Design, build, and operate systems in the Cloud, one day and concept at a time.
An archive. 129 posts published between 2019 and 2021; nothing new since December 2021. Start with the knowledge base for curated reading, or search.
Building a business with continuous delivery and Serverless
Hey – I’m back! I’ve been heads-down learning what Cloud teams need to deliver to AWS securely and make IAM usable, and building that into a business delivered via SaaS & infrastructure code libraries: k9 Security. I’d like to share my experience in how continuous delivery and serverless supported that endeavor. I hope this experience
Never felt more DevOps than when I was Serverless
Serverless helped me integrate DevOps principles into my application delivery workflow like never before.
DevOps interview questions: Organizational Maturity
What questions should engineers ask in a DevOps interview to understand the organization’s DevOps maturity? These questions should not be about specific tools and platforms. They should be about people, processes, how we get work done, and how we collaborate. This post is written primarily for candidates. Hiring teams can also use these questions to
Empathy in Action
What the world needs now is empathetic action by those with power.
Video: Secure an S3 Bucket
Last week I presented ‘Secure an S3 Bucket (and still use it)’ at the Phoenix DevOps meetup. I’m trying to help people understand why and how to protect every S3 bucket with data that needs to remain confidential. We hosted the meetup using Zoom. Attendee participation was strong and people said the content was on-target,
Why protecting data in S3 is hard and a least-privilege bucket policy to help
Securing data in S3 is a nightmare for many people. This post describes why it’s hard and a least-privilege bucket policy to help.
Guide to Tagging Cloud Deployments
Resource tagging is the primary context communication method in the Cloud but many organizations struggle to define the terms and a model to describe and analyze their Cloud deployments. The k9 Security guide to tagging cloud deployments will help you define your tagging standard and explain why it’s important.
Converting energy into something that matters
DevOps practitioners can help deliver value to customers quickly and collaborate across teams, even or especially, in times of crisis
Help with big changes
I hope that you and your family are safe and healthy. COVID-19 is forcing many organizations to change long-standing policies and processes very quickly under great uncertainty. I’d like to help you navigate through those changes, especially if you support healthcare services. First, there are resources in the Knowledge Base that you may find helpful
RSA Conference 2020: A DevOps Perspective
I attended two and a half days of the RSA security conference last week and I’d like to share my first-timer perspective with you. Summary The opening keynote challenged Information Security to reorganize to collaborate better with users, business, risk, and IT teams. My post-conference perspective is that this challenge is largely ahead of us.
Computing a Risk Estimate using Netflix’s riskquant
This post computes a realistic annual loss estimate in dollars for an ecommerce application using the riskquant tool that models the distribution of possible impacts and probabilities appropriately.
Modeling Risk in Cloud Deployments
Information Security risks are those risks “that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations, organizational assets, individuals, other organizations, and the Nation (NIST 800-30).” Risk assessments should help people understand a given Cloud deployment’s information security risks and help
Modeling Security in Cloud Deployments
Cloud deployments often use tagging to describe the context of a compute or resource such as a who owns or what application a virtual machine or object storage bucket belongs to. However, the common resource tagging models in use don’t describe the context required for people or tools to assess security or manage risk easily.
Assessing and Managing Information Security Risks
Reading Time: 6 minutes The current crop of Best Practice tagging schemes and recommendations don’t describe the context required for people or tools to assess security or manage risk easily. But I never explained why risk management is important nor how to assess risk. Let’s start with an introduction to the process of managing risk
Research: Problems Engineers have Securing Cloud Deployments and ‘Shift Left’
I hit an obstacle on my way to extending the common resource tagging models with context to describe security and risk attributes. I couldn’t get past that while I feel this should be a settled engineering practice, it isn’t. Suspecting bad assumptions lurking around, I spoke to some engineers practicing DevOps with titles like DevOps
The context people and tools need to work with your Cloud
Operating applications involving more than a few components without explicitly modeled contextual clues is difficult for humans and might be impossible for tools. This is especially true when people are a couple steps removed such as is often the case when analyzing costs and/or assessing risk. Both people and tools rely on: identifying resources at
Research: Problems with top free security assessment tools (2020q1)
I’m researching how engineers assess the security posture of their Cloud deployments and evaluate risk to those deployments so they can improve it. Reading Time: 10 minutes The research starts with these questions: What’s the hardest part about assessing and improving the security of your Cloud deployments? When was the last time you tried or
Understanding risk using top free AWS Security tools
Most free security assessment tools for AWS will only go so far as to highlighting potential risk areas — assessing risk is up to you.
