Annem Sabah Shah: [00:00:00] I think it takes away from critical thinking skills that help you when it comes to quick thinking, firefighting engineering, when things hit the van, then you need to have quick thinking skills and quick judgment. I would say don't rely on AI too much.

Ashish Rajan: Why the move? Why not just remain cloud native?

Annem Sabah Shah: Personally, I don't think CloudFormation is written extremely well. It's written in a kind of JSON low level programming language in a nested way, and often I don't think it reflects what actual infrastructure looks like.

Ashish Rajan: What would it have looked like without the Terraform pieces?

Annem Sabah Shah: We just had this really big unwieldy repo and that had lots of multiple CloudFormation.

The new feature was the Terraform import command was in line and code. You'd have a resource block and you would have a import statement in your code that would always be there.

Ashish Rajan: If they were to start on this today, where should they start on this?

Annem Sabah Shah: Start small. Don't start with your base networking. Do not start with your DNS.

Start with small resources. Hello.

Ashish Rajan: Welcome to another episode of Cloud Security Podcast. I've got Annem with me today. Thank you for coming on the [00:01:00] show.

Annem Sabah Shah: Thank you for having me.

Ashish Rajan: Maybe to kick things off, if you can tell us a bit about yourself, what do you do? What's your professional background?

Annem Sabah Shah: My name is Annem. I'm a cloud platform engineer.

I've kind been doing this for about six years, since I graduated from university in London. I work for a leading British cosmetics company.

Ashish Rajan: Awesome. And I think before we started recording, we were talking about. The whole migration. For people who do building cloud native, specifically in AWS, they have CloudFormation templates.

You kind of had a project where you moved from CloudFormation all the way to Terraform. Yeah. Could you tell us a bit about that?

Annem Sabah Shah: Yeah. So in, yeah, so last year, around the beginning of last year, I saw a CFP for London. I applied for it and my manager helped me moderate my talk, which is amazing of him.

And what we did at the time was speak about a technical case study where we. architecture and orchestrated migrating from AWS CloudFormation to Terraform. Yeah. And this was our underlying in infrastructure.

Ashish Rajan: And [00:02:00] why the move, why not just remain cloud native?

Annem Sabah Shah: That's a, yeah, that's a great question because we are a fully AWS platform, so it would make a lot of sense to stay with.

Stay with CloudFormation. 'cause you do get a lot of, you do get a lot of features and I think it's come a long way. Or why would you not go from CloudFormation to CDK and you chose Terraform? Yeah, so we actually use Terraform and we use Terraform Cloud or now HCP Cloud, which is Terraforms own CICD tool.

So it wasn't really a big problem, but personally I don't think CloudFormation is written extremely well. It's written in a kind of JSON, low level programming language in, in a nested way. And often I don't think it reflects what actual infrastructure looks like. Mm-hmm. When you write it in code.

And at this point from my previous roles, I had a lot of experience in Terraform, and I was speaking about this with my manager and when I joined two years ago in October actually, he said, look, there's this feature Terraform Import, which [00:03:00] has been bought into like normal service and at that time.

What was different was the Terraform import command has been around for ages, but it was a command. So you'd put it into your CLI and you would import resources. I've had issues in the past where you get into problems with your state file. Mm-hmm. And you're kind of unpicking as you go, and you sometimes need to import a rogue resource.

You do this in your CLI, but there's no record or no auditing or logging that you've done that.

Ashish Rajan: Yep. And

Annem Sabah Shah: at that time, the new feature was the Terraform Inco import command was in line in code. So it would be like your resource block? Yeah. So you would have a resource block and you would have a import statement in your code that would always be there if you wanted it to.

And you would give it a target of where you wanted to import this resource. And its reference would be your existing resource. So you could use data blocks to reference resources outside your Terraform. Yeah. And you could write the import statement with its resource block. And your goal would be if the resource successfully imports, like, [00:04:00] I've got a bucket.

I created it manually, or I created it in CloudFormation. Yep. And I can import this bucket with its target ID and it would then be in Terra in my Terraform state, and I could manage it in my Terraform lifecycle. Mm-hmm. So then if I wanted to delete it, I would destroy it with Terraform tainted and stuff.

And that would always be in my code. So I'd know that this, this resource is not imported and you kind of have a login and audit trail.

