Amazon Web Services User Group Sydney - February 2018

Tonight:
● Introductions
● AWS Services: AWS - Mitch Beaumont
“Amazon Fargate”
● Session 1: Paloalto Networks - Mauricio Sabena
“Automated Security Management on AWS”
● Break – Networking, Beers & Pizza
● Session 2: Kloud - Bobbie Couhbor
“Automating the Service Desk using Amazon Lex and Amazon Connect”
● Close
Networking & Prize Draw - Win an Amazon Dot and also a Beats Pill + Speaker.

AWS Services:
Mitch Beaumont
Enterprise Solutions Architect at Amazon Web Services
“AWS Fargate in 15 minutes!”

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Fargate in 15
minutes!
M i t c h B e a u m o n t , S o l u t i o n s A r c h i t e c t , A W S .
F e b r u a r y 7 , 2 0 1 7

No instances
to manage
Task
native API
Resource
based pricing
Simple, easy to use,
powerful – and new
consumption model
=
What is AWS Fargate?

FARGATE: UNDER THE HOOD

FARGATE USE CASES

MICROSERVICES

BATCH JOBS

MIGRATION TO THE CLOUD

HOW DO I RUN
CONTAINERS
ON FARGATE?

RUNNING CONTAINER

EC2 Instance
TaskTask
Task Task
EC2 Instance
TaskTask
Task Task
EC2 Instance
TaskTask
Task Task
EC2 Instance
TaskTask
Task Task
EC2 Instance
TaskTask
Task Task
RUNNING CONTAINERS

RUNNING CONTAINERS AT SCALE WITH ECS
Availability Zone #1 Availability Zone #2 Availability Zone #3

Scheduling and Orchestration
Cluster Manager Placement Engine
RUNNING CONTAINERS AT SCALE WITH ECS

ECS
AMI
Docker
agent
ECS
agent
ECSTaskECSTask
ECSTaskECSTask
EC2 Instance

ECS
AMI
Docker
agent
ECS
agent
EC2 Instance
ECS
AMI
Docker
agent
ECS
agent
EC2 Instance
ECS
AMI
Docker
agent
ECS
agent
EC2 Instance

RUNNING FARGATE CONTAINERS WITH ECS

RUNNING FARGATE CONTAINERS WITH ECS
Use ECS APIs to launch Fargate Containers
Easy migration – Run Fargate and EC2 launch
type tasks in the same cluster
Same Task Definition schema

NETWORKING

NETWORKING WITH FARGATE IN ECS
Internet
Gateway
172.31.0.0/16

Internet
Gateway
172.31.0.0/16
Subnet 1
Fargate
Task
Public IP
54.191.135.66
172.31.1.0/24
ENI

Internet
Gateway
172.31.0.0/16
Subnet 1
Fargate
Task
Public IP
54.191.135.66
172.31.1.0/24
ENI
Subnet 2
Fargate
Task
172.31.2.0/24
ENI

Internet
Gateway
172.31.0.0/16
Subnet 3
Fargate
Task
Public IP
54.191.135.69
172.31.3.0/24
ENI
Subnet 1
Fargate
Task
Public IP
54.191.135.66
172.31.1.0/24
ENI
Subnet 2
Fargate
Task
172.31.2.0/24
ENI

Internet
Gateway
172.31.0.0/16
Subnet 3
Fargate
Task
Public IP
54.191.135.69
172.31.3.0/24
ENI
Subnet 1
Fargate
Task
Public IP
54.191.135.66
172.31.1.0/24
ENI
Subnet 2
Fargate
Task
172.31.2.0/24
ENI
• AWS VPC Networking Mode – each task gets its own interface
• Full control of network access via Security Groups and Network ACLs
• Public IP support

LOAD BALANCING
APPLICATION LOAD BALANCER
NETWORK LOAD BALANCER

SECURITY

CLUSTER LEVEL ISOLATION
Web Web
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb
Shopping
Cart NotificationsWeb
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb Web
PROD CLUSTER BETA CLUSTER
DEV CLUSTER QA CLUSTER

