Once you've migrated Production Microsoft workloads into AWS, what's next? This webinar will cover the benefits of cloud, automation & tooling in the management of persistent Microsoft workloads. We discuss and show AWS Systems Manager and how that can help with managing Microsoft workloads in AWS.

1. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Ryan Pothecary, Sr Consultant, Proserve GSP Microsoft
28th June 2018
Managing Microsoft Workloads
on AWS

2. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Agenda
• Challenges in Managing Cloud Servers
• AWS Services that can help
• AWS Systems Manager

3. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Customer challenges
Traditional IT toolset not
built for cloud scale
infrastructure
Maintaining enterprise-wide
visibility is challenging
Deploying multiple products
is a significant overhead
Licensing costs &
complexity
Managing cloud and hybrid environments using
a traditional toolset is complex and costly

4. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
AWS Services that you can use
AWS Systems
Manager
CloudWatch Trusted Advisor AWS Config AWS Service Catalog
Auto-Scaling Simple Notification Service AWS Inspector

5. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
AWS Monitoring

6. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Trusted Advisor

7. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Introducing Amazon EC2 Systems Manager
A set of capabilities that:
• enable automated configuration
• support ongoing management of systems at scale
• work across all of your Windows and Linux workloads
• run in Amazon EC2 or on-premises
• carry no additional charge to use

8. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Systems Manager capabilities
Run Command State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store

9. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Run Command
• Remotely execute shell scripts, PowerShell scripts
• Bootstrap an instance, configure the OS, install software
• Execute commands ad-hoc, or trigger using CloudWatch Events
Remotely perform common administrative tasks at scale

10. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Parameter Store
• Encrypt sensitive information using your own KMS keys
• Reference your parameters in Run Command, State Manager,
or Automation service
• Use with IAM to manage access in a granular fashion
• Eliminate ongoing maintenance challenge of critical
enterprise assets
Centralized management of IT assets such as passwords
and connection strings

11. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
State Manager
• Define configuration policy using simple JSON-based Documents
• Example: Configure firewall and update anti-malware definitions
• Control how configuration policy is applied (schedule, target
instances)
• Monitor instance compliance
Periodically re-apply configuration policies to manage drift

12. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Inventory
• Collect instance and OS details, network configurations,
installed software and patches
• Use Custom Inventory and extend the inventory schema
• Track licensing usage and identify zero-day vulnerabilities
• Track inventory state changes over time and generate non-
compliance notifications via AWS Config integration
Collect, query, and audit instance software inventory

13. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Maintenance Window
• Define one or more recurring windows of time during which it is
acceptable for disruptive actions to occur
• Periodically invoke Patch Manager or Run Command
• Improve availability and reliability of your workloads by
automatically performing tasks in a well-defined window of time
Schedule disruptive tasks in well-defined window to
minimize downtime

14. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Patch Manager
• Express custom patch policies as patch baselines
• Example: apply critical patches on day 1 but wait 7 days for non-critical patches
• Perform patching during scheduled maintenance windows
• Generate patch compliance reports
• Eliminate manual intervention and reduce time-to-deploy for critical
updates and zero-day vulnerabilities
Roll OS patches using custom-defined rules

15. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
In summary...
Hybrid Cross-platform Scalable
Secure Easy-to-write automation Expected reduction in total
cost of wwnership (TCO)

16. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
links
• https://www.youtube.com/watch?v=IBvsizhKtFk (HowAmazon.comUses AWSManagement Tools)
• https://youtu.be/KJiCfPXOW-U (TheAWSphilosophyof Security)
• https://youtu.be/Q7zF6sT5Bis (UsingAWSManagement Tools)
• https://aws.amazon.com/blogs/mt/patching-your-windows-ec2-instances-using-aws-systems-
manager-patch-manager/ (Great BlogconcerningpatchingMicrosoft Workloads withPatchManager)
• https://aws.amazon.com/blogs/mt/writing-your-own-aws-systems-manager-documents/
• https://aws.amazon.com/premiumsupport/trustedadvisor/best-practices/ (TrustedAdvisor)
• https://aws.amazon.com/systems-manager/getting-started/ (Systems Manager)
• https://docs.aws.amazon.com/aws-technical-content/latest/aws-overview/management-
tools.html (Management Tools Overview)

17. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Copy files from S3 to local instance
# Your account access key - must have read access to your S3 Bucket
$accessKey = "YOUR-ACCESS-KEY"
# Your account secret access key
$secretKey = "YOUR-SECRET-KEY"
# The region associated with your bucket e.g. eu-west-1, us-east-1 etc. (see
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-regions)
$region = "eu-west-1"
# The name of your S3 Bucket
$bucket = "my-test-bucket"
# The folder in your bucket to copy, including trailing slash. Leave blank to copy the entire bucket
$keyPrefix = "my-folder/"
# The local file path where files should be copied
$localPath = "C:s3-downloads"
$objects = Get-S3Object -BucketName $bucket -KeyPrefix $keyPrefix -AccessKey $accessKey -SecretKey $secretKey -Region
$region
foreach($object in $objects) {
$localFileName = $object.Key -replace $keyPrefix, ’’
if ($localFileName -ne '') {
$localFilePath = Join-Path $localPath $localFileName
Copy-S3Object -BucketName $bucket -Key $object.Key -LocalFile $localFilePath -AccessKey $accessKey -
SecretKey $secretKey -Region $region
}
}