Continuous Delivery with Serverless, CircleCI, and Lambda: The Good, Bad, and the YAML
Our Serverless continuous delivery pipeline lets us achieve Elite levels of Software Delivery Performance.
Minimize your delivery pipeline and platform dependencies
To escape The DevOps Organization Build Trap, I suggested that you minimize the distinct sets of components your organization uses to deliver and operate software. Those components represent a dependency tree and are integrated, enhanced, and worked-around by your team to meet your organization’s requirements on your dime. While all delivery pipelines and deployment platforms
Help for your Agile or DevOps Resolutions
Happy New Year! Many of you have freshly resolved to be more agile, adopt DevOps, or ramp-up your software delivery improvement efforts. The NoDrama Agile and DevOps theme page will help you accomplish these resolutions by: building a solid understanding of what DevOps is, why it works, and the value it provides (spoiler: DevOps is
Key practices for achieving large professional goals
My hope is that this post will help you reach your own goals in 2020. I attained several long-term professional goals in 2019 and I’d like to share the key practices for how I did that to help you along your way. We’ll return to Cloud, Security, and DevOps topics in the New Year. I
How technical do you need to be to set strategy for a technical organization?
Joe Contrera is a leadership coach friend of mine and we just had a lively discussion about why so many strategic technology decisions look bad in hindsight and organizational transformations fail. He asked a great question: How technical do you need to be to set strategy for a technical organization? My answer is “not very,”
SPIFFE Service Meshes that manage application identity and access control
This post on service meshes and SPIFFE will wrap up the series on how application identity and access control is migrating from implicit identification by IP address to application-level authorization. Let’s start with an identity management technology that you may or may not have heard about: Secure Production Identity Framework for Everyone (SPIFFE). SPIFFE The
Cloud native application-level identity and access control
The proper way to provide identities to applications on Cloud and container platforms is for the compute platform to provide that identity to the application instance . I call this the Cloud native application identity. Once the application has received its identity from the compute platform along with an identity document or credential the application
Better Network-based Identity and Access Control in the Cloud
This is the second post in a series about how the Cloud is changing how we manage network access control and application identity. In particular, my thesis is that the use of a network-centric identity such as an IP address or subnet to identify an application is waning and are being replaced by identities provided
Themes: Cloud Security and Containers
#NoDrama DevOps now has over 100 posts covering Cloud, DevOps, Security, Automation, AWS, and more. Cloud Security and Containers are two of the main themes I’ve written about this year. I’ve curated a guide to each of these themes in a new ‘Knowledge Base’ section of the website. These guides should help you find the
Zed, authorizing application access via network controls is (nearly) dead
One challenge many organizations face when migrating their applications to Cloud or container platforms is that identifying applications by their network address, either CIDR block (aka subnet) or IP address no longer “works.” Identifying application instances by their network address no longer works the way it used to because the compute instances are much more
Cloud Pattern: Secure Inbox using S3 and KMS
With the Secure Inbox pattern, organization A can store and deliver objects of arbitrary size to partners while narrowly scoping what partner data its own teams and applications have access to. Organization B can receive work generated by partners reliably and securely while maintaining tight control over who has access to that data via KMS encryption key and bucket policy.
Debugging AccessDenied in AWS IAM
Ugh… that looks like it could be the start of a two hour or two week long goose chase. Understanding why access was denied and implementing a secure solution can be complicated. Sometimes it’s not even clear where to start and what to do when you get stuck. Update: An improved version of this Debugging
Which career path to the Cloud?
