News
More from RSA Conference 2023

Travis Stanfield

Co-Founder & CEO

Stacklet

Gokhul Srinivasan

Sr Partner Solution Architect

AWS

Governance as a service has arrived, but why should orgs care?

Delivering solutions as a managed service is nothing new. It’s already taken over security, cloud and infrastructure.With governance next on the list, what gains can organizations expect from this delivery model as opposed to traditional approaches?“We help organizations manage and reduce their costs and risks,” said Travis Stanfield (pictured, right), co-founder and chief executive officer of Stacklet Inc. “We do that through our governance-as-code platform, which is delivered and made available to customers through a very easy-to-use software as a service.”Stanfield and Gokhul Srinivasan (left), senior partner solution architect at Amazon Web Services Inc

Info

Travis Stanfield | Stacklet & Gokhul Srinivasan | AWS

Travis Stanfield

Co-Founder & CEO Stacklet

Gokhul Srinivasan

Sr Partner Solution Architect AWS

(bright intro music plays)

>> Welcome back to theCUBE's live coverage, day four of RSA Conference. I'm John Furrier, host of theCUBE. Dave Vellante has left the building, he's flying back to Boston. We had four days of great coverage, a lot of content coming out, and one of the big themes has been the platformification. You know, seeing Cloud Native become very important. A lot of open source, a lot of content around hardening the infrastructure by enabling agility. We've got two great guests and we're going to talk a lot about that right now. Travis Stanfield, the co-founder and CEO of Stacklet, and Gokhul Srinivasan, senior partner and solution architect at AWS. Gentlemen, thanks for coming on.

>> Thank you for having us, John.

>> So first, let's introduce you guys. We know AWS. Stacklet, what do you guys do? What's the company? Why do you guys exist?

>> Sure. We are the cloud governance solution. We help organizations manage and reduce their costs and risks. We do that through our governance code platform, right, which can be delivered and available to customers through a very easy to use software as a service. And we've got a few other things which we'll get into.

>> And you got the open source angle too, CNCF.

>> Open source, that's correct. So we are based off of a open source project called Cloud Custodian, that we are the core and creative team behind. My co-founder is the creator and lead maintainer and, certainly, as we will discuss here, it gives us a number of unfair strategic advantages.

>> And by the way, just a shout out, super cool work, congratulations. Gokhul, what's your role as a solution architect? What are you putting together at AWS?

>> Yeah, I'm the senior partner solution architect supporting our global startups such as Stacklet. As part of the global startup program, we help the partners, essentially the startups, with the CodeBuild activity where we engage them and promote their activities, and then we support them in the go-to-marketing and support them with the cold sell. Essentially, we wanted to ensure that the partner solutions that are being promoted via AWS, are meeting all the security guard rails, are the best in the class. So that way the customer get the experience of just not the core AWS services, but also the benefits from the partner solutions.

>> Yeah, great stuff. By the way, we are very familiar with the work you guys are doing with our, our startup showcase. We've been a lot of your success stories, so good job. Well, John, so let's turn into the governance. What is cloud governance? What, how do you guys define that? Define what is cloud governance today?

>> So in a simplistic term, cloud governance is essentially a set of framework that helps the customer establish the processes and select the right set of tools for the overall management and the governance of their cloud ecosystem. And the customer look into the cloud governance into two different aspects. The first one, providing them the better control of their cloud management. And second aspect is the agility to build newer applications and innovate faster. And with AWS services, you do not have to choose either the control or the agility. You can have both for the scale of your organization and slicing the cloud governance even further, the cloud governance is found by four major pillars. First, to begin with, is the security control which which focuses on areas like the encryptions and also the permissions and their identities. And then comes in the cost control, where the customers want to achieve the cost control of their overall cloud operations. And then the most important aspect, when it comes to the cloud governance, is around the compliance. And compliance can come in variety of form. Either it could be a regional compliance like SOC two or a GDPR or an regulated industry governance like a HIPAA or a PCI compliance. And finally, the customer wants to ensure that the cloud governance is in alignment with their overall corporate governance. They do not want to have a multiple governance model. So the alignment of the cloud governance with the overall corporate governance model becomes very important. So in a nutshell, what our customers are looking out for is end-to-end visibility tool that provides the all the aspects of the cloud governance that caters to all levels of the organization from a CXO to a DevOps engineer.