Ashish Rajan: Interest of it. And I guess for people who do not have an understanding of Terraform, Terraform import, or even HCP for that matter, what would've, what would it have looked like without the Terraform pieces?

And there's nothing, there's no automation. All you have is your, I mean, I guess maybe what was the previous state before you did this? Yeah, for the same thing. Good

Annem Sabah Shah: question. So our kind of proof, so what we started with was all of our CloudFormation template. Stacks, as you call them in AWS. So we just had this really big unwieldy [00:05:00] repo and that had lots of multiple.

CloudFormation nested

Ashish Rajan: ones as well. Yeah.

Annem Sabah Shah: Oh, wow. That had a, that had a, that just had multiple infrastructure, like infrastructure stacks in there for, in written and defining CloudFormation, and that was our, what you'd call base infrastructure. Yeah. So your resources that don't change your VPCs, your DNS your DNS.

Yeah. Where you redirect to your websites, your, your asset S3 buckets, which your images from your website, where they're accessed and loaded from. Yep. Your API deployment templates, all of that good stuff is your infrastructure, which is not actually, which you hardly would ever change, so it doesn't really, but you would at some point, yeah.

You would amend some of it. And we were already putting more infrastructure into Terraform Fresh. And we were managing in them in with workspaces in Terraform Cloud on A-H-H-C-P cloud. So we wanted to then put all of our underlying [00:06:00] infrastructure from CloudFormation into Terraform. So we did this in a modularized way.

So we then had a a a a base infrastructure repository, and we had modules for all of our services. So you'd have an API, you'd have an API module, you'd have a storage S3 module, and networking. And. The beauty is that we could then write, we could then mirror what's in the CloudFormation template into our module, and then we could call that module into the multi directory setup that we have.

So yeah, prod, dev, QA, staging.

Ashish Rajan: So almost like a plug and play kind of a thing, depending on what the, yeah. And then

Annem Sabah Shah: the beauty is that you can rinse and repeat those templates ag across as you need them.

Ashish Rajan: I mean, there's one thing to use it for one particular, group of services. How is it to scale it out across, like, obviously you spoke about the layer that's common across the board.

We've lost actually. Yeah, so VPC. Yeah, the DNS, all of that. Yeah. Now on [00:07:00] top of that is kind of where the real complexity comes in with different kinds of application, different kind of workload.

Annem Sabah Shah: Yeah.

Ashish Rajan: How was it for that?

Annem Sabah Shah: We had a lot of stacks, we started off doing it manually. So I would look at the CloudFormation.

Yeah. I was just reading the resources and I'd be like, okay, this is what it might look like in the Terraform documentation. The terra documentation is a really good starting point, and I said this in my talk that if you're ever stuck, the documentation is great 'cause it's constantly updated and it is some of the best documentation I've actually read.

Yeah. Um, and it does, it did help, but. It become, it quite a manual process. 'cause it was a lot of writing, it was a lot of writing lines of Terraform and all those resource blocks. And then I started looking at how we could kind of scale that up and make it a bit quicker. Yeah. So I wrote some I wrote a quite hacky python template that would then go, like you could give it the directory path of the cloud automation stack and it would give a good ground what day?

Zero. Of what that Terraform would then look like. I could then go [00:08:00] and amend what's incorrect. And then keep what, then look at how it would look like in h in the pipeline in HCP Terraform, it would say what you want to import, and I've only realized this recently, but in HCP Terraform, and I don't know if other CICD tools actually do this, but.

When you are importing resources, it will tell you if what you are importing is not like for like, because it will tell you if you are destroying and recreating something. 'cause you don't want that in some cases because it can break links between resources.

Ashish Rajan: Yeah, of course.

Annem Sabah Shah: Yeah. We've had this in cases where importing API, AWS API version one, it's broken links between the API and the integrations.

So then you are missing status codes like your 500.

Ashish Rajan: Yeah.

Annem Sabah Shah: Or you're missing, or you're missing a, a link to your method, which means that your connection in your endpoint deployment to wherever you're connecting it to is not [00:09:00] gonna work.

Ashish Rajan: Ah. Right.

Annem Sabah Shah: It's gonna fail silently because there's no, you haven't got any integration, so it can't tell you what's wrong or what status code it's throwing.