I had an interesting conversation yesterday with someone looking for advice on how to add ‘Cloud’ to their career path. They have more than ten years experience architecting and delivering projects in enterprise IT along with a couple of ‘simple’ migrations to AWS. They started off with a couple of questions: Should I try to
Site Operations Blessing
Here’s a little blessing you can say for your teams and website responsible for operations this peak-filled holiday season: Thank you to all who have improved our system’s capabilities and robustness for our customers. May our dashboards be green and charts stable May fixes flow swiftly through the pipelines to production May instances start quickly
Review: The Unicorn Project
You can learn a lot from The Unicorn Project about the day-to-day leadership, management, and ‘manage-up’ skills to transform yourself, a team, or an organization using The Five Ideals.
Why is AWS IAM So Hard?
Why is AWS IAM so @!#^$!# hard? One of my favorite Directors of Cloud Platform AWS Identity and Access Management (IAM) is a security tool that controls access what AWS API actions that Principals (roles, users) are allowed to perform on which AWS resources: an S3 bucket, EC2 instance, DynamoDB table, etc. IAM is really
Thanksgiving with the Wardleys
White meat, dark meat, you just can’t lose. Adam Sandler The traditional Thanksgiving feast can be an enjoyable gathering filled with sharing of stories, eating good food, and relaxation. But frequently it’s not — especially for the hosts. Today we’ll explore strategy for hosting a Thanksgiving get-together that everyone enjoys. There will be not-so-thinly-veiled connections
Changing organizations successfully
Organization and process changes are full of challenges. First, the existing structure and process is (probably) a ‘stable state’ that people are comfortable with and whose very position in ‘the machine’ reinforces. Even if no one likes the existing state. Second, there are forces within the organization that will actively oppose the change because people
The DevOps Organization Build Trap
I am learning a lot from Melissa Perri’s ‘Escaping the Build Trap’ in my studies of product management. Perri says in chapter 9 ‘Organizing Your Teams’: You can’t build an organizational structure without a product vision, because the value streams are not apparent. Perri, Melissa. Escaping the Build Trap: How Effective Product Management Creates Real
Improving software delivery processes at the organization level
Today I will share my high-level process and questions for reflecting and improving an organization’s delivery process and outcomes. First, review the Aspects of Software Delivery Performance (DORA) that generate improved business outcomes: Deployment frequency Lead time for changes Time to restore service Change failure rate Second, imagine what the ideal delivery process looks like
Why people replace Kubernetes clusters instead of upgrading them
The pace, complexity, and risk of Kubernetes upgrades means you should probably replace clusters instead of upgrading them.
Choose Container Orchestrators Strategically
Deciding which of container orchestrator is right for your organization or team now and in the future is an exercise in strategy. This post will help you develop a strategy aligned to your specific customer needs, technological and organizational assets, desired business state, and other information required to build a good strategy.
What is different about Kubernetes
Kubernetes is a container orchestrator built by a large community of technology vendors and users that was inspired by Google’s Borg orchestrator. Kubernetes is operated by everyone from major Cloud providers to you. From the What is Kubernetes page: Kubernetes is a portable, extensible, open-source platform for managing containerized workloads and services, that facilitates both
What is different about Elastic Container Service (ECS)
ECS is a first class container orchestration platform for teams committed to AWS. If you’re in one of the ‘best for’ categories, give it a serious look.
Minimum Viable Pumpkin
I’m sharing this story to illustrate how you can frame, approach, and explain all kinds of activities as Agile delivery processes. We decompose problems and their solutions all the time and Agile/Lean is applicable for more than just software — in this case a pumpkin.
Container orchestrators are the same but different, Docker Swarm
This is the first of several posts that will provide a high-level introduction to the top container orchestrators in late-2019, differences between them, and which might be best for you.
Concept: Container Orchestrator
A container orchestrator schedules, runs, and supervises containerized application processes, usually across a cluster of hosts. This post describes the responsibilities of a container orchestrator and what the orchestrator integrates with.