>> That's awesome. And then you want to also have the governance and and have agility, not slow things down at the same time. Cloud governance, what's your definition?

>> Sure. And and I think Ghokul gave an amazing definition of it. I would add a few things. Certainly the policies themselves, right? They're kind of the heartbeat of your governance definition as it is implemented, and you want those to be as easy to use for all of the different stakeholders that get involved with governance. You don't want to create a high technical bar, right? For the organization to continue to contribute and collaborate around this important topic. And then also making sure that the governance the policies can be deployed using techniques like C I C D that the organization is already using and perhaps get right which is already well known across multiple organizations for how folks can collaborate, right? Continue to use the best practices that developers use for making sure that your cloud is well governed and you're well managed in the cloud.

>> It's certainly important. And globally too, we're seeing a lot of global activity. Governance is huge. Compliance governance. Most people say, oh my god, it's so much hassle but you want to make it fast, but yet, hit all the numbers but not make it slow down, but also hit the compliance. Totally, totally get it. How do you guys help, what's the differentiations for stack lit? What's, what's your piece on this and what how do you make it better and go faster and differentiate?

>> Sure. I'd say I'd start off with we help the organization unify several of these disparate teams towards the shared objectives around governance. So the the different teams can be the cloud engineering team, the compliance and risk team the finops teams, the DevOps teams, all of those, if they are working together, can help the organization achieve their efficiency goals, right, around financial governance. They can achieve the compliance goals, they can achieve the security goals. That's kind of the first piece. The second is we do, which can be a bit of a controversial subject in security circles, we do the automated real real-time remediation and prevention, right? We do that both in event-based and periodic modes and combination of both. And we do that by making action a first-class citizen in our policy language. You don't have to do anything else to, you know let's say, construct a workflow, to integrate, to communicate with your team around your policy findings. You simply can dial that in, and what it does is give you a declarative experience. You can design the instate of your cloud and if anything goes bump in the night you know that it's going to get gracefully course corrected in line with what your organization would like it to, to be. So, and then the third last, but not least, is the massive community that we have around cloud custodian. It is the defacto industry standard for governance and for policies. And you know, certainly, why this is important is folks like AWS continue to innovate at light speed. You want to keep up with that pace of innovation and you certainly want to do so across all of the different, the long tail of all the different things that Amazon offers. And then, oh, by the way, if you're multicloud, that long tail gets even longer and that the challenge becomes even more compounded.

>> Couple follow-ups, chef, if you don't mind.

>> Yeah, please.

>> First of all, give some color to the governance, the open source project. What's successful? I know it's successful. Congratulations. I think this is now an event. Is it now an event?

>> Yes. The, so the project is now part of the cncf, right? It's in the incubation stage of the CNCF maturity cycle for open source projects. So that's right in line.

>> Next step gets endorsed, right?

>> That's exactly the last, the next step is the last step. And certainly we are well on our way towards achieving that final, that final stage. The community in terms of how wide and large and diverse it is. We've got almost 400 contributors all time in use by thousands of organizations. We've got thousands of people in our, you know, chat groups and that sort of thing. So it's already as mentioned, like the, the industry.

>> It was pretty fast rise too, by the way, pointed out. Good job on that. My other question is, you went back to something that's controversial is what you were saying. It sounded great to me. Why would that be controversial, declarative?

>> Look, I think there's still, what

>> Controversy is there?

>> There's still some organizations for which like the, the CISO or the security group maybe isn't empowered to take action, right? They want to perhaps cut a ticket, flip it over the fence and that's okay. But at a certain level the scale in the, that's all process. You need the automation.

>> Well, what you just said is the ideal, preferred steady state; you want to have action built into the workflow, automation. You got corrections, self-healing, got it. Tuning, I mean all the-

>> You don't just want it, you need it at a certain level.

