Customers are challenged today by a constant struggle between velocity and governance. What they want is consistent, secure, and scalable software deployments, but their security teams also need to be able to identify possible issues early in the development process to allow for proactive modification to the deployment process to ensure compliance in the cloud. Join us for a webinar on “Securing AWS Deployments with Spinnaker and Armory Enterprise” to learn: How to experiment while still enforcing deployment policies How to build reusable modules that reduce the number of stages needed for deployment How lockable pipelines enforce continuous delivery to release orchestration best practices

1. Securing Your AWS
Deployments
Paul Roberts, Principal Solutions Architect
rbpa@amazon.com
Lee Faus, Field CTO
lee.faus@armory.com
With Spinnaker and Armory Enterprise

2. Why Did AWS
Get Involved?
Go where the developers are
Amazon Elastic Container Service
AWS Lambda
Amazon Elastic Kubernetes Service
AWS Fargate
Amazon EC2

3. Amazon Elastic Container Service
AWS Lambda
Amazon Elastic Kubernetes Service
AWS Fargate
Amazon EC2

4. Spinnaker
Documentation
http://www.spinnaker.io

5. Fargate Support

6. Lambda Support

7. EKS Integration
Scaling EKS Apps with Spinnaker

8. CodeBuild
Support

9. Delighting Our Customers…

10. Building a Software Factory

11. Shipping from the Factory

12. The Challenge Ahead

13. The Challenge Ahead

14. The Challenge Ahead

15. Policy Visibility
🤷

16. Change & Security Reviews

17. People, Process and Tools
Rules

18. Codify Your Policies
apiVersion: v1
data:
policyapp-runtime-lb22.rego: >
# The package maps to the task you want to create a policy for.
package spinnaker.deployment.tasks.before.deployManifest
deny[msg] {
msg := "LoadBalancer Services must not have port 22 open."
manifests := input.deploy.manifests
manifest := manifests[_]
manifest.kind == "Service"
manifest.spec.type == "ClusterIP"
port := manifest.spec.ports[_]
port.port == 22
}
kind: ConfigMap
metadata:
labels:
group: demo
type: runtime
name: policyapp-runtime-lb22
namespace: opa

19. Policy Visibility
🤦

20. Policy Status in Non-Production

21. Training Wheels for Safe Delivery

22. Consistent Policy Enforcement

23. Enabling Cloud Migration
Best Practices

24. Nesting Doll Effect
AMAZON WEB SERVICES
COMPANY A
PROJECT 1
APPLICATION Z
NON-PRODUCTION PRODUCTION

25. Who Deployed What?

26. IaaC, CI, CD, GitOps, oh my

27. Reasonable Defaults
With Spinnaker you can define defaults at the
application level allowing teams to focus on
deployments, not operational best practices.

28. Consistent
Deployments
When using the cloud as a platform, it is
imperative to have consistent best
practices enforced at deploy time.
Benefits include:
• Easier transition between teams
• Faster time to resolution
• Higher uptime
• More time focused on strategic work
• Transparency on enforcement
• Collaboration to manage drift

29. Questions?