DevOps: With Great Power Comes Great Responsibility
The power of infrastructure as code comes with great responsibility
Take responsibility of the great power by becoming familiar with the basic security concepts and services of Amazon Web Services“You say you don’t want the responsibility? Guess what? People like us…we don’t get a choice.” — Peter ParkerHave No Fear! Spidey is Here!The amazing spidey powers of Amazon Web Services (AWS) API’s provides developers the ability to provision their infrastructure instantly, and rebuild services as often as the application’s code base. That’s the beauty of DevOps — the “shift left” and automation of operational considerations into the hands of development teams to enable their continuous flow of delivery.With legacy on-premise data center environments, adherence to stringent security, network, and operational controls are included in the lengthy provisioning of infrastructure. As the power to provision infrastructure shifts directly into the hands of the developers, so does the responsibility to build similarly secure environments.This responsibility shouldn’t be taken lightly.In the federated model of DevOps punctuated by the self-service infrastructure capabilities of AWS, there is a pressing need for development teams to be keenly aware of operational considerations that may have previously been taken for granted.DevOps + SecDevOps is an overloaded term. “Dev” compromises an assorted web of tools and techniques that go into building software. “Ops” is weighed heavily by the multitude of functions that ensure the resiliency of production environments — including the oft-overlooked complexities of security.As development teams absorb the many facets of “Ops” into their flow, security needs to be a forethought. By including security considerations early and often in the delivery pipeline, DevOps provides enterprises a unique opportunity to improve their security defenses.The automation of the delivery pipeline allows applications to embed security from the earliest stages of development. By leveraging CI/CD practices such as Automated Test Driven Development (ATDD), security requirements can be tested with every build providing a much tighter and more integrated feedback loop.Train Like Spider-ManAfter being bitten by a radioactive spider, Peter Parker gained several amazing powers. The combination of these abilities made him one of the most powerful crime-fighting superheroes.To combat the anti-pattern foes of your continuous delivery pipeline, you’ll need similar mad skills:Spider-Strength: Be strong and resilient by designing your application for failure. Adopt AWS best practices for high availability, such as using multiple Availability Zones and configuring Auto Scaling groups to replace unhealthy instances.Spider-Speed: Deploy your application with speed and agility by automating tests, builds, and deployments to eliminate the need for error-prone manual operations.Spider-Grip: Adhere to the underlying DevOps principles that include Culture, Automation, Lean, Measurement, and Sharing. Don’t lose your grip … Stay CALMS and DevOps.Spider-Sense: Use automated log monitoring and alerts throughout the delivery pipeline to amplify the feedback loop and quickly ‘focus-in’ on the source of the danger.Take responsibility of the great power afforded to you by becoming familiar with the basic security concepts and services of AWS. As operations “shift left” into development teams, security should be an integral part of your automated delivery pipeline.It won’t be long before you get the swing of it, and are spinning a secure web to combat the villain of DevOps: Anti-Patterns.There will always be doubters, cynics, and haters telling you that becoming Spider-Man isn’t possible. Just remember that “scientists” also said waterfall methodology was suitable for software development.