Yeah. Yeah. H. It's a really good way of showing that you can then amend and fiddle with the Terraform until you get a like for like mm-hmm. Import, which is usually what you want.

Ashish Rajan: And I guess to your point, that's the end goal you guys were looking for in the first place as well, right?

Annem Sabah Shah: Yeah. So I was just looking, yeah, I was writing the Terraform and looking at the plans to make sure that everything, all the resources were like for 'cause you get in production you probably don't, isn't, you probably don't want to be breaking links between re resources or input.

And you do want it to be like for like, and I don't know if other CIC tools do that, but HCP Terraform is really good at showing exactly the parameters you are adding and destroying even down to your descriptions of your resources as well. Really? Yes. It's crazy. Yeah. 'cause

Ashish Rajan: I think to your point, that's one of the things.

A lot of people, at least I struggle with this as well, where sometimes the description is not really apt in terms of what it's [00:10:00] actually doing and

Annem Sabah Shah: Yeah. What's

Ashish Rajan: creating what's, and you wanna

Annem Sabah Shah: change it. That's good. Yeah. Because sometimes there are parameters that you wanna change.

Ashish Rajan: Yeah.

Annem Sabah Shah: But yeah, you would have to look at each resource, comb through it and make sure that.

Ashish Rajan: Especially if, if you have code which doesn't have commentary on what it's doing and what it's creating, it's just gonna happens what, after a few years.

Annem Sabah Shah: Yeah. And in CloudFormation you don't often have that.

Ashish Rajan: Yeah. 'cause can you add comments into CloudFormation? I actually

Annem Sabah Shah: don't know. That's a good question.

Not that

Ashish Rajan: I want to, yeah. Yeah. Because I think, at least I feel after a certain scale. And I'm also curious as to, as you finished building this across, what was the, I guess I've got a couple of things in terms of. How do you organize this? 'cause to your point about earlier, having one repository for CloudFormation template, which is basically this nested loops and

Annem Sabah Shah: Yeah,

Ashish Rajan: multiple stacks, multiple different things happening in there, making it quite complex.

Yeah. Were you able to kind of figure out a way to make it more easily manageable in the case of Terraform?

Annem Sabah Shah: Yeah, good question. The modular approach really works here because basically each module, each stack [00:11:00] turns into a module. And you know that you then have a template Yeah. In your module, which you can put your base parameters in.

Mm-hmm. And then you can change the names, the environments, and make sure that the name space is right for your naming conventions. Yeah. When you're calling the module in whatever environment. And also there are some resources that you want in some environments and you don't want in others.

So you just call whatever resources you need for each environment, which I think is really, really helpful.

Ashish Rajan: Considering you start with the base layers first. Now, if you were to restart this today, how would you, would you still go on the same path in terms of if you were for in any other organization?

I'm thinking about people who are either watching or listening to this conversation. If they were to start on this today, would you, what would your recommendation be for them to start? Where should they start on this moving from Cloud Native Terraform?

Annem Sabah Shah: That's a great question, and it seems, it seemed quite painful at the beginning, but the beauty of the import statement is that your use case doesn't have to be CloudFormation.

And I felt that, I tried [00:12:00] to make that across in my talk. That your resource, it can be from any other IAC tool. It can be from click ops, it can be manual. If you are looking to move to Terraform, then all you need to know are. All you need is to know how to write your import statements and what your resources look like when they're, if they're, when they're defined manually or defined in code.

Interesting. Because it, it will be different across, but from there you can look at the documentation because at the end of each Terraform resource documentation, it will tell you what you need to import that. So whether you're doing it in code or you're doing it in the CLI. And its ID will differ per resource.

Yeah, so some. So it will give you the parameters that you need and you just need to go find those in your existing IAC code or manually in your console. But one thing I did find that today that I'm quite excited about, that Armon mentioned in his keynote this morning that there is a new feature for the life of me.

I can't remember the name, but it will let you import resources [00:13:00] in scale. So you can quickly ramp up importing resources and get, getting them in code safely managed by Terraform then Terraform lifecycle in into production, which is what I, I guess, is a good outcome for all. But yeah, I will, I, I will definitely be looking more at that.

