Simon Elisha's presentation AWS Australian Summit Sydney 2012 - Executive Track

2. Extending Your Data Centre With
AWS
Simon Elisha
Principal Solution Architect
Australia & New Zealand

3. Power
Constraints

4. Space
Constraints

5. Processing (a.k.a “horsepower”) Constraints

6. Lots of ideas & projects you want to try

7. “When all you have is a
hammer – everything looks
like a nail!”

8. Cloud means you now have more than just a hammer.

9. What if you could extend into the cloud easily and
securely?

10. You Can!
Corporate
Data Center

11. You Can!
Amazon VPC
Corporate
Data Center

12. You Can!
Amazon VPC
Corporate
Data Center

13. Review: EC2 Standard Networking
Distinct private/internal and public/external IPs
• Simple model
• True 1:1 NAT (no port translation)
• “Split-brained” DNS
Security groups control ingress
Elastic IPs: fixed public IPs

14. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
Availability Zone 1a Availability Zone 1b

15. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
Availability Zone 1a Availability Zone 1b
Customer 1

16. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
10.1.2.3 10.218.5.17
10.141.9.8
10.16.22.33
Availability Zone 1a Availability Zone 1b
Customer 1

17. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
10.1.2.3 10.218.5.17
10.141.9.8
10.16.22.33
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2

18. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.141.9.8
10.99.42.97
10.16.22.33 10.131.7.28
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2

19. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.141.9.8
10.99.42.97
10.16.22.33 10.131.7.28
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3

20. Internet
EC2 instances dynamically assigned private IP addresses
from the one large internal Amazon IP address range
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3

21. Internet
EC2 instances dynamically assigned public IP addresses on
border network from Amazon’s public IP address blocks
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3

22. 23.20.151.66 23.20.146.1 23.20.103.11 72.43.2.77 23.19.11.5 72.43.22.45
Internet 72.43.22.5
23.20.148.59 72.44.32.9 72.44.21.7 23.19.10.51 72.43.1.7
EC2 instances dynamically assigned public IP addresses on
border network from Amazon’s public IP address blocks
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3

23. Value and Limits of Standard Networking
Simple to use and management free
Security groups are Ingress only
Different from subnet-based controls
Mental model issue
No private networking, DMZs, or NAT/PAT
No consistent / “fixed” IP addresses for instances

24. Introducing AWS Virtual Private Cloud
User-defined virtual IP networking for EC2
Private or mixed private/public addressing and
secured ingress/egress
Re-use of proven and well-understood
networking concepts and technologies

25. VPC Capabilities in a Nutshell
User-defined address space up to /16
• 65,534 addresses
Up to 20* user-defined subnets up to /16
User-defined:
• Virtual routing, DHCP servers, and NAT instances
• Internet gateways, ACLs, ingress/egress security groups and VPN
tunnels
Private IPs stable once assigned
Elastic Network Interfaces

26. Internet
VPC customers can launch instances in their own isolated network
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3

27. Internet
VPC customers can launch instances in their own isolated network
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3 VPC Customer

28. Internet
VPC customers can launch instances in their own isolated network
10.134.2.3
10.1.2.3 10.218.5.17
10.27.45.16
10.243.3.5
10.8.55.5 10.141.9.8
10.99.42.97 10.155.6.7
10.16.22.33 10.131.7.28
10.6.78.201
Availability Zone 1a Availability Zone 1b
Customer 1 Customer 2 Customer 3 VPC Customer

29. Internet
VPC customers can launch instances in their own isolated network
Availability Zone 1a Availability Zone 1b
VPC Customer

30. Internet
VPC customers can launch instances in their own isolated network
Availability Zone 1a Availability Zone 1b
VPC Customer

31. Internet
Availability Zone 1a Availability Zone 1b
VPC Customer

32. Internet
You can assign your own IP range to the VPC network
10.0.1.5 10.0.1.6
10.0.0.5
10.0.0.6 10.0.1.8
10.0.3.5
10.0.1.25
10.0.3.17
Availability Zone 1a Availability Zone 1b
VPC Customer

33. Models of Data Centre Extension
Isolated project
Expand existing systems into the cloud – no public
Expose systems to the public - hosted in the cloud
Branch office access

