Hi there, welcome back. In this lecture, we're going to look at strategies for inspecting and validating your infrastructure for compliance. More specifically we'll take a look at PowerShell desired state configuration, Azure Automation State Configuration, and InSpec.

Some time ago automating the creation of resources was done largely through procedural code that was written in languages like PowerShell. While this methodology does work, it doesn't make it easy for developers to write idempotent code which is code that produces the same outcome no matter how many times you run it.

When PowerShell desired state configuration became available it was a huge improvement. Using DSC you could define a desired outcome instead of creating the process for achieving that outcome. DSC was a declarative way to automate the configuration and compliance of resources rather than a procedural way.

There are now several tools available that allow you to define infrastructure as code. These tools provide lots of benefits to DevOps teams because the tools allow those DevOps teams to now build reliable environments on demand and in a repeatable way. Such environments can even include operating systems and services. Teams can run the same code over and over again to ensure that the target state is not only present to begin with but to also remove any drift from that desired state.

Now all that being said in addition to configuration of environments there is also a need to validate those environments.

Azure Automation State Configuration is a validation tool that builds on PowerShell DSC. It makes management easier by allowing you to author and manage DSC configurations and to import DSC resources. You can also use Azure Automation State Configuration to generate DSC node configurations or MOF documents. These DSC configurations and MOF documents are then placed on an automation server. Target nodes which can be located in the cloud or on-prem can retrieve them from the automation server. The target nodes will then automatically conform to the desired state and report their compliance state back to that automation server.

InSpec is another validation tool. It's an open-source testing framework for infrastructure. It features a language for specifying compliance, security, and other policy requirements. InSpec compares the current state of a system with the desired state that you define within the InSpec code. The tool will then go out and identify violations, displaying its findings in a report.

However, unlike Azure Automation State Configuration, remediations of issues identified by InSpec is performed by the administrator.

Lectures

Introduction - Identifying & Recommending Quality Metrics - Feature Flags - Technical Debt - Team Structures - Performance Testing - Inspecting & Validating Code Base for Compliance - Inspecting & Validating Infrastructure for Compliance - Secure Development & Coding - Infrastructure Security Validation Tools & Practices - Conclusion