Since last year’s ‘Taking DevOps to the Edge’, and with the introduction of AWS Lambda@Edge, the tools available to apply DevOps practices to your application edge have broadened. In this updated session, we dive deep into how you can integrate Amazon CloudFront and related services into your application, be agile in developing and adapting the application, and follow best practices when configuring the services to improve security and performance, all while reducing costs. Attend this session and learn how to determine the best location (origin, edge, or client) to execute your code, avoid needless forwarding of headers and cookies, test your application when making changes, version your configuration changes, monitor usage and automate security, create templates for new distributions, configure SSL/TLS certificates, and more.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Taking DevOps Closer to the Edge
L e e A t k i n s o n , P r i n c i p a l S o l u t i o n s A r c h i t e c t
C T D 4 0 1
N o v e m b e r 3 0 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
1. What is the AWS edge?
2. The application edge
3. Patterns for the DevOps edge

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is the AWS edge?

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS regions
44 Availability Zones (AZs)
16 Regions
17 AZs in 6 Regions announced

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS edge network
107 Points of Presence (PoPs)
96 Edge Locations
11 Regional Edge Caches (RECs)

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS edge services
• Amazon CloudFront
• Content delivery network (CDN)
• Amazon Route 53
• DNS registration and hosting, health checks
• AWS WAF
• Web application firewall (WAF)
• AWS Shield
• DDOS protection
• AWS Lambda@Edge
• Serverless compute in the edge network

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The application edge

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Your application =
EC2/ELB/S3
Route 53/CloudFront/
AWS WAF & AWS Shield
HTML5/Mobile/Desktop
Origin+ Edge+ Client
… and Lambda@Edge!

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ClientClient
Amazon Backbone
Edge location Edge location Edge location
CloudFront helps improve user experience
Origin

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudFront helps reduce costs
Free data transfer cost AWS
origin to CloudFront
Less load on origin
Lower data transfer cost CloudFront to Internet
compared to AWS Region to Internet
Client
Edge location Edge location Edge location
Origin

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1.Cache as much as possible
2.Forward as little as possible
3.Validate efficiently
4.Automate the edge
5.Monitor the edge

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1.Cache as much as possible
2.Forward as little as possible
3.Validate efficiently
4.Automate the edge
5.Monitor the edge

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
HTTP cache-control
Origin
Client
Cache-Control: max-age:1800Cache-Control: max-age:1800,s-maxage:900Cache-Control: max-age:1800,privateCache-Control: no-cacheCache-Control: no-store
HTTP/1.1 200 OK
Last-Modified: Fri, 30 Nov 2017 01:00:00 GMT
ETag: "TGVlQXRraW5zb25Xb3onRXJl"
GET /barchart.jpg HTTP/1.1
If-None-Match: "TGVlQXRraW5zb25Xb3onRXJl"
HTTP/1.1 304 Not ModifiedHTTP/1.1 200 OK
Last-Modified: Fri, 30 Nov 2017 02:00:00 GMT
ETag: "TGVlQXRraW5zb24nRXJlVG9v"
Amazon
CloudFront

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cache-Control
s-maxage?
Cache-Control
max-age?
Expires?
> MinTTL?< MaxTTL?
Use DefaultTTL Use MaxTTL Use MinTTL Use Origin-Defined TTL
The origin has defined
the TTL for the object
CloudFront TTL

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use the client to increase cacheability

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Forwarding
• Include parts of the client’s request in the CloudFront request to the
origin
• Components are: method; path; querystring; headers; cookies
• Values forwarded are included in the cache key
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tips when forwarding
• Only forward if it varies the response
• Reduce variability in forwarded values
• Don’t forward for tracking/logging - use CloudFront access logs or
beacon
• Don’t forward for authorization - use signed URLs/cookies, CloudFront
restrictions, AWS WAF
• Use Vary response header

