22,650 So, how do we conduct infrastructure as code? 125 00:04:22,650 --> 00:04:25,440 Well, we use specialized software to help us with that. 126 00:04:25,440 --> 00:04:27,587 Things like Terraform and SaltStack. 127 00:04:27,587 --> 00:04:29,460 Terraform is a modern method 128 00:04:29,460 --> 00:04:32,340 that's used to provision change and version resources 129 00:04:32,340 --> 00:04:33,810 on any cloud-based environment 130 00:04:33,810 --> 00:04:36,180 by using automation and orchestration. 131 00:04:36,180 --> 00:04:39,000 This is a very popular infrastructure as code methodology 132 00:04:39,000 --> 00:04:40,740 that codifies different cloud APIs 133 00:04:40,740 --> 00:04:42,288 into declarative configuration files 134 00:04:42,288 --> 00:04:44,580 that let you quickly adapt, build, 135 00:04:44,580 --> 00:04:47,195 and standardize your virtualized infrastructure. 136 00:04:47,195 --> 00:04:48,960 Terraform is commonly used 137 00:04:48,960 --> 00:04:50,700 in infrastructure as code deployments 138 00:04:50,700 --> 00:04:52,320 and multi-cloud deployments, 139 00:04:52,320 --> 00:04:53,664 as well as the management of Kubernetes, 140 00:04:53,664 --> 00:04:56,580 network infrastructure, virtual machine images, 141 00:04:56,580 --> 00:04:59,190 and the enforcement of policy as code. 142 00:04:59,190 --> 00:05:00,707 Terraform is available as an open source, 143 00:05:00,707 --> 00:05:03,253 self-managed tool that you can use for free, 144 00:05:03,253 --> 00:05:05,700 or you can use the Terraform cloud 145 00:05:05,700 --> 00:05:08,008 which is a managed Terraform paid service. 146 00:05:08,008 --> 00:05:10,080 Next, we have SaltStack. 147 00:05:10,080 --> 00:05:12,690 SaltStack, also referred to as Salt for short 148 00:05:12,690 --> 00:05:14,917 is a configuration management and orchestration tool 149 00:05:14,917 --> 00:05:17,157 commonly used with infrastructure as code 150 00:05:17,157 --> 00:05:19,230 for IaC deployments. 151 00:05:19,230 --> 00:05:21,677 SaltStack is used as a centralized repository 152 00:05:21,677 --> 00:05:23,820 to provision new servers and services 153 00:05:23,820 --> 00:05:25,110 across the IT infrastructure 154 00:05:25,110 --> 00:05:27,660 and to make changes to existing ones. 155 00:05:27,660 --> 00:05:29,430 The whole idea behind using SaltStack 156 00:05:29,430 --> 00:05:32,160 is to automate repetitive system administration tasks 157 00:05:32,160 --> 00:05:34,710 and code deployments across your organization. 158 00:05:34,710 --> 00:05:36,150 And it does this by eliminating 159 00:05:36,150 --> 00:05:37,830 the manual processes that are used 160 00:05:37,830 --> 00:05:41,190 by legacy IT operations and replaces them with automation, 161 00:05:41,190 --> 00:05:44,430 orchestration and IaC deployment methodologies. 162 00:05:44,430 --> 00:05:45,990 Salt is a Python-based, 163 00:05:45,990 --> 00:05:49,050 open source software that's designed to be highly modular 164 00:05:49,050 --> 00:05:50,823 and easily extensible in its use.