CLUSTER LEVEL ISOLATION
PROD Cluster Infrastructure
DEV Cluster Infrastructure
BETA Cluster Infrastructure
QA Cluster Infrastructure
Web Web
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb
Shopping
Cart NotificationsWeb
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb Web
PROD CLUSTER BETA CLUSTER
DEV CLUSTER QA CLUSTER

PERMISSION TIERS
Cluster
Permissions
Application
Permissions
Task
Housekeeping
Permissions
Cluster
Fargate Task
Cluster Permissions:
Who can run/see tasks in the cluster?
Application (Task) Permissions:
Which of my AWS resources can this application access?
Housekeeping Permissions:
What permissions do I want to grant ECS to perform?
e.g.
• ECR Image Pull
• CloudWatch logs pushing
• ENI creation
• Register/Deregister targets into ELB

CONTAINER REGISTRIES

REGISTRY SUPPORT
3rd Party Private Repositories (coming soon!)
Public Repositories supported
Amazon Elastic Container Registry (ECR)

VISIBILITY AND MONITORING
Service-level metrics available
CloudWatch Logs
CloudWatch Events supported

STORAGE
Container Storage Space – 10GB
Ephemeral storage backed by EBS
Shared volume space for containers within the
task – 4GB

CONFIGURATIONS & PRICING

PRICING DIMENSIONS
{
"memory": “1 vCPU”,
"cpu": “3GB”,
"networkMode": ”AWSVPC",
"compatibilities": [”FARGATE",
”EC2"],
"placementConstraints": [],
"containerDefinitions": [
{
<snip>…....
Task level resources
• Configurable independently (within a range)
Dimensions: Task level CPU and memory
Per-second billing

TASK CPU & MEMORY CONFIGURATIONS
Flexible configuration options –
50 CPU/memory configurations
CPU Memory
256 (.25 vCPU) 512MB, 1GB, 2GB
512 (.5 vCPU) 1GB, 2GB, 3GB, 4GB
1024 (1 vCPU) 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB
2048 (2 vCPU) Between 4GB and 16GB in 1GB increments
4096 (4 vCPU) Between 8GB and 30GB in 1GB increments

ECS Instance ECS Instance ECS Instance ECS InstanceECS Instance ECS Instance
EC2
FARGATE
Notifications
Amazon ECS CLUSTER
Subnet 2
172.31.2.0/24
Subnet 1
172.31.1.0/24
Subnet 3
172.31.3.0/24
Web
Shopping
Cart

DEMO TIME

EKS SUPPORT FOR FARGATE IN 2018

Introduction to AWS Fargate
Fargate Deep Dive

THANK YOU
https://aws.amazon.com/fargate

Session 1:
Mauricio Sabena
System Engineering Manager ANZ North for Palo Alto
Networks where he leads the engineering team to drive
security solutions to address customers business challenges
across enterprise and government.
“AUTOMATED SECURITY MANAGEMENT ON AWS”

AUTOMATED
SECURITY
MANAGEMENT
ON AWS
Mauricio Sabena – Systems Engineer Manager

AgendaPAN/AWS
2 | © 2015, Palo Alto Networks. Confidential and Proprietary.
- Securing AWS and public cloud workloads
- Automation
- Q&A

DATA AND APPLICATIONS ARE EVERYWHERE
SAASPRIVATE
PHYSICAL
IAAS PAAS

SECURING THE CLOUD IS HARD
Fragmented
Security
Human
Error
Manual
Security

WHAT’S NEEDED
Frictionless
Deployment &
Management
Advanced
Application & Data
Breach Prevention
Consistent
Protections Across
Locations

WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
CRITICAL CLOUD PROTECTIONS
INLINE
Protect and
Segment Cloud
Workloads
API
HOST
Secure OS
& App Within
Workloads
API
Continuous
Security &
ComplianceOn-Premises
Cloud Application

3. INLINE SECURITY1. ACCOUNT MGMT
• Segmentation
• Malware Prevention
• Secure Access
• VPC Edge Security
• Key rotation
• Inbound Accessible
Services
• Unencrypted storage
• Nonstandard AMI’s
• Password Policy
2. DATA GOVERNANCE
• Exposed Data
• Keys stored in the open
• Admin Access
API
Aperture
CRITICAL CLOUD PROTECTIONS

