How Qantas is Scaling Cloud Operations with AWS Systems Manager - AWS Summit Sydney

1. S U M M I T SYDNEY

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T How Qantas is scaling cloud operations with AWS Systems Manager Emily Arnautovic Enterprise Solutions Architect Amazon Web Services Steven Tyson Cloud Services Lead Qantas Airways

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T - Define - Discover - Monitor - Manage - Report - Respond - Agility - Innovation Governance Developmentspeed The challenge of governance vs. agility

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS Systems Manager Parameter Store State Manager Session Manager Distributor Resource Groups Automation Run Command Inventory Patch Manager Maintenance Window

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Qantas Airways • 100 year history • Domestic and international flights • Millions of customers • Safety is our highest priority • AWS customer since 2014 • Large, diverse technical stack • 100’s of applications and services • Large cloud and physical IT presence • Constellation app (flight planning) © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Infrastructure as code AWS CloudFormation AWS Lambda AWS Step Functions Auto Scaling GroupAmazon SQS Amazon EC2 AWS Identity and Access Management (IAM)

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Infrastructure as code Documents Parameter Store Run command AWS CloudFormation AWS Lambda AWS Step Functions Auto Scaling GroupAmazon SQS Amazon EC2 AWS Identity and Access Management (IAM)

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Scenario and challenges Image credit: Steve Buissinne from Pixabay © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Scenario and challenges © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Image credit: Steve Buissinne from Pixabay

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 1: runtime parameter queries Permissions Lambda function (deletion of stale values) Parameter Store AWS Systems Manager AWS Cloud VPC

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 3: approved SOE central model Parameter Store Approved AMIs AWS Systems Manager AWS CloudFormation AWS Cloud

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 3: approved SOE central model Parameter Store Approved AMIs AWS Systems Manager CloudFormation AWS Cloud AWS Lambda function Permissions Custom resource

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 4: authenticated instance scans AWS Lambda Pre-scan AWS Step Functions Document 3rd Party security scannerRun Command AWS Cloud Amazon EC2 Instance VPC Amazon Simple Queue Service

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 4: authenticated instance scans Amazon Simple Queue Service AWS Lambda Scan AWS Step Function Amazon EC2 Instance Document 3rd Party security scannerRun Command AWS Cloud VPC Amazon Simple Queue Service AWS Lambda Pre-scan AWS Step Functions

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Use case 4: authenticated instance scans Amazon Simple Queue Service AWS Lambda Scan AWS Step Function Amazon EC2 Instance Document 3rd Party security scannerRun Command AWS Cloud VPC Amazon Simple Queue Service AWS Lambda Pre-scan AWS Step Functions Lambda Clean-Up Step Function

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Lessons learnt AWS Key Management Service key per application Use AWS Systems Manager Documents Leverage VPC Endpoints AWS Lambda for secrets workflow orchestration Secrets aren’t always forever AWS Identity and Access Management naming conventions Keep AWS Systems Manager (SSM) agents current AWS Systems Manager log expertise and management Parameter Store vs. AWS Secrets Manager – effort vs. flexibility

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Results with AWS Systems Manager  Injection of application specific secure strings • No sensitive values in code • No user details in SOE • Developers store and manage their secrets  Central source of truth for real time operational values  Central store of Amazon EC2 information • Store and push out updates centrally Image credit: Nenad Maric from Pixabay

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS Systems Manager summary AWS Systems Manager • Visibility and control at scale • Balance governance with agility: empower development teams Scan your badge! Reference: Walkthroughs • Parameter Store and Amazon Cloud Formation • Looking up AMIs Reference: AWS Solutions • Server Fleet Management at scale

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Related breakouts Keep It Secret, Keep It Safe: Credentials and Secrets Management on AWS (Level 300) Maria Sokolova Security at Scale: Security Hub and the Well Architected Framework (Level 300) Tyson Garrett The Art of Successful Failure (Level 200) Becky Weiss