Ashish Rajan: I think Terraform search, I think looking it up, I think the, it's obviously, I should probably mention this is being recorded. The Hashi con's 2025 in San Francisco. That's why we're this was part of the keynote. I'm also curious in terms of people who. Already have heard your advice and they're gonna walk that path.

And what would be, I mean, I guess day zero being, I don't have any Terraform. I have a ton of CloudFormation templates handy at the moment. Yeah. And I'm, I want to be where you are today where I've transformed everything into a Terraform template or a group of Terraform template or modules. What are some of the milestones that people can think of, or what are some of the things you say are.

Either things you should look out for. Oh that's good. So if that's stage one, stage two, stage three, yeah. Are [00:14:00] there any milestones that come to mind that people can use as indicators for, okay, I'm going the right drive path to what I mentioned?

Annem Sabah Shah: That's a great question. So I think day zero would be looking at your CloudFormation, reading it through, knowing what resources you've got.

And I'd say start small. Don't start with your base networking. Do not start with your DNS your something, something.com. Don't, don't start with that. Start with small resources. Like I started with like little S3 buckets and we just took it from there. Start small. If you can successfully import one CloudFormation stack, it will then become quicker on how it will then become more quicker and apparent.

'cause you just need to read your CloudFormation and write what's there in, into your Terraform and the doc. The Terraform documentation, again, is a really good starting point and support. Yep. Everyone talks about AI nowadays, so yeah, I will give my sprinkle it. The, yeah I will say that I think LLM models, whatever you use, [00:15:00] They write good boilerplate Terraform. Maybe not so much. I've had trouble with import statements before. Most models I've used still think that Terraform uses in in, in CLI import statements rather than in code ones. Mm-hmm. But if you give it an example of a import statement, it should be able to, you can feed it that tell it, and it should be clever and intuitive enough to know by the layout what you're trying to write.

Obviously, I, I would never tell any, I would never tell anyone , to feed their kind of.

Ashish Rajan: Like sensitive files. Yeah, yeah. Sensitive

Annem Sabah Shah: files or even any, or any of their like workplaces like code base into unapproved LLM models. But we fortunately got an approved license to use one model and it was kind of encouraged, which is nice.

So we had a good, safe environment to do that in. And I could feed it examples of import statements and it would write like 2030 for me, which is, it speeds up your development quite rapidly.

Ashish Rajan: I mean, the kind is a. 'cause you obviously do some mentoring as well. Yeah. [00:16:00] Feeds into that part I feel where a lot of people obviously who are starting the career today are thinking about ai.

How, what is that role for sure. I mean, is that great for you? You've been six years, six years in this industry, starting today. So what's, what's been your go-to advice for them as they kind of enter this? 'cause maybe I, obviously I'm not looking for the job right now, but I imagine. AI is top of mind for them as well.

Yeah, and obviously you, everyone talks about AI now for sure. So

Annem Sabah Shah: I think firstly from a mentor standpoint, if you are mentoring, I mean, this fits in nicely. I mentored and I've mentored people in the past and kind of unofficially, I've also I've worked with people who had more of an interest in the platform space, but they were feature engineers.

So I also. Asked and I asked and spoke to some, like some of them, and I said, if you want to help me import some stacks, feel free. But you have to make sure that the work that they're doing, they feel is important and they know the outcome because if they have a sense of [00:17:00] pride and achievement in what they've done, and you appropriately shout it out and celebrate it in retros, in your sprint reviews.

Then it gives them good evidence for their progressions and frameworks in the future. Because most in engineering, we, you speak to your manager, you have your goals and you have, and you kind of need to get feedback and evidence of what you've done to prove that and being able to give your mentees.

Mm-hmm. That sense, a pride of what they've done has given a real. Sense of business value add, then it will encourage them to do it more in the future. And kind of from a mentee perspective, I think AI is a good starting point. I, what I don't wanna tell people is to get too reliant on using AI to write their code.

I feel like to some extent, and this may be a rogue opinion. I think it takes away from critical thinking skills that help you when it comes to quick thinking, firefighting, engineering, and I think especially in the platform space, SRE, if you are on [00:18:00] oncall or a part oncall rotor or incident release management.

