AWS Sydney Summit Re:Cap 2018 - Tasmania

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Injae Kwak
Solutions Architect – Amazon Web Services
Migrating Microsoft Applications to
AWS like an Expert

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What Will You Takeaway From This Session?
• This is a 300 level session
• Holistic approach to migrating Microsoft Workloads
• Move fast…dive deep where necessary
• Barcodes are frustrating – Links on the website
http://unicornshop.lol

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Who Are Unicorn Shop?
“To enable anyone with the dream of being a
unicorn to look like one”
• Online ecommerce offering
• Brick and mortar stores
• CMS, back office applications
• .NET and SQL custom applications
• Email hosted in O365
Issues:
• Wasted resources
• Capex vs Opex model
• Developers restrained and can’t help the
business speed up

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Migration Approach
Approach
Landing
Zone
Application
Migration
Active
Directory
Automation
Database
Migration
What next?
Application
Review

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Web 01 Web 02 Web 03
App 01 App 02 App 03 Batch Jobs
SQL 01 SQL 02
Our Web Store (PCI Compliant)
• PCI compliant workload
• Need to restrict user
access to some
components
• Limited to specific
services
• Need to monitor access
patterns
Application
Review

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Web 01 Web 02 Web 03
App 01 App 02
SQL 01 SQL 02
Our CMS Deployment
• Legacy threat
management SPOF
• Systems idle for 70% of
the weekWeb 03
Threat gateway
Application
Review

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Microservices
Fleet
Microservices Deployment
Web logs
Database Logs
Vendor API
Business Insights
Application
Review

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
So Let’s Go!! ....Almost…
Strategy Plan Build & Migrate Run
Existing IT
estate
evaluation
Planning &
Discovery
Application
design
Migration &
Validation
OperationApplication 1
Application 2
Application 1
Application 2
AWS Application
discovery service
Amazon
Cloudwatch
AWS Config
AWS DMS
AWS SMS
ServicesfromAWS
ecosystem
Our
Approach

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Approaching The Migration With The 6 R’s
Retain
Retire
Rehost
Replatform
Refactor
Repurchase
Our
Approach

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Building Our Landing Zone
• Multiple accounts in Organisations + SCPs
• How to create a monolithic identity approach
(don’t judge me quite yet…)
• Amazon GuardDuty event execution
• Connectivity
• AWS Config enforcing encryption demo
Landing
Zone

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s Deploy Our Organisation’s Structure
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:*",
"cloudwatch:*"
],
"Resource": "*"
}
]
}
A1 A2 A4
M
A3
Dev Prod Prod
PCI
Landing
Zone

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Identity As A Monolith?
Target account A Target account B Target account C Target account B
Administrator account
CloudFormation
template
Stack Set
Region 1 Region 2
Landing
Zone

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Admins
Admin role
Admin role
Sales Account
Retail Account
Identity Account
Cross account roles
Landing
Zone

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Identity Account
Stack Set
Landing
Zone

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty – Event Execution
aws events put-rule --name Test --event-pattern "{"source":["aws.guardduty"]}“
aws events put-rule --name Test --event-pattern "{"source":["aws.guardduty"],"detail-
type":["GuardDuty Finding"],"detail":{"severity":[5.0,8.0]}}“
aws events put-targets --rule Test --targets Id=1,Arn=arn:aws:lambda:us-east-
1:111122223333:function:<your_function>
GuardDuty
Landing
Zone
Macie

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Our CMS Threat Management Layer
Web 01 Web 02 Web 03
App 01 App 02
SQL 01 SQL 02
Web 03
Threat gateway
Landing
Zone

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF
Landing
Zone

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF
• PCI
• OWASP Top
10
• Bot protection
• SQLi/XSS
• IP reputation
• CMS
protection
Landing
Zone

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s Get Our Networking Right…
Customer
routers
AWS direct
connect routers Amazon S3
Public traffic
Private traffic
Landing
Zone

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A good place to start..Microsoft apps need AD

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Windows EC2
Instances
Amazon
Linux EC2
Instances
Azure AD
Connect
Server
ADFS
Server
(optional)
Amazon
Workspaces
Amazon
Workmail
Amazon
Workdocs
Amazon
Chime
AWS Mgmt
Console
RDS for
SQL Server
Amazon
QuickSight
Amazon
Connect
AWS Microsoft
AD Directory
Remote
Desktop
Licensing
.NET
applications
SharePoint
SQL
Server VPN
Connection
Office 365
Azure AD
On-premises
Microsoft
Active Directory
On-premises
Users
Authentication &
Authorisation
SAML
Authenticate
Federate
Synchronise
Users
AWS apps & services Amazon EC2
Cloud applications
AD aware workloads
On-premises AD
Corporate data centre
Active
Directory

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What Next? Migrating Databases Can Be Hard..
Migration
method
Amazon
RDS Target
Amazon
EC2 Target
Downtime DB Objects Cross-Engine
Backup/Restore Yes Yes Yes (hrs) Data, Schemas,
Stored Procedures,
Triggers, Indexes
No
Import/Export
Bulk Copy
Yes Yes Yes (mins-hrs) Data, Schemas,
Stored Procedures,
Triggers, Indexes
No
SQL Log
Shipping
No Yes Minimal (secs-min) Pre-create the DB,
sync
No
Hybrid
Architecture
No Yes Minimal (secs-min) Pre-create the DB,
sync
No
AWS DMS Yes Yes Minimal (secs-min) With SCT (Data,
Schemas, Stored
Procedures, Triggers,
Indexes)
Yes (SCT)
Database
Migration

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Users Accessing On Premise
On-premise DB AWS DB
Database
Migration

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Migrating Database Writes Across
On-premise
CMS DB AWS DBAWS DMS
Database
Migration

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DNS Update And On Premise Decommission
Decommission
CMS DB AWS DBAWS DMS
Database
Migration

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What To Migrate After SQL Server?
Fan out / deploy multiple systems in parallel:
• Exchange
• SharePoint
• Skype for Business
• System Centre Configuration Manager
• System Centre Operations Manager
• Etc…
Application
Migration

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Server Migration Service
SCVMM
HV
HOST
HV
HOST
HV
HOST AWS SMS
SMS VM
CMS Web
AMI
CMS App
AMI
Application
Migration

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Windows? Containers? Actually Yes…
State in containers, you can but it’s hard
Stateless apps + short lived, look at ECS containers
Microservices to Serverless?
.NET Core + Linux?
Application
Migration

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Spot + On-Demand = Winning
Example spot pricing Instance diversity
Application
Migration

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Scheduled Tasks? .Net Core 2.0 Lambda
VPC private
subnet
Pull data from CSV file
Perform ETL
Insert data into SQL table
Upload
Users
Data dropped in S3
Schedule / event triggered
S3 Bucket Lambda function DB in private subnet
Application
Migration

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation Is Key, How Do I Automate Updates?
Start temporary
instance
AWS latest
Windows
AMI
Update EC2 Config
or EC2 Launch
Update PV drivers and run
Windows updates
Invoke user provided
scripts
Run a sysprep /
Generalise
Stop
temporary
instance
Custom AMI ready for
deployment
Automation
SSM Patch Manager

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Understand the dependency chain in your
Microsoft applications
• Build your migration plan around the
dependency chain
• Know how Microsoft licensing on AWS works
and plan accordingly
What Next?
Wrapping It Up

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You!