3 ms·

And I will nuke your off-books deployments from orbit.

comprev 3y ago
I'm involved in implementing some big changes where I work and one of them is CI runner-only deployments. Both infrastructure and applications will follow the same workflow - all changes via pull/merge requests, Jira integration, etc. Developers won't have the ability to create resources outside of the CI platform.
- candiddevmike 3y ago
  I really hope you sold the devs on this instead of commanding them to use it, otherwise their director will use his credit card to sign up for their own AWS account.
  - MattPalmer1086 3y ago
    And that director would be fired as soon as this was discovered. At least where I work, but we are heavily regulated.
    - comprev 3y ago
      This would likely be the same outcome. We're implementing changes because an outside entity states we require them.
  - comprev 3y ago
    It's a regulated environment which needed locking down. The developers still have access to the same resources albeit in a more controlled process. It's not like we flicked a switch overnight - that would be insane - it's a large scale cloud migration project over many years.
- anotherhue 3y ago
  I've seen many cases where someone signs up for a free trial at PaaS-du-jour and then starts pointing prod HTTP traffic at mycorp.magicpaas.com
  - comprev 3y ago
    I've also seen it plenty of times in the startup world. Unfortunately I've also been involved in the emergency bandage fix once it was discovered...
Silhouette 3y ago
Through the forcefield of a VP two levels above your boss who authorised it? Even if you know about it - which is a big "if" - you probably won't have either the authority or the practical means to shut it down. It's become a classic problem. Organisations want to centralise infrastructure and services because consolidation saves on costs and increases visibility and control. Particularly if you're under specific regulations that can make things much easier. But that only happens if the centralised provision actually works. It has to be adequately resourced and reasonably well managed and supportive of the people using the infrastructure or services it provides. If the centralised provision is not good then it had one job and failed to do it. Whose fault it is doesn't really matter. It's not supporting the other parts of the organisation to do their jobs and inevitably a point will come where that infra gets "othered". We've been seeing this phenomenon ever since we had central system administrators who could lock down the OS on individual employees' workstations. The admins argue that they need to make sure security updates are properly deployed and they need to prevent non-expert users from breaking things and they need to ensure consistency because they're also running the help desk and ultimately they're responsible for these things so they need the authority to control them. All very fair and reasonable. And all completely irrelevant to someone with actual revenue-generating work to do who is being blocked for days or weeks because some sysadmin whose opinions are not necessarily justified by their effectiveness hasn't enabled or authorised some essential facility.
jayd16 3y ago
Seems pretty silly. Why do they have permissions if it's not allowed?

I'm involved in implementing some big changes where I work and one of them is CI runner-only deployments. Both infrastructure and applications will follow the same workflow - all changes via pull/merge requests, Jira integration, etc. Developers won't have the ability to create resources outside of the CI platform.

candiddevmike 3y ago
I really hope you sold the devs on this instead of commanding them to use it, otherwise their director will use his credit card to sign up for their own AWS account.
- MattPalmer1086 3y ago
  And that director would be fired as soon as this was discovered. At least where I work, but we are heavily regulated.
  - comprev 3y ago
    This would likely be the same outcome. We're implementing changes because an outside entity states we require them.
- comprev 3y ago
  It's a regulated environment which needed locking down. The developers still have access to the same resources albeit in a more controlled process. It's not like we flicked a switch overnight - that would be insane - it's a large scale cloud migration project over many years.
anotherhue 3y ago
I've seen many cases where someone signs up for a free trial at PaaS-du-jour and then starts pointing prod HTTP traffic at mycorp.magicpaas.com
- comprev 3y ago
  I've also seen it plenty of times in the startup world. Unfortunately I've also been involved in the emergency bandage fix once it was discovered...

Silhouette 3y ago

Through the forcefield of a VP two levels above your boss who authorised it? Even if you know about it - which is a big "if" - you probably won't have either the authority or the practical means to shut it down. It's become a classic problem. Organisations want to centralise infrastructure and services because consolidation saves on costs and increases visibility and control. Particularly if you're under specific regulations that can make things much easier. But that only happens if the centralised provision actually works. It has to be adequately resourced and reasonably well managed and supportive of the people using the infrastructure or services it provides. If the centralised provision is not good then it had one job and failed to do it. Whose fault it is doesn't really matter. It's not supporting the other parts of the organisation to do their jobs and inevitably a point will come where that infra gets "othered". We've been seeing this phenomenon ever since we had central system administrators who could lock down the OS on individual employees' workstations. The admins argue that they need to make sure security updates are properly deployed and they need to prevent non-expert users from breaking things and they need to ensure consistency because they're also running the help desk and ultimately they're responsible for these things so they need the authority to control them. All very fair and reasonable. And all completely irrelevant to someone with actual revenue-generating work to do who is being blocked for days or weeks because some sysadmin whose opinions are not necessarily justified by their effectiveness hasn't enabled or authorised some essential facility.

jayd16 3y ago

Seems pretty silly. Why do they have permissions if it's not allowed?