Read raw, unedited customer feedback
Here’s an idea to help your team build empathy for what customers are feeling when they use your service. Read raw, unedited customer feedback about your product or service as a team. There’s probably a ton of this data kicking around your organization’s customer service, chat, CRM tools, and social media. Often this data is
Uninterrupted Time
When was the last time you worked uninterrupted for one hour? An entire hour. Much of the work technologists and other knowledge workers perform requires significant time to load context, think, and work out the solution. But frequently, we do not give people that time. One of the most important transformations of my career happened
Docker cpu resource limits
Docker allows you to constrain the CPU resources available to a container on either a relative or absolute basis — this post shows you how and why you might do that.
Docker memory resource limits and a heap of Java
Ok, so maybe you’re convinced why you need to set limits for container resource usage, especially when running on shared container application platforms like ECS, Kubernetes, and Swarm. In this post, I’ll show you how to set memory limits for a basic Java web app built with Spring Boot. Most container clusters are memory bound,
The importance of Docker container resource limits
This post explains why enforcing resource limits is a critical best practice for running workloads on shared compute platforms such as a container cluster orchestrated by ECS, Kubernetes, or Swarm.
Slower is Faster, especially when it’s urgent
Leatherback sea turtles have a top speed of about 6 miles per hour in any direction. I am pretty sure their navigation skills have more to more to do with successful migrations across the vast ocean than top speed. Many teams face a lot of pressure to “go fast” and “get things done.” These are
Prototyping helps clear the err
Reading time: 2.5 minutes We create and review designs primarily in our minds. While our expertise is worth a lot, we’re not perfect and neither are our diagrams. We’re still subject to: known-knowns we think are true, but aren’t known-unknowns we uncovered in the design process unknown-unknowns we didn’t forsee One of the ways we
How to review a design
Today, I will share how I like to review a design produced by my design process: I call this a ‘semi-formal’ design review, because it leverages key aspects of a ‘formal design review’ such as: the design is built from a structured template tailored to our problem space and is written to be read and
The design process
This post describes QualiMente’s design process. This design process incorporates feedback from authors, a design review, and (optionally) prototypes. Once design feedback is collected, the delivery team and product manager have much more knowledge about whether to continue, how to approach the solution, and how to break up and sequence the work. Additionally, you can communicate to collaborating teams with the confidence that you’e probably identified half or more of the design’s defects.
The genesis of a design
Designing a solution is one of engineering’s primary creative activities. We use our knowledge of principles, techniques, and primitives from science, engineering, and industry to create a solution to a problem. This post describes my initial steps for designing.
Form follows function
Teams must select the right steel — the patterns, compute platforms, algorithms, languages, and frameworks that form the core of our systems in order for them to function well, or at all.
Zzzt! Closing the loop
Reading time: 90 seconds In QualiMente’s Secure Cloud team retrospective on Friday, we identified a couple of improvement actions: For context, we are several weeks into building a new service called k9 that helps people and access analysis tools understand “who has access to what” in AWS. As product owner and team lead, I prioritized
The work iteration retrospective aka ‘Sprint retro’
Retrospectives are a tool that can provide a primary data gathering mechanism for a team’s health and delivery process and are performed at the completion of an iteration of work.
Feedback loops are a beautiful thing
Delivery process improvement ideas rise from the frustration felt by teams executing the process. If you want to improve a team’s delivery processes, I recommend putting your team in control of improving itself and support the team with practices and resources to help them do that.
The Silver Bullets Are Not Evenly Distributed
Reading time: 3.5 minutes Are there any ‘silver bullets’ in software development? Fred Brooks led the IBM’s System/360 development effort and recounted that delivery story and strategies in The Mythical Man-Month (brilliant) said: “There is no single development, in either technology or management technique, which by itself promises even one order-of-magnitude improvement within a decade
State of Application Secret Delivery and Audit Practices – 2019
The State of Application Secret Delivery and Audit Practices should help you explain to others why delivering application secrets is challenging, the risks of unsafe practices, and a general approach for improving your application secret delivery process.
