Challenge

After being impacted by a supply chain security incident in 2021, Mercari implemented “Carrier,” a system for “Zero Touch Production” as a preventative measure to reduce the potential blast radius of similar incidents in the future.

Informed by Google’s SRE practices, they worked to implement on-call and “break glass” access to production instances. Today, Mercari is migrating from their in-house system to Opal so they don’t have to maintain a whole host of integrations with third-party services.

Mercari’s engineering teams are typically small and operate fairly autonomously, so access requests and approvals are best delegated to teams themselves.

Goals

• Replace Carrier, the in-house access tool, with a more flexible platform

• Enable faster access to production systems for on-call SREs without creating long-standing privilege

• Eliminate the need to support various third-party services that Opal already supports

Opal Solution

• Infrastructure-as-code via Terraform

• Track GCP projects and their associated GKE instances

• Just-in-Time and ”break glass” access for SREs on call

In 2021, Mercari experienced a security incident as a result of a supply chain attack. The aftermath of this led to various initiatives to improve their overall security posture. One of the risks highlighted was the potential impact of the exposure of long-lived credentials. To tackle this the Mercari Platform team worked on the development of an internal tool called Carrier, used to provide just-in-time role bindings. The goal was to achieve “Zero Touch Production,” removing, as much as possible, any need to maintain permanent access to systems.

“Opal enabled Mercari to migrate away from Carrier and sustain the same ‘Zero Touch Production’ mindset without the need for internal development and maintenance. Opal also allowed Mercari to expand just-in-time access to more developer tools and productivity applications. 

It’s a huge relief to unload a lot of ‘keep the lights on’ maintenance work while improving our security posture in line with the broader business goal of keeping customer data safe.”

— Allan Wirth, Manager of Platform and AI Security, Mercari

Strategic Impact

With tedious “keep the lights on” work reduced, engineers can now focus more on business problems, all  while still maintaining strong just-in-time access capabilities for our environment and high level of security in the solution to provide this.