Hey there,
As a platform team, you’re not paid to have opinions. You’re paid to build functionality that serves the needs of different user groups, be it developers or security. Not only that, having strong opinions makes you attackable for no reason. Let me explain.
I was recently in Oslo - dope city btw and very good food. I was prepping an internal demo for some fine platform engineers working for a government entity building an Internal Developer Platform. This team operated under the (correct) assumption that the more you can keep developers on golden paths the higher your degree of standardization the more secure your setup and the higher your return on investment. That’s absolutely true.
The team had just built their first Minimum Viable Platform and was about to show this to a bigger forum of internal stakeholders for approval before it would start prepping for prod readiness. I take those demos very seriously, whatever you anchor at that point will stick with you for a while.
When I first reviewed the pitch it was full of statements like “we want more abstraction for developers”, “we want to drive standardization”, “we do not want developers to access the Azure account”. I was very firm that I don’t think this is a good idea. Here’s why:
- You’re in an early demo. You have nothing to win scaring users, yet everything to lose.
- If your users shouldn’t touch production settings in Azure that’s ok but honestly it’s not your decision but the decision of your security team. You’re the platform team and your job is to build a platform that can shut down parts of the estate through RBAC. You’re not paid for opinions. There’s nothing to gain for you, if you have to implement something into your platform because of compliance, make sure the user knows it’s not your fault.
- Be careful how you introduce abstractions. Think about escape paths right from the beginning. I always follow the mantra: you can abstract but you can never take context. I would take this seriously. Make absolutely sure the user knows what happens at any point in time.
So, when you are preparing for your next demo and presentation: tone it down! Don’t use strong statements and opinions, don’t offend people, think about your audience, be tactical and don’t make yourself a target to blame.
It’s true what Google’s James Brookbank told me last week in New York: Platform Engineering is a socio-technical problem. And both the socio- as well as the technical side are like playing 3 dimensional chess.
Good luck out there fighting the good fight.
At AWS re: Invent or in Las Vegas? Come say hi at the Platform Engineering Executive Roundtable
Kaspar
