Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

AWS Networking 2020

581 views

Published on

菊池之裕
JAWS DAYS 2020 ONLINE AWS LT

Published in: Internet
  • Be the first to comment

  • Be the first to like this

AWS Networking 2020

  1. 1. © 2020, Amazon Web Services, Inc. or its Affiliates. 菊池 之裕/Yukihiro Kikuchi 2020/03/28 AWS Networking 2020 JAWS DAYS 2020 Online
  2. 2. © 2020, Amazon Web Services, Inc. or its Affiliates. 自己紹介 名前:菊池 之裕(きくち ゆきひろ) 所属:シニアソリューションアーキテクト ネットワークスペシャリスト ロール:Network系サービスについてのご支援 経歴:ISP,IXP,VPN運用、開発を経てネットワーク機器、仮想ルー タ販売会社のプリセールス、プロダクトSEからAWSへ 好きな AWS サービス: AWS Transit Gateway,AWS Direct Connect,AWS Marketplace 2
  3. 3. © 2020, Amazon Web Services, Inc. or its Affiliates. Networking update 2020
  4. 4. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS Update for Networking(抜粋) Amazon Route 53 Resolver endpoints for hybrid cloud are now available in the South America (São Paulo) and Middle East (Bahrain) Regions 03/25/2020 AWS Transit Gateway Network Manager now includes support for AWS CloudFormation 03/23/2020 Use Amazon VPC Endpoint Policies for granular control of Amazon EC2 APIs 03/23/2020 AWS Global Accelerator launches TCP Termination at the Edge 03/23/2020 AWS Site-to-Site VPN now supports certificate authentication for connections to AWS Transit Gateway 03/20/2020 Amazon Elastic Container Service (Amazon ECS) now supports Service Discovery in three additional AWS regions 03/19/2020 Amazon VPC Flow Logs Now Support Resource Tagging and Tag-on-Create 03/17/2020 AWS App Mesh launches support for end to end encryption 03/16/2020 API Gateway offers private integrations with AWS ELB and AWS CloudMap as part of HTTP APIs GA release 03/13/2020 AWS App Mesh is now available in Asia Pacific (Hong Kong) Region 03/11/2020 Amazon VPC NAT Gateway Now Supports Tag-on-Create 03/09/2020 AWS adds the ability for customers to enable AWS Local Zones themselves 03/09/2020 Amazon VPC Endpoints For Amazon SQS Are Now Available In The Middle East (Bahrain) Region 03/03/2020 AWS Lambda@Edge now supports Node 12.x and Python 3.8 03/02/2020 Amazon FSx now enables you to create and use file systems in Shared Amazon Virtual Private Clouds (VPCs) 02/28/2020 AWS Global Accelerator now supports Bring Your Own IP Addresses and Resource Tagging 02/27/2020 Amazon CloudFront in China announces support for Usage and Activity Reports in the Console 02/21/2020 Amazon VPC Endpoints and Endpoint Services now support Tag-On Create 02/18/2020 Amazon EKS Announces Release of VPC CNI Version 1.6 02/14/2020 AWS App Mesh is now available in Europe (Stockholm), South America (São Paulo) and Middle East (Bahrain) regions 02/13/2020 Amazon VPC Flow Logs Now Support 1-minute Aggregation Intervals 02/05/2020 Introducing the Desktop Client for AWS Client VPN 02/05/2020 New Digital Course: AWS Transit Gateway Networking and Scaling 01/28/2020 New Digital Course: Architecting Serverless Solutions 01/28/2020 AWS Cloud Map supports editing custom service instance attributes in the AWS Console 01/24/2020 Amazon VPC Ingress Routing Now Supports AWS CloudFormation 01/21/2020 Query Volume Metrics Now Available for Amazon Route 53 Resolver Endpoints 01/21/2020 AWS to Launch Standard AWS Region in Osaka in Early 2021 01/21/2020 AWS Direct Connect supports AWS Transit Gateway for AWS Middle East (Bahrain) Region 01/17/2020 AWS Client VPN now Supports Port Configuration 01/16/2020 AWS Transit Gateway is Now Available in the Europe (Stockholm) AWS Region 01/14/2020 Amazon CloudFront launches in five new countries - Bulgaria, Greece, Hungary, Kenya, and Romania 01/10/2020 Amazon Route 53 Resolver Endpoints for Hybrid Cloud Now Available in the Asia Pacific (Hong Kong) AWS Region 01/09/2020 AWS PrivateLink now supports Private DNS names for internal and 3rd party services 01/06/2020 AWS Direct Connect supports AWS Transit Gateway for AWS Asia Pacific (Hong Kong) Region 01/06/2020 AWS Step Functions now supports AWS PrivateLink