34. Isolated Project
Dev/Test. Corporate
Users
Proof of Concept.
“Fail Fast” projects.
Time bound/ephemeral. Router & Firewall
No need for internal system access of
resources.
AWS

35. Expanding Existing Systems Into The Cloud
Leverage additional processing nodes. Corporate
Host entire stack in the cloud with secure
data centre Corporate
Users
LAN/WAN access.
• E.g. Sharepoint, CMS, CRM, etc
Dev/Test. Router & Firewall
Disaster Recovery.
Big Data analysis. VPN Connection
Use existing management tools.
No Internet access to systems.
AWS

36. Expanding Systems Into The Cloud, with Public
Internet Access
Enable access by customers/partners to Corporate
systems. data centre Corporate
Users
Enable internal systems to be involved
and accessed by applications.
Router & Firewall
Secure segregation of components and
network access. VPN Connection
Customers/
Partners
AWS

37. Branch Office Access
Branch Office Users
Enabling remote users & offices Router & Firewall
to have secure access to
resources. VPN Connection
Centralised systems with
minimal infrastructure. AWS
VPN Connection VPN Connection
Router & Firewall Router & Firewall
Branch Office Users Branch Office Users

38. Making the Connection…

39. New Enterprise IT
Network Architecture

40. Corporate
Data Center
Corporate
Headquarters
New Enterprise IT
Network Architecture

41. Corporate
Data Center
Corporate
Headquarters
New Enterprise IT
Network Architecture

42. Corporate
Data Center
Corporate
Headquarters
New Enterprise IT AWS Region
Network Architecture

43. Corporate
Data Center
Availability Zone 1
Corporate
Headquarters
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

44. Corporate
Data Center
Availability Zone 1
Router
Corporate
Headquarters
Amazon VPC
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

45. Corporate
Data Center
Availability Zone 1
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Amazon VPC
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

46. Corporate
Data Center
Availability Zone 1
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Public Subnet
Amazon VPC
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

47. Corporate
Data Center
Availability Zone 1
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Public Subnet
Amazon VPC
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

48. Corporate
Data Center
Availability Zone 1
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Internet Public Subnet
Gateway
Amazon VPC
Availability Zone 2
New Enterprise IT AWS Region
Network Architecture

49. Corporate
Data Center
Availability Zone 1
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Internet Public Subnet
Gateway
Amazon VPC
Availability Zone 2
Branch Offices
New Enterprise IT AWS Region
Network Architecture

50. Corporate
Data Center
Availability Zone 1
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Internet Public Subnet
Gateway
Amazon VPC
Availability Zone 2
Branch Offices
Elastic
New Enterprise IT
S3 SQS/SNS/SES SWF SimpleDB DynamoDB
Beanstalk
AWS Region
Network Architecture

51. Corporate
Data Center
Availability Zone 1
DirectConnect
Location
10G
Private Subnet
Router
Customer VPN Gateway
Gateway
Corporate
Headquarters
Internet Public Subnet
Gateway
Amazon VPC
Availability Zone 2
Branch Offices
Elastic
New Enterprise IT
S3 SQS/SNS/SES SWF SimpleDB DynamoDB
Beanstalk
AWS Region
Network Architecture

52. Rich Capabilities in VPC
Elastic Load Balancer, AutoScaling, CloudWatch, Alarms
Relational Database Service (MySQL engine, for now)
Elastic MapReduce
CloudFormation
And many others, with more to come…
“Blackbox” services with public endpoints reachable via
Internet gateway (or VPN via your own network)

53. Dedicated Instances
Option to ensure physical hosts are not
shared with other customers Single Tenant
Compute Instance
$10/hr flat fee per Region + small hourly
charge
Can identify specific Instances as
dedicated
Optionally configure entire VPC as
dedicated

54. DirectConnect: Private X-Connect to AWS
Dedicated bandwidth to AWS border
network in 1Gbps or 10Gbps chunks.
Full access to public endpoints, EC2 Internet
standard & VPCs.
• VLAN tagging maps to public side or VPCs
Benefits:
• Faster / more consistent throughput
• Increased isolation and control
Great companion technology to VPC.

