Seamless IaC Generation with appCD’s Asif Awan

This is Textron tv. Hi everyone. Welcome back here to techron tv.

I wanna introduce you to our next guest. His name is Asif Awan. Asif is with AppSec cd.

He's the co-founder over at AppSec cd along with our, our friend Sal Oif is also the CPO, which I'm assuming is Chief Product Officer, though today, you can never tell they make up, you know, chief everything. So, but CPO always means chief Product Officer to me. oif, welcome.

How are you? I'm doing well. Thank you so much for having me, Alan.

My pleasure. Asif, I, am I correct CP o's Chief Product Officer? Yeah, that Is right.

Yes. Good. Alright, so Asif, let's start with you, right?

Yes. You're the, a co-founder here at App cd. You know, we, we, uh, it's a fairly new company.

I, I think we had, uh, when you first came out of stealth, I, geez, was that around maybe the end of February, I'm thinking End of March. March, yep. I, I think we had, uh, Sasha on at that point.

Um, but app cd, what, what kinda, what was your journey like? What, where have you been? What have you done?

Yeah, I'll start from, uh, the, the very top. Uh, I've been in the enterprise space for 25 plus years, Alan building enterprise product solutions. Uh, um, and this is my fifth startup.

You know, uh, my three previous startups, or the first three startups were in the security space. The first one was in the mobile security space, which was acquired by Aruba Networks, which are now HP Enterprises. Yeah.

Um, the, the second one was in the container security space when the entire containerization related, call it, boom, call it hype, uh, started picking up. Uh, so that is the startup that I did with Al my current co-founder and the CEO of app C. Um, and the company was acquired by qualis.

Um, uh, then, uh, though I was not involved in a day-to-Day operations, I was involved in incubating Rex, you know? Yes. Give your startup done both before this one, I actually did another startup with the MLOps space, you know, building a machine learning ops platform for both the standard as well as, uh, federated machine learning.

And that brings us to the current startup, which is, uh, absolute. But you're a real glutton for punishment, huh? Let me loaded, I, uh, you know, I've done a fair amount of startups myself also, you know, venture back subs, dating back to the, uh, mid 1990s, late nineties all the way through.

I, I left the last startup that I did around 2010, and I said, no more. I'm done. I just, I couldn't anymore.

And I, uh, of course I started more became tech strong in, um, 2013. We started publishing 2014, and though I was almost gonna raise money for that, I got lucky. I didn't, you know, we started getting, uh, sponsors signing on, and before I had a chance to actually raise money, we were actually making money.

And I said, wow, I've never had that happen to me before. Um, and, and so we never had a We Boots, we never had to raise money. And it, you know, I'm happy about that, but look, there is as, and I'm sure you can tell people, and you have the T-shirts to prove it, there is a whole lifestyle built into working in venture-backed and starting co-founding, founding venture-backed startups.

Absolutely. It takes a certain kind of person, right? Exactly.

It does. It does. And after some time, at least in my case, uh, to your, uh, previous point, Alan, it, uh, it is sort of an addiction, you know?

Yeah. You love being, Oh, yeah, no, it's adrenaline. It's, it's like, uh, you know, it becomes almost like a, a drug habit or something.

But anyway, congratulations to you and, and yes, Sasha has had a tremendous amount of success as well as it sounds like you have. Um, let's talk about app CD a little bit. This is the latest startup from, from you and the team there.

Um, as I said, we covered it when it first launched, but let's assume out here, you know, our audience is not familiar. What, how, what would you tell 'em about App cd? Just to put it very simply, right, the whole concept of infrastructure as core, right, which HashiCorp popularized and a lot of enterprises use, that is very complex for developers to deal with for DevOps teams to deal with platform engineering to deal with.

So at a very high level, that is a problem that we are going after, and how are we going after, uh, solving their problem through infrastructure from code. So what that means is that app CD is the only company, uh, that has come up with this innovative solution for automatically generating infrastructure as code files, right? We terraform files, ELM charts, so on and so forth from the original application code without having to modify anything in there, you know, and then these, uh, auto-generated deployment files have the security best practices and the compliance guardrails and policies built in.

Got it. Um, I, I realize it's early on, right? From, from March, you know, to June, but I, I also know, and I know how, how you guys work generally, you sort of pre-loaded this, if I'm not mistaken, with a lot of CIOs, c you know, CTOs, a lot of organizations, and kind of got their feedback to make sure that it was on target, that this was, this was a real, you know, a pain point that needed to be solved.

Mm-Hmm. I'm wondering now, since launch in March, how has that, how has your target or, you know, changed? What have you learned since March?

Absolutely. You know, that'll make AppD better. I think our, I mean, in terms of the North Star, in terms of our vision of completely streamlining and managing the deployment lifecycle of the application, that's the vision that we are carrying.

Alan, let me start there. Right? io.

So what, what has been happening is that we are getting very specific requests that still falls under the same category, or that umbrella saying that, Hey, you are talking about, as an example, infrastructure from code. Do you support, uh, uh, application that are being codified in, um, pen Java or in Python or in dotnet as an example, right? Um, do you support, uh, AWS uh, ECS, um, as, uh, the deployment stack tech stack, so to speak?

Do you support A-W-S-E-K-S? And now we just added the support for AWS Lambda, so nothing has changed, and then it's just that now we are getting to the next, the second order and the third order, uh, a specificity, so to speak, right? Yeah.

And then again, to, uh, finally add one more point, at least, uh, in this context is that, as you can imagine, even that our engagement has been with very large enterprises, majority of requests come from the perspective of how does app CD fit in our existing CI cd pipelines or the DevOps procedures and policies, as well as the automation that we have put in place. Agreed. I, um, you know, I want talk a little bit about LAMB that you mentioned that you guys are expanding now in support with the Lambda, and we, we do some work with the A Lambda team and their partner channel.