Then when things hit the fan, then you need to have quick thinking skills and quick judgment because you may be the only person around who is able to fix

Ashish Rajan: at 3:00 AM in the morning. Yeah. At

Annem Sabah Shah: 3:00 AM in the morning. Yeah. I would say don't rely on AI too much. 'cause it can it, it can take rob you off those really important, methodical skills that you need as a, for any kind of software engineer.

Yeah, I'd say that's, I'd say that's really important to

Ashish Rajan: see AI playing. And maybe not just in your personal, but across your peers as well. Do you see an AI playing a huge role in there in terms at the moment

Annem Sabah Shah: I think it should do. I would encourage it. So I mean, if you work for an organization that's presumably spending a lot of money.

For, to create a safe trading ground for you to use ai, then I would say it should be expected that you that you use it to the best of, to the best of its ability and ask it questions and stuff. And it can age you with what? [00:19:00] Fixing bugs or typos or anything that sometimes we just aren't able to see.

It's amazing pairing with engineers, but sometimes maybe you don't have the bandwidth all the time and it can speed. Things up there as well.

Ashish Rajan: Is any use cases that come to mind that people can start off with AI in the beginning, to your point, could be to generate some telephone code or, but are there any for lack of a better word, any easy to do first few use cases, people can start finding some success using ai?

Have you found any?

Annem Sabah Shah: I, yeah, for sure. I mean, a lot of, if you have resources where you think that you don't have a lot of monitoring or logging like capabilities there. You could start with writing some alarms on your resources. And I think the good thing is in this, in that you're not starting from ground zero.

You are looking at Terraform from the con, from the lens of you don't have to start from ground zero. Yeah. Here's a main F file of configuration it creates an API deployment. Oh, okay. And you just have that. But then what do [00:20:00] you do when you want to know if you ever have 500 server side errors, that could be any, that could be any bad error. But if it's in production, it's probably doing something important. And you want to know if anything's happened? Yeah, if anything's happened to it. So you are looking at Terra from the lens of I, I guess from its crux in that you don't have to start from the beginning.

You have a resource that you want to amend. Yeah. And add parameters to You reference that resource and you can you can use whatever model that you use to suggest, to write an alarming CloudWatch if you're using AWS. Yeah. And you've added some kind of you've added some safety around your resource.

And you can tell it then where to output its alarm, whether that's to teams or Slack or kind of an Yeah. Through throughs.

Ashish Rajan: At your point, use AI as a way to start building towards, especially if you have not done it before. Yeah. You can have some kind of a, it's point. It's to

Annem Sabah Shah: start, and I think it's important to know Terraform is a tool that you don't have to build from the ground [00:21:00] up.

You can amend what's already there and keep adding to it. And I think that's quite important. 'cause I know I mentioned in the keynote today, Terraform actions. Yes. You have a resource that hasn't been redeployed for about four months, you literally can just add an action to redeploy it. I mean, that's quite, that, that's quite cool.

Yeah, and I think that takes it back to kind of the what Terraform is really there for.

Ashish Rajan: Awesome. I mean, that's all the technical questions I have. Of course. You've got three fun questions for you. First one being, what do you spend most time on when you're not trying to migrate cloud native to Terraform?

Could be professional hobbies or personal hobbies as well.

Annem Sabah Shah: Professionally, I really do enjoy mentoring. I'm. I am not, I'm not mentoring right now but to be us, I feel like I'm slightly at cro. I'm deciding what's in the cards for my future and how I see myself. My 10 year career plan ends this year, so I'm looking at what the next five to 10 years hold for me and what I see for myself.

And I guess being privileged enough to be able to come to someone like San Francisco from London, I think gives me a, a real sense of [00:22:00] personal achievement and accolade because if I. If I didn't, I don't think I'd be here if I didn't produce content or speak to speak to other people. And it's, it's, I still think it's somewhat unusual to get such opportunities.

So I think it's amazing to be here in this amazing city in California or places for my first time in America. So it's quite, it's quite special, but yeah. That's not so fun if Yeah. For fun. I do, I like playing tennis. I didn't pick, I'm not. Last time in last year in August was the first time I ever picked up a tennis racket.

Um, and that's, that's been quite fun. I'm trying to do more hobbies outside, as people say, touch more grass.

Ashish Rajan: Fair. And I guess you kind of answered my second question, but I'll still ask it. What is something that you're proud of that is not on your social media?