Concept: Configuration
Configuration is data interpreted by a program to change its behavior so that it supports a particular use case. This post describes the challenges and techniques for creating a configuration interface that is safe and usable.
Can you handle 10x or 100x more application components?
Reading Time: 2 minutes Many organizations are making fundamental changes to the way their applications are structured and operated. These changes are intended to address real problems. Structurally, monolithic applications can severely hamper change delivery rate as the regression test process comes to dominate change delivery time or changes from many teams being held up
Bootstrapping Trust – Terraform+VMWare+Chef
Lack of understanding how to deliver secrets to applications securely is the biggest challenge identified by DevOps practitioners in the Secret Delivery and Audit Practice study. This post describes how you can deliver secrets securely when using VMWare, Terraform, and Chef.
Learning to Debug
Finding the needles in a large haystack is sometimes the hardest part of solving a problem. Debugging is also a skill you can learn and develop.
Preventing 3rd-Parties from Leaking Data in Cloud – Attunity
Let’s examine three controls customers can adopt to help keep control of their data stored in S3 or another Cloud object store while still making it accessible or manageable by third parties.
Provable Security at AWS
Helping customers answer security questions in the general case and preventing bad configurations from making it into the wild is one of the main themes at AWS’ inaugural Security conference, re:Inforce. They have done this by operationalizing the ‘Provable Security’ field for their services.
Running Docker application containers more securely
This post describes easy to adopt practices for running Docker application containers more securely.
Should your Spidey sense tingle when discussing REDACTED?
There might be a relationship between an easy to measure factor that I’ll leave unnamed and Risk to your secrets. Please contribute your data.
What are application containers and what problems do they solve?
This post introduces application containers and explains how Docker helps you package and run (crazy) applications inside neat little boxes, keeping the hosting computer nice and tidy.
A 6 Minute Step Towards Better Strategy, Mapping Templates
You probably just spent a week working on something and it’s time for a bit of reflection and improvement. How about checking-up on your strategy? Watch this video and use these templates to take make your first strategy improvement pass in an hour.
On the Deceitful Complexity of Cloud Security
This post shares a QualiMente Cloud Engineer’s experience and key learnings from taking the AWS Security Fundamentals Course: these pieces *do* tie together.
Building Security Skills for an AWS Cloud Migration
The Security skills needed for a Cloud migration may be in shortest supply and the most difficult to acquire. This post describes resources you can use to build Security skills throughout your engineering team and to integrate your Security Engineers with greater leverage.
The Prime Directive of Retrospectives: Safety
(Reading Time: 1min) If you feel like you’re not getting good participation and feedback in your sprint or project retrospectives, you’ve got a problem. That problem might be that people don’t feel safe in sharing what they really think and feel. Tactically, if people aren’t sharing the information you need to improve continuously, it’ll take
Why I Design
(Reading Time: 2.5 minutes) I design to avoid waste. Waste in building something: nobody wants can use effectively can afford That is, design is a process that helps maximize the value of systems we create. The design process is also critical to understanding whether we should build them at all. Some systems will have low
ADRs are not the only doc in an Architecture process
A successful architecture decision-making and recording process depends on creating and socializing a design doc on the matter.
Scaling Architectural Processes with Guilds
Reading Time: 2 minutes Comcast published a detailed description of how they use Architecture ‘Guilds’ to scale investigation, review, and decision making: https://www.infoq.com/articles/architecture-guild-800-friends Scaling decision making is a hard problem because you want to: gather input from interested and knowledgeable creators and users focus on the most important parts of the problem and solution, avoiding
Why did we do that?
We make every decision with imperfect information. ADRs give you a way to quickly record what you knew at the time and why you did what you did.