  5. 5. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS Update for Networking(抜粋) Amazon Route 53 Resolver endpoints for hybrid cloud are now available in the South America (São Paulo) and Middle East (Bahrain) Regions 03/25/2020 AWS Transit Gateway Network Manager now includes support for AWS CloudFormation 03/23/2020 Use Amazon VPC Endpoint Policies for granular control of Amazon EC2 APIs 03/23/2020 AWS Global Accelerator launches TCP Termination at the Edge 03/23/2020 AWS Site-to-Site VPN now supports certificate authentication for connections to AWS Transit Gateway 03/20/2020 Amazon Elastic Container Service (Amazon ECS) now supports Service Discovery in three additional AWS regions 03/19/2020 Amazon VPC Flow Logs Now Support Resource Tagging and Tag-on-Create 03/17/2020 AWS App Mesh launches support for end to end encryption 03/16/2020 API Gateway offers private integrations with AWS ELB and AWS CloudMap as part of HTTP APIs GA release 03/13/2020 AWS App Mesh is now available in Asia Pacific (Hong Kong) Region 03/11/2020 Amazon VPC NAT Gateway Now Supports Tag-on-Create 03/09/2020 AWS adds the ability for customers to enable AWS Local Zones themselves 03/09/2020 Amazon VPC Endpoints For Amazon SQS Are Now Available In The Middle East (Bahrain) Region 03/03/2020 AWS Lambda@Edge now supports Node 12.x and Python 3.8 03/02/2020 Amazon FSx now enables you to create and use file systems in Shared Amazon Virtual Private Clouds (VPCs) 02/28/2020 AWS Global Accelerator now supports Bring Your Own IP Addresses and Resource Tagging 02/27/2020 Amazon CloudFront in China announces support for Usage and Activity Reports in the Console 02/21/2020 Amazon VPC Endpoints and Endpoint Services now support Tag-On Create 02/18/2020 Amazon EKS Announces Release of VPC CNI Version 1.6 02/14/2020 AWS App Mesh is now available in Europe (Stockholm), South America (São Paulo) and Middle East (Bahrain) regions 02/13/2020 Amazon VPC Flow Logs Now Support 1-minute Aggregation Intervals 02/05/2020 Introducing the Desktop Client for AWS Client VPN 02/05/2020 New Digital Course: AWS Transit Gateway Networking and Scaling 01/28/2020 New Digital Course: Architecting Serverless Solutions 01/28/2020 AWS Cloud Map supports editing custom service instance attributes in the AWS Console 01/24/2020 Amazon VPC Ingress Routing Now Supports AWS CloudFormation 01/21/2020 Query Volume Metrics Now Available for Amazon Route 53 Resolver Endpoints 01/21/2020 AWS to Launch Standard AWS Region in Osaka in Early 2021 01/21/2020 AWS Direct Connect supports AWS Transit Gateway for AWS Middle East (Bahrain) Region 01/17/2020 AWS Client VPN now Supports Port Configuration 01/16/2020 AWS Transit Gateway is Now Available in the Europe (Stockholm) AWS Region 01/14/2020 Amazon CloudFront launches in five new countries - Bulgaria, Greece, Hungary, Kenya, and Romania 01/10/2020 Amazon Route 53 Resolver Endpoints for Hybrid Cloud Now Available in the Asia Pacific (Hong Kong) AWS Region 01/09/2020 AWS PrivateLink now supports Private DNS names for internal and 3rd party services 01/06/2020 AWS Direct Connect supports AWS Transit Gateway for AWS Asia Pacific (Hong Kong) Region 01/06/2020 AWS Step Functions now supports AWS PrivateLink 37個もありました!
  6. 6. © 2020, Amazon Web Services, Inc. or its Affiliates. きりがないので、3つ説明します • Transit Gateway/VPN/Direct Connect • VPC • ELB
  7. 7. © 2020, Amazon Web Services, Inc. or its Affiliates. Transit Gateway
  8. 8. © 2020, Amazon Web Services, Inc. or its Affiliates. Reference Network Architecture AWSVPN AWS Direct Connect Account Account Account Account IAM, cross-account roles Route tables Route tables Transit Gateway Account Account Account Account Account Account Account Account Account Account Account Account Internet
