Collapse All Expand All
1. What is Infrastructure as Code (IaC)?Simply put, it’s a script that deploys cloud resources. IaC has also been defined as managing and provisioning infrastructure using code, instead of manual processes. IaC makes it easier for mission partners to deploy cloud infrastructure.
2. What are the DOD Cloud IaC baselines? DOD Cloud IaC are pre-configured, pre-authorized, Platform as a Service (PaaS) environment baselines for easy cloud adoption. When possible, these baselines leverage security services offered by Cloud Service Providers (CSPs) over traditional data center tools, resulting in enhanced, holistic environment security. Customers are able to use these baselines to adopt cloud faster by giving them an authorized starting point for their environments.
3. Where do I get the DOD Cloud IaC baselines? HaCC DOD Cloud IaC baselines are available in a repo. To access the repo, submit a request to
https://www.hacc.mil/Contact/ using your .mil email address.
In the future, these DOD Cloud IaC baselines will also be hosted within the Azure Government Marketplace.
4. Can I get help deploying the baselines? 5. Does the HaCC deploy my application/s? No, the HaCC deploys secure computing platforms for your application/s, not the application/s itself.
6. Why Platform as a Service over virtual machines? Because PaaS removes the requirement for patching, as well as Security Technical Implementation Guides (STIG)! The PaaS offerings (e.g. Azure App Service, Azure Database, AWS lambda) deployed by DOD Cloud IaC make the cloud service provider responsible for vulnerability patching and hardening and securely configuring the operating system and middleware. PaaS services also allow for rapid technology insertion (e.g. Azure Machine Learning, AWS Sagemaker) without the responsibility of integrating middle-tier applications.
7. What Cloud Service Providers are available? HaCC currently offers infrastructure baselines for AWS and Azure with additional CSPs planned for the future.
8. Are the DOD Cloud IaC baselines available to the general public? No, DOD Cloud IaC baselines are only available for use by the US federal government.
9. Is this a managed service environment? No, the HaCC does not manage the baselines once they are deployed. DOD Cloud IaC is deployed in a decentralized model. As DOD Cloud IaC primarily uses PaaS, the CSP will manage many of the services, but the customer will be responsible for the mission application and data hosted. The HaCC will continuously update the baselines with improvements and new services that will be uploaded to the repo, so that customers can access the most current version of a baseline.
10. What security services are provided by DOD Cloud IaC baselines? DOD Cloud IaC baselines satisfy 92% of Virtual Datacenter Security Services (VDSS) and Virtual Datacenter Management Services (VDMS) by leveraging PaaS and security services from the Cloud Service Providers. Mission Owners need to acquire a Cloud Security Service Provider (CSSP) and a Cloud Access Point (CAP) to be in compliance with the DOD Cloud Computing Security Requirements Guide (SRG).
11. How much does it cost to use a baseline? Our baselines are free! Mission owners are responsible for the storage and compute costs associated with using a CSP.
12. How does application-level CAC authentication work? DoD Cloud IaC uses DISA’s Global Directory (GD) - DoD’s centralized Identity, Credential, and Access Management solution - to authenticate and enable CAC users. The link between the CSP tenant and GD is transparent, and once a CAC user is authenticated, the application uses the CSP’s role based access controls to enforce permissions as decided by the application developer.
13. Can I incorporate my own Continuous Integration/Continuous Deployment (CI/CD) tooling? Yes! You can incorporate your own CI/CD tooling once you deploy the baseline to your environment.
14. Can I request a new service? Yes! HaCC is open to suggestions about or requests for new baseline services. We use these demand signals to develop roadmaps for future IaC services.
Customers can reach us at
https://www.hacc.mil/Contact/
15. What are the DOD Cloud IaC monitoring features? DOD Cloud IaC provides easy to use dashboards to monitor the status of cloud configurations in real-time.