How to lose a secret
Quick tophat: If you have 8 minutes I’d really appreciate your support with my secret delivery and audit research, by completing this anonymous questionnaire: https://www.surveymonkey.com/r/BL7K385 Have you ever accidentally exposed a password, api key, or other secret? The romantic version of this is like putting a message in a bottle afloat on the sea. Will
Research: Application Secret Delivery and Audit Processes
I am researching how people currently deliver secrets to applications, audit their use, and what they would like to improve and I need your help.
The Future of Information Security is Simpler (I Hope)
We can improve the world’s software by transforming ‘complicated’ and ‘complex’ into something simper, even boring. This transformation isn’t easy but there is a way to commoditize security and other specialty practices that make your system safer and more reliable.
Knocked out of orbit by Odlyzko’s ‘Cybersecurity is not very important’
When you enhance your build, delivery, deployment, and operational systems and processes with the capabilities above, you’re “Doing The (mundane) Work” to make your systems safer.
How Terraform models the state of resources
Terraform’s magic is in how it models resources and tracks dependencies within in a dependency graph.
Converging Infrastructure to a Desired state
This post describes the process infrastructure as code tools like Terraform use to ‘converge’ the real world to the state you declared in your code.
Concept: Infrastructure as Code
When you adopt “Infrastructure as Code” (IaC), you manage infrastructure by defining the desired state of your infrastructure in source files and use a tool to realize those infrastructure resources.
Like nails on a chalkboard: ‘We haven’t shipped’
Recently, the Hertz car rental company sued Accenture for $32M in damages. The suit (pdf) alleges breach of contract in Accenture’s agreement to build and deliver a new website. This new site was supposed to: support the Hertz, Thrifty, and Dollar brands, starting with Hertz, North America be a ‘responsive’ site that works across phone,
Delivering Secrets to Applications, Securely
I synthesized and expanded what I’ve been sharing about delivering secrets to applications into a 1 hour talk and presented it at the Phoenix DevOps meetup on Wednesday. This talk covers (Recording (YouTube), Slides (Google)): the fundamental challenges of handling secrets, including The First Secret Problem common ways you can lose control of them in
Joe Armstrong and Fault Tolerant, Concurrent Systems
Joe Armstrong pioneered the engineering of fault tolerant, concurrent systems. Throughout his career he asked and answered: How can we program systems which behave in a reasonable manner in the presence of software errors? He surmised that: Large systems will probably always be delivered containing a number of errors in the software, nevertheless such systems
Controlling Access to Secrets within CI/CD Systems
Controlling access to secrets within Continuous Integration and Delivery (CI/CD) systems is very important. CI/CD those systems often use credentials with highly-privileged access to create and publish business critical artifacts and application deployments. This post shares pointers for how to protect access to secrets in Jenkins, Gitlab Enterprise, CircleCI, and CodeFresh.
Concepts: Zones and Regions
The major cloud providers provide a Region+Zone model to help you architect, deploy, and operate applications built upon isolated fault domains with well-defined behaviors. Learn the characteristics of your Cloud provider’s model and architect a deployment that will meet your availability goals prior to deploying your application.
Concept: Failure Domain
A failure domain is a set of resources that provide a service to users and operates independently of other failure domains that provide that same logical service. And they are incredibly important.
Origin Story: The Blue-Green Deployment Method
Ever wonder what the heck the ‘Blue Green’ deployment method is or how it got its name?
It’s a Trap: Optimizing process flow instead of evolutionary flow
Yesterday, Simon Wardley highlighted one of the biggest problems organizations face in transformations and improvement efforts: getting ‘trapped’ by their existing context. Once an organization develops a solution that works, the solution establishes momentum. This momentum keeps the process in motion and delivering outputs that supports outcomes (good) as well as creating inertia to change
Heartbleed’s lesson about delivering change
Investing in robust delivery processes to lower the minimum time for an idea to go to concept to customer is not at odds with security, ‘stability’, and customer happiness. In fact, a robust delivery pipeline is a mechanism by which you can achieve all of these.
Consuming Secrets in Applications
Explore the three main methods, advantages, and disadvantages for applications to consume (use) secrets stored in a vault: environment variable, file, and API.