  9. 9. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS Region Transit Gateway ENIs VPN Routing domain Routing domain AWS Direct Connect Regional router • CentralizeVPN andAWS Direct Connect Scalable • Thousands ofVPCs across accounts • Spread traffic over manyVPN connections • AcceleratedVPN - new Flexible routing • Network interfaces in subnets • Control segmentation and sharing with routing • Inter-region routing - new Multicast Support • Multicast Routing – new Operations / Management • TGW Network Manager – new Transit Gateway – 2020
  10. 10. © 2020, Amazon Web Services, Inc. or its Affiliates. Transit GatewayのMulticast対応 • Multicast • AWS Transit Gatewayの機能として、データスト リームを仮想的に複数のアプリケーションに配信 することが可能に • 株価配信やマルチメディアコンテンツ配信など、 データを購読者にストリームする際に最適 • バージニアのリージョンで利用可能 AWS Transit Gateway Instance Instance Instance Traditional server
  11. 11. © 2020, Amazon Web Services, Inc. or its Affiliates. 注意する点 • OSPFやVRRPを使うための機能ではない • IGMP(v2)は当初未サポート • 手動登録の必要があります。
  12. 12. © 2020, Amazon Web Services, Inc. or its Affiliates. Transit Gateway リージョン間接続 • リージョン間ピアリング • 各リージョンに構成したAWS Transit Gatewayをリージョン間でピアリ ングすることができるようになった • 各リージョンにまたがるグローバルネットワークを構成可能になり、ト ラフィックは常にAWSの回線を通過する • さらにその通信経路はSPOFがないよう冗長化され、リージョン間トラ フィックは暗号化が行われる • バージニア、オハイオ、オレゴン、アイルランド、フランクフルトで利 用可能 • クロスアカウント接続可能 • Peeringにはアタッチメント料金がかかり、Peeringのデータアウトは データ通信量にはカウントされない • 通常のリージョン間データ転送料金はかかる AWS Transit Gateway InstanceInstance AWS Transit Gateway
  13. 13. © 2020, Amazon Web Services, Inc. or its Affiliates. Transit Gateway Network Manager • Transit Gatewayを介したAWS/オンプレミスのグ ローバルネットワークを可視化し、モニタリング するダッシュボードを提供 • クラウドとオンプレミスの双方を単一のダッシュ ボードで可視化・監視することができるようにな る • ネットワークの監視にはCloudWatchメトリクス や、CloudWatch Eventsを利用して行う • SD-WANパートナのソリューションを利用してい る場合、自動的に接続し管理対象として登録して くれる • 東京を含む各リージョンで利用可能
  14. 14. © 2020, Amazon Web Services, Inc. or its Affiliates. ネットワークマップの例
  15. 15. © 2020, Amazon Web Services, Inc. or its Affiliates. Direct Connect Gateway Update Direct Connect GatewayとVPCは同一支払いアカウントであれば、 別のアカウントでもアタッチ可能(2019/10/4 制限削除※1) オフィス データセンター VGW 接続:Owner A VPC:Account X VPC:Account X VPC:AccountY DXGW:Account X Direct Connect Gateway Direct Connect 接続 Private VIF AWS ルーター VGW VGW VIF:Account X DXGWと別アカウントの VPCもアタッチ可能 DXGWと別アカウントの VPCもアタッチ可能 DXGWと別アカウントの VPCもアタッチ可能 DXGWと別アカウントの VPCもアタッチ可能 ※1 https://aws.amazon.com/jp/about-aws/whats-new/2019/10/aws-direct-connect-aws-direct-connect-announces-the-support-for-granular-cost-allocation-and-removal-of- payer-id-restriction-for-direct-connect-gateway-association/
  16. 16. © 2020, Amazon Web Services, Inc. or its Affiliates. VPC
  17. 17. © 2020, Amazon Web Services, Inc. or its Affiliates. AmazonVPC Ingress Routing • サードパーティ製品をAWS環境で活用することが 容易になる新機能を発表 • Internet Gateway/VGWに対するアウトバウンド・ インバウンド双方のトラフィックを特定EC2イン スタンスのENIに向ける事ができる • VPCに出入りする全トラフィックが特定EC2イン スタンスを通過することを強制するため、IDS/IPS やFirewallによる監視・通信制御を効果的に実行可 能になる • Amazon VPCのIngress Routingは全てのリージョ ンで利用可能
  18. 18. © 2020, Amazon Web Services, Inc. or its Affiliates. ELB(ALB)
  19. 19. © 2020, Amazon Web Services, Inc. or its Affiliates. ALBが重み付け負荷分散をサポート • Application Load Balancerに紐付けられたターゲッ トグループ毎に流入するトラフィック量を制御で きるようになった • ターゲットグループ毎に0-999の重みを設定する と、それぞれが全体に占める割合に応じたトラ フィックが流入するようALBが制御する • Blue/Greenデプロイやカナリアリリースを行いた いときにも有益 • すべてのリージョンで利用でき、追加費用はなし Instances Instances Application Load Balancer TargetGroup #1 TargetGroup #2
  20. 20. © 2020, Amazon Web Services, Inc. or its Affiliates. ALBがLORアルゴリズムによる負荷分散に対応 Application Load BalancerでLeast Outstanding Requests(LOR)アルゴリズムが利用可能になった 処理中のリクエスト数が最小のインスタンスに新たなト ラフィックをルーティングするように動作する 従来のアルゴリズムではリクエストの内容によって負荷 が変わる場合に、負荷のムラを抑えることが期待できる Spot Fleetなどでバックエンドのインスタンスタイプが 混在している場合や、WebSocketのように持続する接続 を分散したい場合に有益 Application Load Balancer Instance Instance
  21. 21. © 2020, Amazon Web Services, Inc. or its Affiliates. まとめ • Transit Gateway/VPN/Direct Connect • VPC • ELB(ALB) どんどん進化するAWSネットワーク ご期待ください!
  22. 22. © 2020, Amazon Web Services, Inc. or its Affiliates. ありがとうございました!

×