Um, you know, in many ways it's a little bit of a different animal, right? In other ways it's not, you know, it's still compute, but did the whole serverless thing and all of this, what were some of the challenges there, you think that kinda made it unique? Um, if I may ask for a clarification, are you talking in generic terms, uh, uh, of, uh, challenges pertaining to AWS Lambda, or Yeah.

Well, yeah. So it presents a unique use case and then how, how with app cd, what did you have to do to make it, you know, uh, solve the pain points in that use case, if you will. Absolutely.

Okay. Uh, uh, thank you so much for that clarification. No problem.

Let we start from the top, right? I mean, at a very high level people, or especially developers, right, as well as DevOps engineers who work closely with developers for deploying applications, they sort of box the applications through one of the two categories, right? It's kuber, Kubernetes, uh, deployed AppSec or serverless, right?

Yeah. And though of course, I mean, code is code your point, compute is compute, you know, so you can always deploy. so-called the application that have, that were supposed to be, or meant to be deployed as serverless could also be deployed on Kubernetes stack, right?

But that's the kind of distinction that's especially large enterprises. This is based on our experience even before starting App cd, um, tend to make, so in that context, now shifting the focus specifically on, um, uh, AWS Lambda or the serverless or even driven based application, the challenge is that these applications, even driven applications, they are built and deployed and updated at a much, much faster clip. You know, so what we are talking about is these event driven applications, and they have a lot of loose parts, right?

So without taking the name of that specific company that we are engaged with, uh, one of our enterprise, um, uh, current POC that is going on with prospective customer, they have 12,000 AWS Lambda application. Okay? So then when you think about it, the, the challenge is that from a developer perspective, right?

The developers are churning up this code being focused on addressing the business requirement, but at the same time, they also have the owners of writing the infrastructure as code file. It's a Terraform file, figuring out how to configure the platform resources, figuring out that, uh, those configurations of those platform resources, they comply with the security policies, the best practices, design policies that the industry has defined, as well as the compliance requirement that they have. So, and, and trying to do it at the pace that is expected from the business drivers or from the business leader.

So we are going after, at a very high level that that is the business problem. That app cd, uh, it is, uh, is, um, providing the solution with the support for AWS Lambda. So let me, let me bring something up to you.

You speak to the folks who, you know, are behind, like the platform engineering community, and they highlight this specifically, this kind of thing as a specific reason why we need platform engineering, right? It shouldn't be the developers who have to deal with that. There should be a DevOps team, and whether you wanna call it a DevOps team, an ops team, or a platform team, I don't care what you call it, don't call it late for dinner, right?

But there has to be a team that kind of does that legwork that, you know, baseline work so that the developer can then come in and develop applications on that platform, not when we ask the developers to design the platform themselves. You know, you don't ask, they don't ask the heart surgeon to come in and do the anesthesia or, or some of the other preliminary stuff. He comes in to operate on the heart, right?

Same, same sort of thing here. So do you, I I wonder if, are you seeing like platform engineering teams saying, Hey, you know, we wanna work with app CD more than developers. Actually we are getting, uh, equal amount of interest, uh, so to speak, right?

Uh, uh, from, uh, both user personas, but I would like to address your key point or, or the, the, the, the, yeah. The key point that you, or the question that you were asking, Alan, is that if the platform slash DevOps team are supposed to and are, are responsible for creating these Terraform templates or infrastructure code files, right? Why is it that, uh, app CD is going after addressing their problem?

Now, are you getting, let me be very honest, right? I think your question was that, are you getting pushback from this platform or the DevOps team? So let me sort of address it by providing some context, right?

If I am a platform engineering team, or if I had, uh, I mean a platform engineer, or if I am heading the team, basically my approach to solving that problem of creating the infrastructure for each of those 12,000 Lambda based application would be to create templates. And templates by definition are generic, right? They are not specific to a particular application.

What does that mean? If it is generic, that means it'll have over provisioning of resources because two or three different types of applications or classes of application will fall into that, that bucket for which the templates have been created. The second issue is that from security perspective and from access control perspective, it is not created, and the platform resource attributes are not configured specific to that application because of the fact that app CD is extracting the deployment traits or the needs of the application directly from the application code itself.

We can not just auto-create the deployment files meant for that specific application, but even specific version of that application as a specific example, right? Let's just say that you have a Lambda function, which currently gets triggered by, uh, by a particular platform resource like S3 bucket or whatever. Right now, you, uh, make certain changes that it needs to, as a developer, I make certain changes and it needs to start interacting with another platform resource that change the code chain in the application is something app CD processes and accordingly provisions the, the resource with the correct configuration that have been defined or that have been directed by the security policies or the compliance policies, if that makes sense.

I know longer answer to it does, but I wanted to be a little bit more specific there. No, no, I, I love it. I iif, unfortunately we're over time already, but, um, it goes so good.

You know, we, you and I, we can sit and talk about it all day, but probably the audience wants to get on with their work. Um, thank you for coming on here. For people wanna get more information about app CD in general, but also about, you know, support for Lambda working in Lambda.

io you mentioned? That Is correct. io and developers can sign up for free and use all the capabilities that, um, uh, that AppSec CD currently provides.

We do have support for A WSE Cs as, as well as EKS, um, and we just launched the Lambda support as we have been talking about, as well as we do support Azure EKS as well. Excellent. Stay hello to everyone at op CD for me.

Best of luck going forward. Thank you so much, Alan. We'll be in touch and yeah, thank you once again for having me.

Take care. Bye-Bye. Okay, Asif Juan co-founder, CPO cd, check it out.

We're taking a break on Tech Trunk tv. We'll be back in a minute.