Let me tell you a secret
Secrets can be integrated into an automated application delivery process with the support of a tool that knows how to map and distribute secrets from a secure source vault to a secret store running in the target runtime environment.
The First Secret Problem
Your application’s compute execution role is its identity in the Cloud. Use it to bootstrap access to runtime secrets in addition to authenticating to other provider-managed services.
Cloud lock in and the cost of portability
All systems have dependencies and you’re always “locked-in” to something. Evaluate dependencies in the full context of the delivery problem and business goals. Base your strategy on this wide context and resume the task of delivering value to customers.
APIs are the ante for the Cloud service game
If a service can’t be provisioned and managed via an API, it’s not a Cloud service.
Cloud Service Delivery Models
Learn about the Cloud has three main service delivery models: infrastructure, platform, and software as a service and when you’d want to use each.
What is a Cloud?
The Cloud changes the economics of application deployments by shifting to pay-for-what-you-use consumption based model. You can and should use the Cloud’s resource provisioning APIs to allocate resources when you need them and release them when you’re finished to create an economical deployemnt.
Upgrade your testing process for Continuous Delivery
If you are thinking of adopting continuous delivery, now is the time to evaluate the effectiveness of your verification process and identify opportunities for improvement in safety, efficiency, and throughput.
Upgrade your deployment process to support Continuous Delivery
Once you’ve automated the core of your deployment process and decoupled ‘deploy’ from ‘release’, the majority of concern about adopting CD should melt away.
Foundations of Continuous Delivery: Deployment and Test Automation
Once Continuous Integration is in place, you can focus on improving your project’s delivery process. Today I want to highlight the need for two foundational of a continuous delivery process: deployment and test automation. Average Read Time: 2 minutes Recall that Continuous Delivery is a practice that: ensures our code is always in a deployable
Good release artifacts drop onto deployment platforms
This deep-dive on Continuous Integration started with saying that a project’s CI process should build the canonical release artifacts for a project or product. These release artifacts should archive the application that was built along along with application-specific tools such as scripts required to run the application. Avg Reading Time: 3 minutes These artifacts will
Continuous Integration of a Containerized Application
Learn how to create a continuous integration process that packages custom software into a Docker image, tests, and publishes that as a releasable artifact.
Continuous Integration for Infrastructure Code
Continuous Integration can and should be applied to infrastructure code written in tools like Terraform and CloudFormation. This post describes how.
What does Continuous Integration look like in 2019?
The primary goal of a continuous integration process is to provide rapid feedback on changes to the development team. Teams use CI to determine whether a change is reasonable to deploy for further testing.
Improving Software Delivery Performance with Continuous Integration and Continuous Delivery
Much of the extra effort and delay in software delivery processes is hiding in long-lived feature branches and test environments built from long-lived release branches. Deliver more frequent releases with lower lead times using Continuous Integration and Delivery (CI/CD).
Adopting a Robust Incident Response Process
You don’t need to build an incident response process from scratch, adopt!
A Good Response for an Incident in a Complex System – GitHub
What does a good response look like for an incident in a Complex system? Start by establishing a system for classifying incidents in terms of customer and business impact. Then establish a process to manage the restoration of service that prioritizes the following external goals: safety for the service’s customers and their data restoration of
Are Target Resolution Times for Incidents Harmful?
Incident resolution times are a lagging indicator of team and organizational performance, not constructive guidance during incident response.
Cooking Something Good with DevOps
This is the final piece of a three-part series introducing the Principles and Value of DevOps. I am excited and relieved that after 15 years of trying to discover, learn, apply, and teach these practices, that we have matured so that it’s clear: what principles we should apply how to guide the application of those
The Value of DevOps to Your Organization
DevOps provides value to organizations by enabling them to change quickly and safely.
Principles of DevOps
DevOps will help you optimize the delivery of services that are built on technology _and improve the services_ themselves.
