apidays Australia 2023 - Platforms, Products, and People: The Power of APIs October 11 & 12, 2023 https://www.apidays.global/australia/ APIs Aren't Enough: Why SaaS Leaders Are Investing In IPaaS Tim Pettersen, Head of Developer Experience at Atlassian ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. APIs aren’t enough
Why SaaS leaders are investing in iPaaS
TIM PETTERSEN | HEAD OF DEVELOPER EXPERIENCE, ATLASSIAN | @KANNONBOY

3. Platform engineer
ABOUT TIM
@KANNONBOY
App developer
Dev evangelist

4. We are a product company
ABOUT ATLASSIAN
@KANNONBOY

5. We are a product company
ABOUT ATLASSIAN
We are a platform company
@KANNONBOY

8. Atlassian’s Ecosystem
In-house Developers
Customers and professional
services customising our
products is a key
differentiator.
Strategic Partners
Integration with other SaaS
partners is key to our product
strategy across our Cloud
portfolio.
@KANNONBOY
Commercial Partners
Our commercial Marketplace
just passed $3B in lifetime
sales in Q3 FY23

9. BUT NOT AS GREAT AS IT CAN BE
OUR ECOSYSTEM IS PRETTY
AWESOME,
@KANNONBOY

10. @KANNONBOY

11. @KANNONBOY

12. @KANNONBOY

13. @KANNONBOY

14. @KANNONBOY
!=

15. @KANNONBOY
Jira Cloud Jira Server
• “Apps” are stand-alone web
services, operated by Atlassian
partners
• Data is exchanged via REST APIs
and webhooks
• UX is provided by iframes, served
directly from partner infrastructure

16. @KANNONBOY
Jira Cloud Jira Server
• Apps are stand-alone web services,
operated by Atlassian partners
• UX is provided by iframes, served
directly from partner infra
• Data is exchanged via REST APIs
and webhooks
• Apps are Java OSGi bundles that
are executed in process, deployed
& managed by customers
• UX provided by native Jira view
technologies (JSP, Webwork, etc)
• ORM, logging, AuthN, AuthZ,
scheduling, backups, etc. all
provided by the platform

17. @KANNONBOY
Jira Cloud Jira Server
Build and operate a high scale, high
availability, secure & compliant web
application.
Write a few Java classes and front-
end assets to handle your business
logic, leverage platform
abstractions for the rest.

18. BUT NOT AS GREAT AS IT CAN BE
OUR ECOSYSTEM IS PRETTY
AWESOME,
@KANNONBOY

19. @KANNONBOY

20. Platformise Trust
Abstract away security
and data privacy concerns
Platform goals
Simplify Development
Let developers focus on
delivering customer value
@KANNONBOY

21. Why a FaaS for Ecosystem?
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
Infrastructure
as a
Service
Platform
as a
Service
Functions
as a
Service
Provided by
Platform
Built by
Developer
@KANNONBOY

22. Why a FaaS for Ecosystem?
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
Infrastructure
as a
Service
Platform
as a
Service
Functions
as a
Service
Provided by
Platform
Built by
Developer
@KANNONBOY

23. Why a FaaS for Ecosystem?
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
Infrastructure
as a
Service
Platform
as a
Service
Functions
as a
Service
Provided by
Platform
Built by
Developer
@KANNONBOY

24. Why a FaaS for Ecosystem?
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
Infrastructure
as a
Service
Platform
as a
Service
Functions
as a
Service
Provided by
Platform
Built by
Developer
Moving up
the stack!
@KANNONBOY

25. Why a FaaS for Ecosystem?
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
H/W
O/S
Runtime
Web App
Business
Logic
Infrastructure
as a
Service
Platform
as a
Service
Functions
as a
Service
Provided by
Platform
Built by
Developer
H/W
O/S
Runtime
Web App
Business
Logic
IPaaS / AppFaaS
@KANNONBOY

26. Functions
Eco FaaS platforms are everywhere!
@KANNONBOY

27. After
Abstracted Infrastructure
Before
Function
Function
Function
Forge
Platform
@KANNONBOY

28. Abstracted Infrastructure
@KANNONBOY
# manifest.yml
app:
id: xxx
modules:
trigger:
- key: issue-trigger
events:
- avi:jira:created:issue
- avi:jira:updated:issue
function: trigger-func
function:
- key: trigger-func
handler: trigger.run
// trigger.js
export async function run(event) {
// business logic
console.log(event.issue.id);
}

29. Abstracted Infrastructure
✅ Simple onboarding - can bootstrap an
app in minutes
✅ No infrastructure management
✅ Simplified operations
✅ Mitigates most web app security risks
✅ Atlassian can monitor and scan client code
🚧 Automatic Multi-region & Data Residency
@KANNONBOY

30. Abstracted Infrastructure
🚊 Less flexibility in app architecture
🚌 Significant migration cost for existing apps
💰 Requires investment in compute & storage primitives
@KANNONBOY
✅ Simple onboarding - can bootstrap an
app in minutes
✅ No infrastructure management
✅ Simplified operations
✅ Mitigates most web app security risks
✅ Atlassian can monitor and scan client code
🚧 Automatic Multi-region & Data Residency

31. Network Isolation
Function Function
Forge Shard
Function Function
Function Function
STOP
Internet
Atlassian Services
GO
@KANNONBOY

32. # manifest.yml
…
permissions:
external:
fetch:
backend:
- '*.ingest.sentry.io'
images:
- '*.giphy.com'
…
@KANNONBOY

33. Simplify AuthN & AuthZ
App
Jira Cloud
Before
@KANNONBOY

34. App
Jira Cloud
(1) Per-tenant secret issued
in a signed installation hook
Before
@KANNONBOY
Simplify AuthN & AuthZ

35. App
Jira Cloud
(1) Per-tenant secret issued
in a signed installation hook
Secrets
(2) Store secret, handle
rotation protocols
Before
@KANNONBOY
Simplify AuthN & AuthZ

36. App
Jira Cloud
(1) Per-tenant secret issued
in a signed installation hook
(3) Use secret to generate
JWT (w/ custom claim) to auth
Secrets
(2) Store secret, handle
rotation protocols
(4) Incoming web hooks / iframes
also signed with JWTs
Before
@KANNONBOY
Simplify AuthN & AuthZ

37. App
Jira Cloud
User Auth
Service
(1) Per-tenant secret issued
in a signed installation hook
(3) Use secret to generate
JWT (w/ custom claim) to auth
Secrets
(2) Store secret, handle
rotation protocols
(4) Incoming web hooks / iframes
also signed with JWTs
(5) Can swap JWT for (short-lived)
bearer token to impersonate users
Before
@KANNONBOY
Simplify AuthN & AuthZ

38. export async function run(event) {
await API
.asApp() // or .asUser()
.requestJira(route`/rest/api/2/issue/${event.issue.id}/comment`,
{
method: 'POST',
body: { 'Hello there!’ }
});
}
After
No AuthN / No AuthZ
@KANNONBOY

39. Is a hosted ecosystem platform
right for your business?
@KANNONBOY

40. @KANNONBOY
82% of Forge apps on the Marketplace
launched in 3 months or less
44% launched within 4 weeks

41. go.atlassian.com/onward
Case study
go.atlassian.com/forge
Try it yourself!
Thanks!
@KANNONBOY