Description
HashiCorp Terraform and Vault Integrated Solution Control Number VA-23-00066438 2 JUSTIFICATION AND APPROVAL FOR AN EXCEPTION TO FAIR OPPORTUNITY Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724 Description of Action: The proposed action is for a firm fixed price delivery order (DO) to be issued under the National Aeronautics and Space Administration (NASA) Solutions for an Enterprise-Wide Procurement (SEWP) V Government wide Acquisition Contract (GWAC) for a brand name HashiCorp Terraform and Vault integrated solution consisting of software with maintenance support. Description of Supplies or Services: VA Financial Services Center (FSC) requires the purchase of a brand name HashiCorp Terraform and Vault integrated solution consisting of annual software subscriptions with maintenance support. FSC runs hybrid workloads from local FSC servers and the cloud, performs disaster recovery, ensures site continuity capabilities, and ensures orchestration and automation of applications and workloads to reduce operational costs. To ensure the additional security needed to perform these functions within Information and Technology (IT) Industry security practices, FSC requires brand name HashiCorp Terraform Enterprise Platform Self-Serve Infrastructure Governance & Policy software with maintenance support integrated with Vault Enterprise Platform Multi-Datacenter & Scale Governance & Policy software with maintenance support and Vault Enterprise Platform (Non-Prod) software with maintenance support. Best IT industry security practices include avoiding placing secrets, tokens, passwords, certificates, encryption keys, variables, state versions and other sensitive data into HashiCorp Terraform configuration or state files. Development and Operations (Dev/Ops) staff who want to include rapidly changing or highly sensitive configuration data on managed systems can connect directly and securely from Terraform to Vault. Terraform is a provider-agnostic software which will allow a single configuration to be used to manage systems in multiple clouds from multiple providers. Additionally, Terraform will handle the cross-cloud dependencies, as well as on premise, a key feature that significantly increases the value of the package. Ultimately, the Terraform software will simplify management and orchestration of a large-scale on premise and multi-cloud infrastructure used within FSC. Vault is a secrets management solution that brokers access for both humans and machines, through programmatic access, to systems. Secrets can be stored, dynamically generated, and in the case of encryption, keys can be consumed as a service without the need to expose the underlying key materials. Terraform and Vault provide a better DevOps/Development Security and Operations experience through managed infrastructure, fast replication, and near real-time deployment changes Terraform and Vault are required for VA FSC cloud infrastructure/orchestration operations management. The associated standard maintenance and gold support for the software is needed to keep the software fully functional and operational. The period of performance shall be one 12-month base period, with two 12-month option periods to be exercised at the Government s discretion. The total estimated value of the proposed action is $, inclusive of the option periods. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of section 41 USC 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B) entitled Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized. Rationale Supporting Use of Authority Cited Above: Based upon market research, as described in Section 8, it was determined that limited competition is available among resellers for brand name HashiCorp Terraform and Vault integrated solution of software and maintenance support. Only brand name HashiCorp Terraform and Vault software and maintenance will meet VA s requirements due to compatibility and interoperability constraints associated with this proprietary solution. As the FSC continues to expand to multi-platforms for infrastructure, the complexity and challenge of deployment to different platforms increases, and existing infrastructure management tools are largely provider specific. Terraform is the only provider-agnostic configuration orchestration and infrastructure management tool which will allow a single configuration to be used to manage systems in multiple clouds from multiple providers/services and other third-party services to be combined and composed simultaneously using a single unified syntax in a JavaScript Object Notation based configuration files with resource graphing and high-level datacenter abstractions into easy and reliable deployments. Terraform handles the cross-cloud dependencies, in addition to on premise. FSC compiles information from various cloud platforms. Since Terraform is provider-agnostic, it can interact with a variety of products and manage the information into a single configuration. Terraform is currently in use at FSC as a solution to simplify management and orchestration of a large-scale on premise and multi-cloud infrastructure. Vault, also currently in use at FSC, provides an essential security function to store passwords, usernames and other security secrets Terraform can access. Using Terraform without Vault would introduce an increased risk of exposing security secrets. When used together, IT products like Terraform and Vault provide maximum functionality within their own production environment and cannot interoperate in a mixed vendor variety of licensing model or configuration while maintaining the central management requirement from the existing product. In order to prevent interoperability issues, VA requires the software to be integrated together so that they function within the existing Terraform solution. The maintenance support for brand name HashiCorp Terraform and Vault software is essential to the seamless compatibility and operations with software and applications already deployed and used across FSC. Only HashiCorp or an authorized reseller can provide maintenance support on the Terraform and Vault software. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government s requirements. However, it was determined that limited competition is viable among authorized resellers for these brand name items. In accordance with 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contracting Opportunities website and this justification will be made publicly available within 14 days of award. Actions to Increase Competition: Government will continue to conduct market research to ascertain if there are any new products or maintenance services available in the marketplace that would enable future actions to be fully competed. Market Research: VA FSC technical experts conducted market research in April 2023. Competition in the network infrastructure management and orchestration space is limited to specific individual products that are limited in the environments that they can manage. With the use of Gartner.com, VA FSC Technical Experts determined no other tool on the market can manage resources in multiple cloud platforms like Terraform. FSC technical experts compared SlickStack and Cloudify infrastructure management software, but neither of these software tools can meet all of the FSC functional requirements for managing the infrastructure across the many storage platforms that are currently in use like Terraform can since it is provider-agnostic. Other software packages like Puppet and Chef are configuration management tools. Vault was compared to products from Bitdefender Total Security, HashCalc, KeePass, and Tripwire Enterprise. No other secrets management solutions had the flexibility and functionality to integrate with Terraform and provide maximum security. No other products met all the FSC requirements for DevOps architecture systems and the required services. Based on this market research the Government s technical experts have determined that HashiCorp s brand name Terraform and Vault Integrated Solution is the only source that can meet the Government s requirements. Switching to alternative products or running mixed environments would lead to application limitations, tool limitations, learning curves, migration complexities and in-house resource requirements. Additional market research was conducted in April 2023, wherein the Contract Specialist utilized the NASA SEWP V Provider Lookup Tool and identified eleven Service-Disabled Veteran-Owned Small Businesses contract holders as authorized resellers of required HashiCorp Terraform and Vault software and maintenance support. Therefore, limited competition is anticipated Other Facts: None. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief. Date: ________________________________ Project Manager Signature: ____________________________ Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. NASA SEWP V has already determined the prices on contract to be fair and reasonable. Additionally, the successful quote will be compared with the Independent Government Cost Estimate. Date: ________________________________ Procuring Contracting Officer Signature: ____________________________ Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $750,000, this document serves as the contracting officer s basis for using an exception to the fair opportunity process in accordance with FAR 16.505(b)(2)(ii)(A). Date: ________________________________ Procuring Contracting Officer Signature: ____________________________