Learn why it is critical to have an out-of-box approach to monitoring AWS and understand Inter-Region and Inter-AZ performance and network topology.

1. 1© 2017 ThousandEyes Inc. All Rights Reserved.Confidential © 2017 ThousandEyes Inc. All Rights Reserved.

2. 2© 2017 ThousandEyes Inc. All Rights Reserved.
Monitoring Connectivity of AWS Services
Why
Is it important to monitor connectivity to AWS
Relying on CloudWatch alone is not sufficient
How To choose the right AWS Region and AZ
What Are the best practices to monitor inter-
dependent AWS services

3. 3© 2017 ThousandEyes Inc. All Rights Reserved.
About ThousandEyes
Network Intelligence platform
that gives you a complete
picture from users to internal
and cloud-based applications
Routing
User App
End-to-End Performance Data
App
Performance
User
Experience
Network
Topology
Routing
Topology
Enterprise, Endpoint and Cloud Agents
Network
Connectivity
Surface insights from
a global data set
Lightweight, flexible
data collection
Unified view of diverse
performance data
Solve issues across
shared infrastructure
See any network like
it’s your own

4. 4© 2017 ThousandEyes Inc. All Rights Reserved.
Why monitor connectivity to AWS?
• Focus on infrastructure
and host level monitoring
within VPC
• Insights into type of traffic
and amount of traffic
to/from VPC
• Can help identify if EC2
instance is over capacity
• Provides real time
perspective of how
services are consumed
• Focus on monitoring
connectivity to AWS VPC
and regions
• Can help identify if an ISP
outage impacts service
availability
Amazon CloudWatch ThousandEyes

5. 5© 2017 ThousandEyes Inc. All Rights Reserved.
Anatomy of the AWS Network
Transit Centers Transit Centers
Availability Zone 1 Availability Zone 2
Availability Zone ’n’
Region

6. 6© 2017 ThousandEyes Inc. All Rights Reserved.
AWS Regions & Availability Zones
2
2
3
3
2
2
3
3
2
2
5
2
2
2

7. 7© 2017 ThousandEyes Inc. All Rights Reserved.© 2017 ThousandEyes Inc. All Rights Reserved.
Inter-Region Performance
Virginia
London
Mumbai
Sydney
California

8. 8© 2017 ThousandEyes Inc. All Rights Reserved.
Performance Benchmarking
• Inter-AZ
– Latency between AZ’s in a region is ~ 2-5 ms (roundtrip)
– AZ’s are a single Layer 3 hop away from each other
AZ’s are a single Layer 3 hop away

9. 9© 2017 ThousandEyes Inc. All Rights Reserved.
Inter-AZ Performance
Inter-AZ
latencies
within the EU
region not as
stable as US-
East

10. 10© 2017 ThousandEyes Inc. All Rights Reserved.
Performance Benchmarking
• Inter-Region transit is entirely within the AWS network.
• Forward and reverse paths across region’s have no
overlap.
• Latency between regions vary from 20ms – 200ms.
• Varying levels of visibility across AWS regions.

11. 11© 2017 ThousandEyes Inc. All Rights Reserved.
Visibility across various AWS regions
• Visibility into AWS-East,
AWS-West, AWS APAC
South (Mumbai) is limited
due to the presence of
more “white” nodes.
• Regions exhibit varying
level of visibility. For eg,
AWS EU Central has no
”white” nodes compared
to AWS-APAC South
• White node: Node in the
path that fails to respond
to probing data.
White nodes

12. 12© 2017 ThousandEyes Inc. All Rights Reserved.
Monitoring EC2 Performance Across Regions
2
2
3
5
2

13. 13© 2017 ThousandEyes Inc. All Rights Reserved.
Choosing Regions and AZ’s
• Latency is heavily dependent on where users are accessing
the service from

14. 14© 2017 ThousandEyes Inc. All Rights Reserved.
Peering across regions
• AWS-West
peers with
Level 3 more
frequently

15. 15© 2017 ThousandEyes Inc. All Rights Reserved.
Peering across regions
• AWS-West
peers with
Level 3 more
frequently
• AWS-East
peering is
rather
distributed
Level 3
Integra Telecom
Tinet SpA
TeliaNet

16. 16© 2017 ThousandEyes Inc. All Rights Reserved.
Best Practices to Monitor AWS Connectivity
• Understand network performance from the perspective of the
customer
– Select Cloud Agents that approximate customer distribution
– Pick Cloud Agents based on ISP networks
• Keep tabs on connectivity from your data center to AWS
services for hybrid cloud
– Use Enterprise Agents in the data center monitoring services (or Enterprise
Agent) to relevant AWS Regions, AZ’s
– Agent-to-Agent tests provide richer context
• Monitor Inter-Region performance for services distributed within
AWS Regions
– Bidirectional network tests across Enterprise Agents

17. 17© 2017 ThousandEyes Inc. All Rights Reserved.
Dependency across Amazon Services
AWS Service What is it? Features Dependency
Amazon VPC VPC is a virtual network dedicated
to an account/enterprise. Isolation
container for resources deployed
within AWS.
AWS workloads like EC2 can be
spun within a VPC.
VPC’s can share multiple AWS
services like EC2, EMR, Redshift
etc
Amazon Elastic Compute Cloud
(EC2)
Compute resources or virtual
servers within a VPC.
Compute is redundant across
availability zones and regions
AWS Elastic Block Sotrage
AWS RDS for database mgmt
AWS CloudWatch
Amazon Simple Storage Service
(S3)
Storage buckets within AWS Allows you to host a static website
or store images and other static
assets for an EC2 service.
AWS EC2
Amazon CloudFront CDN service 68 PoPs globally. EC2 instances serving as origin
servers
S3 content
Amazon Route 53 DNS service Amazon CloudFront
EC2, S3, Cloud Trail, Elastic
Beanstalk
AWS Direct Connect Provides dedicated network
connection between your
enterprise network and AWS
Direct Connect locations
AWS Connect Partners like
Equinix, Telecity Group, CoreSite
etc

18. 18© 2017 ThousandEyes Inc. All Rights Reserved.
Interaction across various AWS Services
End User
Route
53
CloudFront Edge
Amazon
Route 53
Amazon
Route 53
EC2
S3
EC2
S3
AWS VPC (Origin)

19. 19© 2017 ThousandEyes Inc. All Rights Reserved.
Monitoring Route 53
• Monitor the DNS infrastructure through DNS Trace and DNS Server
Tests
• Correlate DNS performance to network behavior
• Alert based on DNS Errors, Resolution time, End-to-End Network loss
and BGP routing
DNS Trace DNS Server
Test the entire DNS hierarchy Test a pre-determined set of name
servers (authoritative or local)
Understand the availability and
accuracy of record mappings
Understand the performance of
Route 53 DNS infrastructure
Validate record mappings Validate record mappings, network
and routing data

20. 20© 2017 ThousandEyes Inc. All Rights Reserved.
Interaction across various AWS Services
End User
Route
53
End User
CloudFront Edge
Amazon
Route 53
Amazon
Route 53
EC2
S3
EC2
S3
AWS VPC (Origin)
Monitor DNS
Benchmark CDN Performance
Monitor Origin EC2, S3 Instances separately

21. 21© 2017 ThousandEyes Inc. All Rights Reserved.© 2017 ThousandEyes Inc. All Rights Reserved.
Thank You!