Hi, and welcome to 'This is My Architecture'.
Today. I'm with Crispin from Volkswagen Financial Services.
Thanks for having me.
So Crispin, tell me a little bit more about the whole company that you are working at.
So I'm working at Volkswagen Financial Services
and the company is coordinating the financial activities
of the entire Volkswagen Group globally.
We offer products such as financing, leasing, mobility services, and insurance.
And we ensure that our customers stay financially flexible
and stay mobile in 48 markets.
And that implies that you are really strongly regulated.
So are you falling for example under European Central Bank regulation?
Yes, but not only the European Central Bank regulation,
also, from different central banks such as the FED in the United States.
Okay, I see.
Can you just briefly guide us about which one is the use case
that we are going to discuss today?
Yes, the use case is about wanting to bring our products
closer to the customer, so that they have a seamless experience.
For example, if they want to buy a new insurance package for their car,
they should be able to do it online as well.
What about the AWS presence?
So we started back in 2017 with AWS.
As of today we have 1,400 AWS accounts
used by more than 1,200 developers.
And if we're talking about production workloads,
we have roughly 300 production workloads.
And the important aspect here, everything is managed in a central landing zone
by a central platform team consisting of 8 engineers.
Okay.
And you just mentioned that you started in 2017,
and I can imagine that the 1,400 accounts came later on.
So that means that you started small.
Can you just guide us through the whole process?
Yes, we started as most customers do at AWS,
I would assume as a single account environment.
And couple of developers, dozens of developers, developed couple of products there,
and it was a high risk and also a chaotic environment.
I still remember the day when I was deleting a server of a different team,
which was not a really a good experience.
So the first step we took, we splitted the workloads into different workload accounts
and also applied a staging concept.
So each workload got four AWS accounts representing different stages.
For example, the development, integration, and production account.
And I can imagine that actually that helped you to reduce the whole blast radius.
Yes, it did.
But what about the governance?
Did you apply it or introduce some governance on top of the users?
Yes, we did.
So the next step was that we introduce the centralized IAM account
and hosting our Single Sign-On provider, which is rated SSO on a Fargate cluster
so that we can apply user governance.
So what we do is we are using SAML that our developers can log in
to their workload accounts so that we ensure user management processes
such as recertification of users or temporary production access in a monitored state.
Okay, and I can see here that your writing is SSO Bifrost.
What is it exactly related to the Fargate?
Yeah, so we rebranded Red Hat SSO,
and we are using Bifrost from the Marvel movies
as Bifrost represents our rainbow which connecting different traits and different AWS accounts.
That's an amazing example to show that not only it's possible to integrate
different AWS services, but also open source tools and also for example, this Red Hat SSO.
So I see here also that you wrote something about compliance and auditing.
Do you mind just guiding us through?
Yes.
We have a centralized compliance and monitoring account
and also centralized auditing account.
The auditing account is used that all the CloudTrail logs flow into a centralized place.
And our centralized compliance account
is that we can generate reports for our security officers.
Okay, I see.
So you just mentioned centralized.
So I guess it's something like a single source of truth.
Which one is the main benefit that you just observe
from just introducing such an approach?
Yes, so for us, it's important that we have a single source of truth
and also a centralized dashboard for our security officers.
That means well, there are two examples.
The first one is AWS Config.
We are using AWS Config to track resource changes
across all of our 1400 AWS accounts,
so that we can generate reports for our security officers.
Another example would be Amazon Inspector.
We are using Inspector, as you might remember back end of last year
when we had the [inaudible] happened
and Inspector enabled us to scan all of our instances and containers
in a matter of minutes, and we could identify which resources were actually affected.
I see.
And at the very beginning you've written that you had 1,400 accounts.
I can imagine that it had been a challenge for you to just manage that amount of accounts.
Was it that way?
Yes, it was a challenge, and it's still a challenge,
but to my opinion, they are true major ingredients.
The first one is you need to have an amazing team.
So shout out to my team.
And the second factor is you need to automate as much as possible.
And we are really thankful that AWS launched AWS Organizations,
which helps us to automate as much as possible.
So for example, we are using hundreds of thousands CloudFormation stack sets
to apply a certain baseline to each account.
Okay, so you started briefly five years ago,
and you just evolved the whole architecture until today?
And I can imagine that that's not going to stop there.
Do you have any plans for the future as well to just keep evolving the whole architecture?
Yes. We plan to continue to scale at this,
at that amount of accounts, and we have new initiatives planned,
for example, big data or data driven scenarios.
Also, we are looking forward to push the boundaries with AWS Service teams
and continue to push boundaries.
And also we are looking into integrating new services
such as VPC IP Address Management.
Okay.
So I've seen nowadays a lot of customers struggling
to just keep with compliance, keep compliant and keep with regulations as well.
But this is an amazing use case and an amazing example
in how to address such a situation.
So thanks a lot for guiding us through in the whole process and the whole use case.
You're welcome, thanks.
And thanks a lot for watching 'This is My Architecture'.