>> That's, it sounds like a preferred state.

>> It is.

>> But it's kind of like WebAssembly business why don't we that happen sooner?

>> Exactly, exactly.

>> It's obvious. Yeah, it's kind of like, hey, no brainer. Right? All right, let's get into the Amazon side, the tool chain involved. You guys know this on and on the compliance side, it comes up all the time when I do Amazon interview, Amazon websites. Compliance is not easy when you look in that regional; but you have a lot of region, you can make things work better across the cloud. How important do you see this piece of it? Cuz you got now open source and developers coding in line get the new, the new preferred method. You guys are used to this undifferentiated heavy lifting being automated away.

>> Oh, absolutely.

>> Can you add some color to how that works with the Amazon tool chain?

>> Okay, so within the Amazon tool chain there are two or three different important aspects, right? Even internal to AWS, our recommendation is to automate and go with the API and the cloud formation and the infrastructure as a code as the fundamental building blocks. Because essentially what we have seen is just not the success story of our customers, but also where our customers and partners had challenges. To give an example, we have a lot of customers who start bundling a lot of their business workloads into a single AWS account and then without no governance. And then when they really want to scale and grow their business, that is a lot of opportunity coming in, but they're unable to scale and that slows down their business growth prospect because the governance was not in place.

>> So they, they didn't think was an afterthought relative to the deployment.

>> Exactly. They started with the business-

>> Had problems With them.

>> Exactly. So they started with the business first approach. The solution was great, the technology was good, but there was no governance in place. As you rightly brought up, there are multiple regions when they want to scale across these different regions. There are different teams operating these workloads. So these different teams and departments, they look for their own set of controls, their own set of governance policies. And also they wanted to manage the cost because of the different geographies and the different compliance that are required in those geographies. So in order to manage it, this is essentially where the governance becomes an essential part. And this is one area where we found that governance platforms like Stackler really plays a differentiating role.

>> Yeah, yeah. And one of it's-

>> Governance is code.

>> It is, yes.

>> That's basically what it is. Infrastructure is code the governance. = Exactly.

>> You built your cloud with code, you should govern your cloud with code as well.

>> Take us through on the stack size, I'm a developer say I screwed up and I didn't do the compliance. I bolted it on after as an afterthought. Do you have to go back and redo it or so take me through that scenario and then what happens? I want to be more proactive. Is it built into my C I C D pipeline? Take me through the developer aspect of it.

>> Yeah. So one of the things that we have just announced and just launched is what we refer to as our infrastructure as code governance. So as we are describing in this conversation, the way you get to cloud today predominantly is going to be through an infrastructure-as-code technique. And, when you're doing that, as you're mentioning, there's a developer experience that you want to engage with and you want to have your controls engage with, as well, your governance and compliance policies. So the way we do that is we give you the ability at the developer workstation, at the CI, and at the CD level, right? The the pre or... sorry, pre-marriage, pre-commit, re-deploy and then also at runtime ability to dial in these policies, right? We do that through the same experience that cloud custodian gives you. That's very easy to use. Human readable yammel dsl. And, what that does is it unlocks a prevention story, right? You can fix the things at the source, no pun intended. Right?

>> And are you shifting left?

>> We are shifting left. Yes. Absolutely. Doing that is exactly what we're doing. We have already shifted the challenges of governance left by embracing governance's code and creating a platform around that. Now, we're also embracing that and making that possible, right? Where the developer lives in the workstation the pipeline and the deploy, right? You can now have that complete control, inclusive of what's going on at runtime and do so in a way as mentioned, that's going to 10 x the organization because they're going to be more engaged in the policy creation.

>> And how does the developer know that they've got the governance as code? Is it more education? It's just got to know it's there? I mean or is it more of they don't really have to think about it?