Mapping a Safer, Faster IAM Development and Review Process
I used Wardley mapping this morning to explore ideas I have for improving the development and review of AWS Identity and Access Management (IAM) policy changes. I’d like to share the internals of that mapping process with you to give you an illustrated example. The purpose of this process improvement effort is to help people
Learning to evolve strategy with Wardley mapping
I think Wardley Mapping is a fascinating and effective way to describe a system and develop a strategy to evolve it. Wardley Mapping has a growing community of practice with many ways to learn and participate. Here are the ones I know about (and I’d love to hear about more): Online Simon Wardley’s tweets about
Identifying Undifferentiated, Heavy Lifting
In The Promise of Clouds and Optionality, I said: Cloud providers are competing to offer high quality services that meet their customers’ needs at decreasing cost and increasing scale. They want you to offload whatever you consider undifferentiated heavy lifting to them. But what the heck is ‘undifferentiated, heavy lifting’ and where do I find
The Promise of Clouds and Optionality
The real magic Cloud providers give you is optionality to build the right thing.
Recap: Going Fast, Safely
I’d like to recap why I’ve been discussing the nature of systems, isolation, and enterprise-level controls. It’s because I want you to: Go Fast, Safely I hope you recognize that the systems we build and work within are much more than the sum of a set of Obvious parts. The parts interact and we need
Starting Carefully with Service Control Policy
Let’s say you’re excited about using Service Control Policy to govern what goes on in your organization’s AWS accounts and improve compliance, but you don’t want to break the world when you roll it out. How do you do that? Start by identifying a single account that serves an active, but low risk use case
Improving Enterprise Security and Compliance with AWS Organizations
Let’s examine how AWS Organizations helps you manage and improve some aspects of Enterprise-wide security and compliance. This discussion builds on the previous post detailing how AWS Organizations help you manage many AWS accounts and their costs. AWS Organizations provide a number of additional security features, the one we’ll examine today is Service Control Policy.
Managing Multiple AWS Accounts and Costs with an AWS Organization
Previously, we explored the benefits of the security and fault boundaries provided by AWS accounts, and provisioning accounts to match your use cases in order to operate safely in the Cloud. Today, we’ll explore the AWS Organization service and why you should use it to manage your enterprise’s AWS accounts. When you deploy distinct use
How should I organize my AWS accounts?
Previously, I answered ‘How many AWS accounts do I need?’ with: Create however many accounts your organization needs to establish safe security and fault boundaries that enable your organization’s primary use cases and expected level of team/application autonomy. Today, we’ll explore the tradeoffs of AWS account organization methods using an example that covers one approach
How many AWS accounts do I need?
Today, I’d like to answer a common question people ask about AWS accounts: How many AWS accounts do we need? What’s an AWS Account? First let’s start with some background about what an AWS Account is and the features it provides. An AWS Account is a logical container that owns resources in the AWS Cloud.
Why Docker makes sense through the lens of Cynefin
Docker promises to help you Build, Ship, and Run applications. In this post I will describe why Docker was such a breakthrough for those building and running applications through the lens of Cynefin. The previous post introduces using Cynefin to understand systems and make good decisions. Situational Awareness: Building, Shipping, and Running Applications What kind
Making Sense of Systems and Good Decisions
Cynefin is a framework created by Dave Snowden to help people understand systems and assist decision-making. Cynefin identifies five domains from which people can analyze a system or situation: Obvious, Complicated, Complex, Chaotic and Disorder. Dave Snowden – CC BY-SA 3.0 Managing a system from the context of a domain is important because the framework
What is in a System?
Let’s take a step towards understanding and building “Systems.” My favorite Systems Engineering textbook defines a System as: a set of components which are related by some form of interaction, and which act together to achieve some objective or purpose. Components are simply the individual parts, or elements, that collectively make up a system. Relationships
Ready, Set, Eliminate Drama!
Life moves pretty fast. If you don’t stop and look around once in a while, you could miss it. — Ferris Bueller Welcome to the No Drama DevOps Daily blog! We’re going to learn how to design, build, and operate modern technology systems in the Cloud safely and efficiently, one day and concept at a time. Each day,