Welcome to 'This is My Architecture.'
Today, we are in Zurich, Switzerland and I have Sebastian from Roche with me.
- Hi, Sebastian. - Hi, Ramon.
Sebastian, tell us a bit about Roche.
Yeah, Roche is one of the leading pharmaceutical companies specializing in personal healthcare cancer medicine.
And like many enterprises, it's on its cloud journey,
and, yeah, we have IT supporting that, of course.
All right, and so, you brought us an architecture diagram here today.
What was this project about?
The project is about catering for different viewpoints of a cloud journey.
If I'm a data scientist, I know the cloud is fast.
It's easy to use.
I get immediate service. I get all the services.
Of course, if I'm working for legal or security,
it's more about, how do we control risks
and how do we stay compliant with GDPR, with HIPAA laws.
And we try to cater for both views and both needs with our architecture.
Okay, that's very interesting.
If I'm a user, can you walk us through this journey, so to say?
Sure. Let me start actually at the bottom here.
The bottom is something we call a data hub.
The data hub is a distributed data store
where we, of course, use a couple of AWS technologies to store data,
Redshift, S3, Lake Formation for automation,
but important thing is still onboarding the metadata capturing.
So we have a semi-automated onboarding process
that makes sure that all the metadata that are relevant for the data.
What is the data about? What is the format,
but also what is the usage scenario?
Are there any legal things? Are there licenses involved?
All these things are captured in the moment some data enters the hub.
The principle is always a very clear separation of processing and storage.
So storage is forever, of course.
Yeah, it needs to be extremely secured, extremely monitored.
For us, it's important to know exactly who is using which data for which purpose
and what is really the usage scenario.
On the other hand, we have the processing
where people say, "Okay, I need an AWS account
doing things from SageMaker machine-learning,
and that is for us more temporary.
Can be, of course, couple of years temporary,
but still it is definitely something that goes away.
And that is what we try to establish here.
The user journey would actually start going to a ticket system, ServiceNow, for example,
and say, "I have a request for an environment.
I want to process data. I want to do some data science," for example.
We have some automation between ServiceNow and the Service Catalog,
but then triggers a couple of creation steps from CloudFormation.
The CloudFormation outcome is one of these here.
That is something we call a bubble.
That is essentially an AWS environment,
but AWS environment is very shelled out.
So inside your admin, you can do a lot.
You can use all these 170 services.
On the outside, we have a lot of things like firewalling,
like making sure that no data can be open to the internet,
but also a lot of policies like encryption is insured in every case.
And that is all automated through CloudFormation.
And so, let's say I'm a user and have this bubble environment now.
How do I go about requesting data?
Yeah, bubble environment, of course, is empty so you go to this GUI here.
That is custom software also deployed on AWS,
developed with the tools there, the datahub GUI.
Here you have a data catalog, typical data catalog
that allows you to find all of the data assets that went in
and next step is requesting the data for access.
The request at the end of the day, looks at all the data that are physical there
and involves the data owner always saying yes or no to that request
because the data owner at the end is the one needing the usage scenarios of the data.
Then out of these different technologies, if your request was approved,
you get a cross-sharing back to your data environment
and really can start working with it.
It's normally read-only
so that you have, in a best-case scenario,
only a couple of minutes between finding the data and accessing the data.
So you're not actually moving data, right?
You're just sharing this S3 bucket
and those accounts can, say, access it in read-only mode?
That is correct. It goes, again, to this permanent usage
and permanent character of that storage.
And if you have results, because you will produce results,
that, again, will go into the datahub,
being available for the next group, for example, using this data.
Right, and what role Service Catalog and CloudFormation play in all of this?
I would put it broader. Automation plays a very big role.
On the one hand, automating the environments,
meaning really making sure that all the policies, all the measures are automatically there,
automatically controlled.
That is one big part.
But if I'm in the shoes of a user,
I want to build up environments like EKS or SageMaker.
That can be quite complex, especially in the case of EKS.
But I don't want that. I'm a data scientist.
So I'm looking for a one-click scenario
where I easily can use a predefined configuration and start working immediately.
That, again, is something that we mostly put into Service Catalog.
- All right. Thank you for sharing, Sebastian. - Thank you, Ramon.
And thank you for watching 'This is My Architecture.'