>> Well, so the experience is going to be very similar to like a-another coding standard, right? Hey, you made this violation, this misconfiguration, this is not aligned to best practice. This being, let's say, the infrastructure is code that you, let's say, we're developing right there in your workstation or trying to merge in or deploy out, right? You will detect all of those things inform the developer, "Hey, do you realize yeah where you perhaps violated our best practice? Here's the recommended way of doing that." And that, um, creates the reinforcement learning that ultimately changes the culture for the developers to be more aligned in embracing of the organization best practice. And what it does is it gets 'em going faster.

>> What's the market like? Cuz this is one of those things where I can see enterprise missing the boat on this or not paying attention. It's kind of reminds me of the old days when in enterprise where backup was not thought about until like, oh, where we going to back this stuff up? They, but bolted on as an afterthought. And then that became, they flipped the script. Now with ransomware and security, no one talks about backup as an after this all on the front end. It's all designed in this is designing it into the beginning.

>> That's right.

>> This is what's happening.

>> That's right.

>> How aware are the customers on this? Because imagine it must be some going, "Hey, I get this." And some saying, "wait a minute I didn't know I needed to do that." And then so, so where are we on the progression and the mind share of the customers? If you guys could share some commentary on that.

>> I'll start. So I think Ghokul made an astute observation that a lot of the early approaches to cloud may not have appropriately taken into account, like, :how do I prevent these things?" Right? So there can be, oftentimes, with a customer journey the need to let's say, dial in some remediation and reduce the technical debt that may have been accumulated from the early entry approaches into cloud. But then, I think everybody can appreciate, hey if I can avoid that technical debt through preventative controls, we would absolutely do that. So there's a lot of resonance towards that approach. And we do that in as easy to use and a way that embraces and unifies the organization.

>> Yeah. As Travis rightly said, what we are observing from our end customer and partner siders, the the direction earlier in the stages is really increasing the productivity of the developers by multifold. Because this is just not about the technical aspect. Also from the, the overall DevOps process it eliminates a lot of the unnecessary tickets and also unnecessary meetings. So it's, it enables the developers and empowers them to experiment with a variety of aspect. And then in a lot of organization, the responsibility is spread across multiple teams. The developers probably don't have much insight into the the security needs or the compliance needs because they are probably fully focusing on the technical aspect. So this shift-left approach helps-

>> It's, it's a matter of time. I mean no one does tickets. I mean, come on. It's just like, it's so antiquated. It's so vulnerable... It's, I mean, I think it's a wake up call. I'm sure you guys are going to do really well. Talk about your customer base. I know you guys have a lot of confidential big customers. I know you can't say their names, but, you know, give them give a taste of some of the organizations-

>> Sure.

>> That are working with you. Size, scope, needs.

>> Yeah, yeah.

>> The, the residents. Are they leaning in? What's the feedback? Can you share some information?

>> We actually just had a customer advisory board a few weeks ago. It was amazing and very invigorating. Our customers love our product. They are growing in users, usage, use cases. They're becoming public advocates on our behalf. It's really a movement. And certainly that's exciting for us because we know and are passionate about the challenge that we're solving and making an impact in their lives. So in, in terms of like the diversity of the customer base we do have one of Amazon's largest customers. So we know that we can achieve the level of scale at cloud scale or cloud size. Right? And then we also have customers across, you know other diverse different verticals. Like, all verticals kind of face this challenge in the cloud once you, it's-

>> A horizontal solution. every developer-

>> That's right.

>> Organization needs this. And I, and I got to say just my observation in covering Amazon's cloud and, just knowing how the global landscape is, this only going to get more pressure to be more sovereign in international areas, you're going to have to stay within region. It's going to be- more policy is coming.

>> Sure.

>> That's, that's not ticket friendly. Right? You got me on the tickets thing.

>> It triggered me. It's just so old. I mean, it's not a, not a, it's not controversial. It's like it's going to happen. Right? I think people who are not going to align with actionable and self self-healing kind of thinking is going to be out of business.

>> You get to a place in the cloud and we've seen, you know, a lot of that attachment happen at a certain point where the infrastructure just isn't knowable in a single person's mind. Yeah. You can't, you know throw enough people at the problem.

>> Yeah.