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Forward User-Agent?
GET / HTTP/1.1
origin
client
GET / HTTP/1.1
CloudFront-Is-Mobile-Viewer: true
GET / HTTP/1.1
CloudFront-Is-Tablet-Viewer: true
GET / HTTP/1.1
CloudFront-Is-Desktop-Viewer: true
GET / HTTP/1.1
CloudFront-Is-SmartTV-Viewer: true
GET / HTTP/1.1
User-Agent: …
GET / HTTP/1.1
User-Agent: Firefox/56.0
Amazon
CloudFront
AWS Lambda@Edge
Viewer Request
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Versio
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.10
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.10
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/5
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
'use strict’;
const useragent = require('useragent’);
exports.handler = (event, context, callback) => {
const request = event.Records[0].cf.request;
const userAgentHeaders = request.headers['user-agent’];
if (userAgentHeaders && userAgentHeaders.length > 0 ) {
const userAgent = useragent.parse(userAgentHeader[0].value);
userAgentHeader.value =
`{userAgent.family}/{userAgent.major}.{userAgent.minor}.{userAgent.patch}`;
}
callback(null, request);
};
User-Agent normalisation with Lambda@Edge

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
'use strict';
exports.handler = (event, context, callback) => {
const request = event.Records[0].cf.request;
const uri = request.uri;
const acceptHeaders = headers['accept'];
if (acceptHeaders && acceptHeaders.some(header => {
return header.value.split(',').some(type => {
return type.match(/image/webp;?/);
})
})) {
request.uri = uri.substring(uri.lastIndexOf('.')) + '.webp';
}
callback(null, request);
}
Path-rewriting for WebP support

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Responsive Web design
/* Use CSS3 media-selectors */
@media only screen and (max-width: 768px) {
…
}

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
HTTP does not provide invalidation
CDN invalidation is not recognized by downstream caches:
• Origin J
• CloudFront J
• ISP/corporate/public caches L
• Browser caches L

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
HTTP does provide validation
• Use conditional HTTP requests
• If-Modified/If-Match/If-None-Match
• Origin should efficiently generate 304s
• Use low s-maxage and higher max-age
• Use URL versioning to ‘cache-bust’

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS edge services automation
• AWS edge services have APIs
• AWS SDK available for 11 languages and platforms
• Deploy your application edge using AWS CloudFormation
• Change configuration as your application develops
• Use AWS Identity and Access Management (IAM) to control access to
your resources

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon
Route 53
AWS WAF
Amazon
CloudFront
Elastic Load Balancing EC2
EU-WEST-1
Amazon S3
Corporate
data center
Elastic Load Balancing EC2
US-WEST-1
Amazon
Route 53
The edge as code
AWS Lambda
AWS
Certificate Manager
Client

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Edge deployment with AWS CodePipeline
Testing
CloudFormation
Template
AWS
CodeCommit
‘Dev’
CloudFront
distribution
‘Prod’
CloudFront
distribution
AWS
CodePipeline
re:Invent 2016 demo https://www.youtube.com/watch?v=y_E231oJlT8

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS WAF security automations
https://aws.amazon.com/answers/security/aws-waf-security-automations/

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CloudTrail
• Route 53
• CloudFront
• AWS WAF
• AWS Lambda@Edge

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon CloudWatch metrics and alarms
• Route 53
• CloudFront
• AWS WAF
• AWS Lambda@Edge

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudFront reporting

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Analysing CloudFront access logs
Amazon
CloudFront
S3 bucket S3 bucket
Amazon
QuickSight
#Version: 1.0 #Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent)
2014-05-23 01:13:11 FRA2 182 192.0.2.10 GET d111111abcdef8.cloudfront.net /view/my/file.html 200 www.displaymyfiles.com Mozilla/4.
2014-05-23 01:13:12 LAX1 2390282 192.0.2.202 GET d111111abcdef8.cloudfront.net /soundtrack/happy.mp3 304 www.unknownsingers.com Mo
Amazon
Redshift
W3C Log
Processor
AWS Glue
Amazon
Athena

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patterns for the DevOps edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key takeaways
1. Consider the AWS edge as a part of your application
2. Optimise and use caching efficiently
3. Automate configuration of the AWS edge
4. Monitor the AWS edge using CloudTrail, CloudWatch, and
services logs

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!