Annem Sabah Shah: My talk is actually linked at my social media.

I am quite, I'm quite proud of it. I mean, I do find it cringe, but I don't like, I would, no one likes hearing their own voice, but I get a sense of achievement that I've done that and I've ticked it off and I would love to do more CFPs in the future. What I'm proud about that's not on my social media.

Ashish Rajan: You kind of answered it this [00:23:00] before. Funny enough. With the SF thing that you just mentioned, that they are, yeah, actually,

Annem Sabah Shah: yeah. You know what? I've not posted about being at San Francisco I think currently. I, yeah, I think that's given me a huge sense of achievement, being able to be here and network with so many other people.

It's such a special moment. 'cause I've been trying to, I've been try, I've been trying to get attend a conference here for the last few years and it's just not happened and yeah, it's, it's amazing to be able to be here and for it to be with HashiCorp who. Let me be on stage. Was it almost two years ago?

It's quite special.

Ashish Rajan: Awesome. Final question. What's your favorite cuisine or restaurant? Considering you're a foodie? I'm expecting like a serious answer this time. Like a, you can grade them if you want, but what's your favorite cuisine or restaurant you can share?

Annem Sabah Shah: Um, my favorite cuisine, hands down is always gonna be South Asian food, like Pakistani food, Indian food.

I'm, I'm of, my parents are Pakistan, so I'm a Pakistani heritage. I mean, I've visited many times and the food is absolutely mind blowing. I'm sure you can, I'm sure you can testify. Yes,

Ashish Rajan: but wait, is the food better in London or in the Pakistan? [00:24:00] It.

Annem Sabah Shah: The food is definitely better in the food is definitely better in Pakistan 'cause that's where it comes from.

But it's, the food kind of differs from whether you're in the city, whether you're in the village. Oh, village tree is a lot more fresh and you get a lot more vegetable focused dishes. Right. Which is amazing. But yeah, the food in Pakistan is generally, it is generally amazing. Don't hate me and I will say it, my safe choice is Dishoom.

Ashish Rajan: Oh my God. It's like, I like take,

Annem Sabah Shah: I like taking people there, but I've heard that mom likes going there and so does a lot of like the HashiCorp, I always feel people who are not from

Ashish Rajan: London love to go to Dishoom.

Annem Sabah Shah: Yeah. But people from London also love going to Dishoom. It's choice. I not

Ashish Rajan: every day kind of thing, but not every

Annem Sabah Shah: day.

But it's, I quite like it and I like having to, it's good places.

Ashish Rajan: I've been told, I think the, one of the guests that came on our podcast age ago, I was selling him. He was asking me, he was testing 'cause he, I claimed to be a foodie and he was, his question was, okay, what's your favorite Indian restaurant?

And I said, Dishoom man. Like, wow. I'm like, I'm walking away from this conversation. You're, you're, it's crazy. There's so many more. And I'm like, wow, I should really open up my palate, I guess. [00:25:00] But I, I, I appreciate the answer. It is definitely very, the popular ones as well.

Annem Sabah Shah: Yeah. Yeah.

Ashish Rajan: Thank you so, so much for sharing that.

Where can people connect with you to talk more about all the work you're doing and maybe mentorship if you wanna go down that part as well with you?

Annem Sabah Shah: Thank you. So it's a good question LinkedIn and quite easy to find. So just search my first name, my last name, and you should be able to find me.

Ashish Rajan: I'll put that in the show notes as well. But thank you so much for coming on the show. It was lovely meeting you. Thank you for tuning again. Next time. Thank you for listening or watching this episode of Cloud Security Podcast. This was brought to you by Tech riot.io. If you are enjoying episodes on cloud security, you can find more episodes like these on Cloud Security Podcast tv, our website, or on social media platforms like YouTube, LinkedIn, and Apple, Spotify.

In case you are interested in learning about AI security as well, to check out our sister podcast called AI Security Podcast, which is available on YouTube, LinkedIn, Spotify, apple as well, where we talk. To other CISOs and practitioners about what's the latest in the world of AI security. Finally, if you're after a newsletter, it just gives you top news and insight from all the experts we talk to at Cloud Security Podcast.

You can check that out [00:26:00] on cloud security newsletter.com. I'll see you in the next episode,

please.

‍