>> Some of the existing toolkit as you mentioned perhaps doesn't scale as appropriately as our solution does. Or has proven itself to have accomplished and you, you know, just get overwhelmed. Right. And that's a big part of the journey that we take folks on is again, let's clean up some of the debt that you may have already accumulated and then, let's really start to prevent it going forward. Yeah. And that's, that is the business velocity improvement. That GOCO reference.

>> Yeah.

>> It's first awareness, operationalize it and then it's going to self tune itself. It's now part of the operations. It's obviously, you know, that

>> And part of the culture, right?

>> The culture.

>> I mean, and, and the fact that you open source project has so much traction, right. Shows that it's not just tire kicking techies and and you got real practitioners That's right.

>> That's right.

>> I think that's a tell sign. Obviously Amazon, you know the cloud's global and has opportunity.

>> Absolutely. Travis, Ghokul, thanks for coming on the queue. Appreciate the breakdown of governances code. Again, another sign that cloud is going to be at the center of the security equation. We know what's going to happen here. It's just a matter of time, cloud edge, on-premise. As one operating model security will be with Network the key platform, the Platformization... platformication of securities coming. this theCUBE. We'll be right back with more, on day four, after the short break. (calm outro music plays)

Travis Stanfield | Stacklet & Gokhul Srinivasan | AWS

(bright intro music plays)

>> Thank you for having us, John.

>> So first, let's introduce you guys. We know AWS. Stacklet, what do you guys do? What's the company? Why do you guys exist?

>> And you got the open source angle too, CNCF.

>> And by the way, just a shout out, super cool work, congratulations. Gokhul, what's your role as a solution architect? What are you putting together at AWS?

>> That's awesome. And then you want to also have the governance and and have agility, not slow things down at the same time. Cloud governance, what's your definition?

>> Couple follow-ups, chef, if you don't mind.

>> Yeah, please.

>> First of all, give some color to the governance, the open source project. What's successful? I know it's successful. Congratulations. I think this is now an event. Is it now an event?

>> Yes. The, so the project is now part of the cncf, right? It's in the incubation stage of the CNCF maturity cycle for open source projects. So that's right in line.

>> Next step gets endorsed, right?

>> Look, I think there's still, what

>> Controversy is there?

>> Well, what you just said is the ideal, preferred steady state; you want to have action built into the workflow, automation. You got corrections, self-healing, got it. Tuning, I mean all the-

>> You don't just want it, you need it at a certain level.

>> That's, it sounds like a preferred state.

>> It is.

>> But it's kind of like WebAssembly business why don't we that happen sooner?

>> Exactly, exactly.

>> Oh, absolutely.

>> Can you add some color to how that works with the Amazon tool chain?

>> So they, they didn't think was an afterthought relative to the deployment.

>> Exactly. They started with the business-

>> Had problems With them.

>> Yeah, yeah. And one of it's-

>> Governance is code.

>> It is, yes.

>> That's basically what it is. Infrastructure is code the governance. = Exactly.

>> You built your cloud with code, you should govern your cloud with code as well.

>> And are you shifting left?

>> And how does the developer know that they've got the governance as code? Is it more education? It's just got to know it's there? I mean or is it more of they don't really have to think about it?

>> That's right.

>> This is what's happening.

>> That's right.

>> Sure.

>> That are working with you. Size, scope, needs.

>> Yeah, yeah.

>> The, the residents. Are they leaning in? What's the feedback? Can you share some information?

>> A horizontal solution. every developer-

>> That's right.

>> Sure.

>> That's, that's not ticket friendly. Right? You got me on the tickets thing.

>> Yeah.

>> It's first awareness, operationalize it and then it's going to self tune itself. It's now part of the operations. It's obviously, you know, that

>> And part of the culture, right?

>> The culture.

>> I mean, and, and the fact that you open source project has so much traction, right. Shows that it's not just tire kicking techies and and you got real practitioners That's right.

>> That's right.

>> I think that's a tell sign. Obviously Amazon, you know the cloud's global and has opportunity.