Levi McCormick, Cloud Architect at Jamf, joins Corey on Screaming in the Cloud to discuss his work modernizing baseline cloud infrastructure and his experience being on the compliance side of cloud engineering. Levi explains how he works to ensure the different departments he collaborates with are all on the same page so that different definitions don’t end up in miscommunications, and why he feels a sandbox environment is an important tool that leads to a successful production environment. Levi and Corey also explore the ethics behind the latest generative AI craze.

About Levi

Levi is an automation engineer, with a focus on scalable infrastructure and rapid development. He leverages deep understanding of DevOps culture and cloud technologies to build platforms that scale to millions of users. His passion lies in helping others learn to cloud better.

Links Referenced:

• Jamf: https://www.jamf.com/
  


• Twitter: https://twitter.com/levi_mccormick
  


• LinkedIn: https://www.linkedin.com/in/levimccormick/
  

Transcript

Announcer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.

Corey: Welcome to Screaming in the Cloud. I’m Corey Quinn. A longtime friend and person has been a while since he’s been on the show, Levi McCormick has been promoted or punished for his sins, depending upon how you want to slice that, and he is now the Director of Cloud Engineering at Jamf. Levi, welcome back.

Levi: Thanks for having me, Corey.

Corey: I have to imagine internally, you put that very pronounced F everywhere, and sometimes where it doesn’t belong, like your IAMf policies and whatnot.

Levi: It is fun to see how people like to interpret how to pronounce our name.

Corey: So, it’s been a while. What were you doing before? And how did you wind up stumbling your way into your current role?

Levi: [laugh]. When we last spoke, I was a cloud architect here, diving into just our general practices and trying to shore up some of them. In between, I did a short stint as director of FedRAMP. We are pursuing some certifications in that area and I led, kind of, the engineering side of the compliance journey.

Corey: That sounds fairly close to hell on earth from my particular point of view, just because I’ve dealt in the compliance side of cloud engineering before, and it sounds super interesting from a technical level until you realize just how much of it revolves around checking the boxes, and—at least in the era I did it—explaining things to auditors that I kind of didn’t feel I should have to explain to an auditor, but there you have it. Has the state of that world improved since roughly 2015?

Levi: I wouldn’t say it has improved. While doing this, I did feel like I drove a time machine to work, you know, we’re certifying VMs, rather than container-based architectures. There was a lot of education that had to happen from us to auditors, but once they understood what we were trying to do, I think they were kind of on board. But yeah, it was a [laugh] it was a journey.

Corey: So, one of the things you do—in fact, the first line in your bio talking about it—is you modernize baseline cloud infrastructure provisioning. That means an awful lot of things depending upon who it is that’s answering the question. What does that look like for you?

Levi: For what we’re doing right now, we’re trying to take what was a cobbled-together part-time project for one engineer, we’re trying to modernize that, turn it into as much self-service as we can. There’s a lot of steps that happen along the way, like a new workload needs to be spun up, they decide if they need a new AWS account or not, we pivot around, like, what does the access profile look like, who needs to have access to it, which things does it need to connect to, and then you look at the billing side, compliance side, and you just say, you know, “Who needs to be informed about these things?” We apply tags to the accounts, we start looking at lower-level tagging, depending on if it’s a shared workload account or if it’s a completely dedicated account, and we’re trying to wrap all of that in automation so that it can be as click-button as possible.

Corey: Historically, I found that when companies try to do this, the first few attempts at it don’t often go super well. We’ll be polite and say their first attempts resemble something artisanal and handcrafted, which might not be ideal for this. And then in many cases, the overreaction becomes something that is very top-down, dictatorial almost, is the way I would frame that. And the problem people learn then is that, “Oh, everyone is going to route around us because they don’t want to deal with us at all.” That doesn’t quite seem like your jam from what I know of you and your approach to things. How do you wind up keeping the guardrails up without driving people to shadow IT their way around you?

Levi: I always want to keep it in mind that even if it’s not an option, I want to at least pretend like a given team could not use our service, right? I try to bring a service mentality to it, so we’re talking Accounts as a Service. And then I just think about all of the things that they would have to solve if they didn’t go through us, right? Like, are they managing their finances w—imagine they had to go in and negotiate some kind of pricing deal on their own, right, all of these things that come with being part of our organization, being part of our service offering. And then just making sure, like, those things are always easier than doing it on their own.

Corey: How diverse would you say that the workloads are that are in your organization? I found that in many cases, you’ll have a SaaS-style company where there’s one primary workload that is usually bearing the name of the company, and that’s the thing that they provide to everyone. And then you have the enterprise side of the world where they have 1500 or 2000 distinct application teams working on different things, and the only thing they really have in common is, well, that all gets billed to the same company, eventually.

Levi: They are fairly diverse in how… they’re currently created. We’ve gone through a few acquisitions, we’ve pulled a bunch of those into our ecosystem, if you will. So, not everything has been completely modernized or brought over to, you know, standards, if you will, if such a thing even exists in companies. You know [laugh], you may pretend that they do, but you’re probably lying to yourself, right? But you know, there are varying platforms, we’ve got a whole laundry list of languages that are being used, we’ve got some containerized, some VM-based, some serverless workloads, so it’s all over the place. But you nailed it. Like, you know, the majority of our footprint lives in maybe a handful of, you know, SaaS offerings.

Corey: Right. It’s sort of a fun challenge when you start taking a looser approach to these things because someone gets back from re:Invent, like, “Well, I went to the keynote and now I have my new shopping list of things I’m going to wind up deploying,” and ehh, that never goes well, having been that person in a previous life.

Levi: Yeah. And you don’t want to apply too strict of governance over these things, right? You want people to be able to play, you want them to be inspired and start looking at, like, what would be—what’s something that’s going to move the needle in terms of our cloud architecture or product offerings or whatever we have. So, we have sandbox accounts that are pretty much wide open, we’ve got some light governance over those, [laugh] moreso for billing than anything. And all of our internal tooling is available, you know, like if you’re using containers or whatever, like, all of that stuff is in those sandbox accounts.

And that’s where our kind of service offering comes into play, right? Sandbox is still an account that we tried to vend, if you will, out of our service. So, people should be building in your sandbox environments just like they are in your production as much as possible. You know, it’s a place where tools can get the tires kicked and smooth out bugs before you actually get into, you know, roadmap-impacting problems.

Corey: One of the fun challenges you have is, as you said, the financial aspect of this. When you’ve got a couple of workloads that drive most things, you can reason about them fairly intelligently, but trying to predict the future—especially when you’re dealing with multi-year contract agreements with large cloud providers—becomes a little bit of a guessing game, like, “Okay. Well, how much are we going to spend on generative AI over the next three years?” The problem with that is that if you listen to an awful lot of talking heads or executive types, like, “Oh, yeah, if we’re spending $100 million a year, we’re going to add another 50 on top of that, just in terms of generative AI.” And it’s like, press X to doubt, just because it’s… I appreciate that you’re excited about these things and want to play with them, but let’s make sure that there’s some ‘there’ there before s