Why is it so hard to get IaC right? Kelsey Hightower talks with AutoCloud

Transcript

"Yeah, I mean, for people that don’t know, I’m an advisor to the AutoCloud team. And the one thing that’s interesting about what
they’re attempting to build is this situation where you’re doing configuration as code. And you walk into any company, I guarantee it, probably even your own company if you’re listening to this, and you ask, how much of the cloud resources that you use--I’m talking
everything from load balancers to those S3 buckets--are actually covered fully by the configuration that you actually want?

Most people are dealing with default values - they don’t even know what it means. Maybe you’ve downloaded a Terraform module
from the cloud or maybe only a subset of your cloud resources are actually under management, meaning you probably just logged into the console, like the majority of people, and just clicked around. Now it works and you’re like, "yo just don’t touch it!" You know what I mean? And then that stuff is not necessarily being tracked. So everything we just said earlier about getting consensus [doesn't apply].

And then taking what we learned or agree on and turning it into a config and moving forward, you don’t have that anymore because now you have this blind spot, right? So I think the kind of biggest challenge most people have is what resources do we actually depend on and
need? And do they actually adhere to the configuration that we actually want? And when I say configuration here, I’m talking about all
the decisions you make to green light something for like production.

InfoSec wants these security things. The platform team wants these tuning parameters. The developers are actually building on top of it. They want to configure what it looks like. All of that needs to be expressed somewhere. And I think that’s the negative space that people struggle with--how to actually get to that particular point where that’s what they’re doing."