55. 15 Daily Newspapers
50 Web Sites
62 MM unique users per month
Over 1 Billion page views per month

56. NYTimes EC2 Expansion (April 2011)
Amazon EC2
Courtesy NYTimes

57. NYTimes EC2 Expansion (April 2011)
Amazon EC2
Courtesy NYTimes

58. NYTimes: EC2 Capacity vs Cost
50%
43%
36%
29%
21% Percent
14%
7%
Capacity 0%
Cost

59. “The AWS Cloud brings business agility as Shell is able to
deploy services much more quickly”
Johan Krebers
Vice President of Architecture
Use of AWS Business Benefit
Global oil and gas company. No minimum commitment up front and pay
per use brings significant savings.
Operationalizing their cloud strategy.
Fast provisioning within minutes for many
Shell Foundation Platform – an IT applications.
framework – is AWS approved.
Elasticity – the ability to expand and
Core operational applications running in contract IT infrastructure as needed.
production on AWS.
Development and test environments
running on AWS.
33

60. Let’s Create a VPC in Less than 4 Minutes

61. Lets Build a VPC in 4 Minutes…

62. Lets Build a VPC in 4 Minutes…

63. Let’s Start an Instance in our VPC…

64. Now lets launch an instance into our VPC

65. Now lets launch an instance into our VPC

66. Let’s Check Our Instance…

67. And lets see the results…

68. And lets see the results…

69. Example: SharePoint with On-Premises Active Directory

70. Migrating to the Cloud Cloud
Benefits
Zero upfront investment
On-demand provisioning
Instant scalability
Auto scaling and elasticity
Pay as you go
Removes undifferentiated
heavy lifting
Developer productivity
Automation

71. Migrating to the Cloud Cloud
Benefits
Zero upfront investment
On-demand provisioning
Cloud Strategy Instant scalability
Auto scaling and elasticity
Pay as you go
Removes undifferentiated
heavy lifting
Developer productivity
Automation

72. Migrating to the Cloud Cloud
Benefits
New Zero upfront investment
Applications On-demand provisioning
Cloud Strategy Instant scalability
Auto scaling and elasticity
Pay as you go
Removes undifferentiated
heavy lifting
Developer productivity
Automation

73. Migrating to the Cloud Cloud
Build a Cloud- Benefits
Ready Design
New Zero upfront investment
Applications On-demand provisioning
Cloud Strategy Instant scalability
Auto scaling and elasticity
Pay as you go
Removes undifferentiated
heavy lifting
Developer productivity
Automation

74. Migrating to the Cloud Cloud
Build a Cloud- Benefits
Ready Design
New Zero upfront investment
Applications On-demand provisioning
Cloud Strategy Instant scalability
Auto scaling and elasticity
Existing Pay as you go
Applications Removes undifferentiated
heavy lifting
Developer productivity
Automation

75. Migrating to the Cloud Cloud
Build a Cloud- Benefits
Ready Design
New Zero upfront investment
Applications On-demand provisioning
Cloud Strategy “No brainer to
Instant scalability
move” Apps Auto scaling and elasticity
Existing Pay as you go
Applications Removes undifferentiated
heavy lifting
Developer productivity
Automation

76. Migrating to the Cloud Cloud
Build a Cloud- Benefits
Ready Design
New Zero upfront investment
Applications On-demand provisioning
Cloud Strategy “No brainer to
Instant scalability
move” Apps Auto scaling and elasticity
Existing Pay as you go
Applications Removes undifferentiated
heavy lifting
Planned Phased Developer productivity
Migration
Automation

77. “No-brainer to move” Apps
• Dev/Test applications
• Self-contained Web Applications
• Social Media Product Marketing
Campaigns
• Customer Training Sites
• Video Portals (Transcoding and
Hosting)
• Pre-sales Demo Portal
• Software Downloads
• Trial Applications

78. Cloud Migration : a Phased-driven Strategy
http://aws.amazon.com/whitepapers

79. A Bridge to the IT Capabilities
Your Business Needs

80. Extending Your Data Centre With
AWS
Questions and answers