Writing software that does what it's supposed to is easy. Becoming successful at delivering software "as-a-Service" is a completely different beast and a significant shift for any organization. Not least because it's an act that spans across multiple disciplines which need to work together and rethink the way they operate. Join this presentation for some lessons learned from our Cloud Transformation Journey and recommendations around the topics of Cloud Architecture, Operations, Security and Service Management

1. The Road to SaaS
Victor Ionescu
Principal IT Consultant @ msg systems Romania

3. Chapter 1.
Building for the Cloud
Cloud Architecture

4. Say NO to Hypes

5. Cloud Architecture Rulebook

6. Rule #1: Start with the Problem, Not the Solution
Online Shop
User
Management
Billing
Product
Catalogue
…
• Business First, Technology Second
• Decompose the Problem into
Subdomains (DDD, Event Storming)
• Identify Your USP

7. Rule #2: Cloud is about Outsourcing Headaches
User
Management
Billing
Product
Catalogue
…
Buy vs. Build
• Buy vs. Build isn’t a binary decision
• Nobody needs another VM
• Code is a Liability
• Don’t run software you didn’t build
(e.g. Databases)

8. Rule #3: Don’t Let Technology Define Your Architecture
Database
Expectation Reality – “Spaghetti Architecture”
Database
Business Logic
Cross-Cutting
Concerns
Infrastructure
Connectivity
Function-as-a-Service

9. A Better Approach
Database
function function
Business Logic
Infrastructure
Connectivity
Cross-Cutting
Concerns
Key Points:
• Business Logic at the core
• unaware of the underlying Infrastructure
• shared across services (functions)
• Dependencies always pointing inwards
(“Inversion of Control”)
Known as:
• “Clean Architecture” (Uncle Bob)
• “Hexagonal Architecture”
• “Onion Architecture”

10. Chapter 2.
Running in the Cloud
Cloud Operations

11. DevOps isn’t what You think it is
Put yourself in the position to deliver
the best-possible service to customers
• Know when something is wrong
(“Observability”)
• Have a Plan to fix it (“Shared
Responsibility”)
Infrastructure-
as-Code
What Teams
Focus On
T-Shaped
Skills
Scripting
What Customers
See
• Reliability
• Availability
• Security
What’s Actually
Critical
?
Pipelines

12. Observability is Key
New Skills to Learn
• Building “Observability” into the
application
• Efficient Troubleshooting
Continuous Improvement
• Post-Mortems
• Drills
• Chaos Engineering
What Teams
Focus On
What Customers
See
• Reliability
• Availability
• Security
What’s Actually
Critical
Monitoring
Alerting
Troubleshooting
Continuous
Improvement

13. Towards a DevOps Operating Model(?)
App Team
Ops Team
“I Build it,
I Run it”
(“DevOps”)
“I Build it,
You run it”
(“Silos”)
Responsibility
Spectrum
Infrastructure
Platform
Application
Lessons Learned
• There are many flavors of
“DevOps”
• End-to-end ownership also
comes with downsides

14. Managed Services to the Rescue
App Team
Ops Team
“I Build it,
I Run it”
(“DevOps”)
“I Build it,
You run it”
(“Silos”)
Responsibility
Spectrum
Minimize Your Area of
Responsibility
• Outsource Headaches to Your
Cloud Provider
• No need to stop at
Infrastructure
Hyperscaler’s
Operational
Responsibility

15. Lack of Governance Leads to a ZOO
App Team
Hyperscaler
Managed
Service
Given the Opportunity, 3 Teams will find 3 Solutions for the same Problem
App 1
Ops Team
App 3
(Kubernetes on AWS)
App 2
(Lambda) (Docker + AWS Fargate)

16. Chapter 3.
Organizing for the Cloud
Cloud Governance

17. Why Governance Matters: Security
Individual Security Setups
Heterogeneous Tech Stacks
High Cost + High Risk
Identity and
Access
Management
Secret
Management
Vulnerability
Management
Business
Continuity
Management
Logging and
Monitoring
Incident
Management

18. The Thinnest Viable Platform*
Thinnest Viable
Platform
Why:
• Compartmentalize Complexity
• “Divide and Conquer”
• Standardize
• Processes
• Architecture
• Improve Developer Experience
• Self-Service
How:
• As restrictive as necessary
• As permissive as possible
*Source: https://teamtopologies.com/key-concepts-content/what-is-a-thinnest-viable-platform-tvp

19. Thinnest Viable Platform - exemplified
Infrastructure
- Region and Service Constraints
- Backup Policy Enforcement
Identity and Access Management:
- SSO. MFA
- Role Management (Least Privilege)
- Privileged Access Management
Operations:
- Deployment Strategies (Blue-Green / Canary / ..)
- Backups and Recovery Strategies
Logging:
- SIEM
- Threat Management
Project Engagement
- Self Service Enabled
- Security by Design (e.g. Vulnerability
Management)
- Cost Management