344 KB
172.16.1.10
source IP
64.81.2.23
destination IP
TCP/443
destination port
Security Groups/NACLs vs Dedicated:
Control & Visibility

344 KB
mjacobsen
user
canada
destination country
172.16.1.10
source IP
64.81.2.23
destination IP
TCP/443
destination port
SSL
protocol

344 KB file-sharing
URL category
PowerPoint
file type
“Confidential and Proprietary”
content
mjacobsen
user
prodmgmt
group
canada
destination country
172.16.1.10
source IP
64.81.2.23
destination IP
TCP/443
destination port
SSL
protocol
HTTP
protocol
slideshare
application
slideshare-uploading
application function

PLATFORM AUTOMATION
URL
Filtering
CLOUD-
DELIVERED
SECURITY
SERVICES
WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
API
3rd
party
feeds
Customer
data
Amazon
GuardDuty
MineMeld
Threat
Prevention
Malware
Analysis

Dynamic Address Groups – “commitless”
14

Terraform
• Automatic deployment and configuration with Vagrant
• Overlaps
• Using bootstrapping (S3 region restrictions etc.)
• NEW: Terraform provider
• 1 product
• No bootstrapping
• No restriction

Terraform AWS
# Declare the data source
#data "aws_availability_zones" "available" {}
/* EXTERNAL NETWORG , IG, ROUTE TABLE */
resource "aws_internet_gateway" "gw" {
vpc_id = "${aws_vpc.main.id}"
tags {
Name = "internet gw terraform generated"
}
}
resource "aws_network_acl" "all" {
egress {
protocol = "-1"
rule_no = 2
action = "allow"
cidr_block = "0.0.0.0/0"
from_port = 0
to_port = 0
}
ingress {
protocol = "-1"
rule_no = 1
action = "allow"
cidr_block = "0.0.0.0/0"
}
name = "FirewallBootstrapInstanceProfile2Tier"
role = "${aws_iam_role.FirewallBootstrapRole2Tier.name}"
path = "/"
}
resource "aws_subnet" "NewPublicSubnet" {
cidr_block = "${var.PublicCIDR_Block}"
availability_zone = "${data.aws_availability_zones.available.names[0]}"
#map_public_ip_on_launch = true
tags {
"Application" = "${var.StackName}"
"Name" = "${join("", list(var.StackName, "NewPublicSubnet"))}"
}
}

resource "panos_security_policies" "security_policies" {
rule {
name = "SSH inbound"
source_zones = ["${panos_zone.zone_untrust.name}"]
source_addresses = ["any"]
source_users = ["any"]
hip_profiles = ["any"]
destination_zones = ["${panos_zone.zone_trust.name}"]
destination_addresses = ["any"]
applications = ["ssh", "ping"]
services = ["application-default"]
categories = ["any"]
action = "allow"
}
rule {
name = "SSH 221-222 inbound"
source_zones = ["${panos_zone.zone_untrust.name}"]
source_addresses = ["any"]
source_users = ["any"]
hip_profiles = ["any"]
destination_zones = ["${panos_zone.zone_trust.name}"]
destination_addresses = ["any"]
applications = ["ssh", "ping"]
services = ["${panos_service_object.so_221.name}",
"${panos_service_object.so_222.name}"]
categories = ["any"]
action = "allow"
}
provider "panos" {
hostname = "${var.ipaddress}"
username = "paloalto"
password = “booyah"
}
PAN Provider

Break & Networking:
• Refresh your drink
• Grab some pizza
• Make new contacts

Session 2:
Bobbie Couhbor
Cloud Infrastructure Consultant and Technology
and Solutions Advisor
“Automating the Service Desk using Amazon Lex and
Amazon Connect”

Automating the Service Desk with
Amazon Lex and Connect

•  Artificial Intelligence & automation will result in reduction of IT services
staff by 7-10% in India, US by 2022 – Economic Times
•  56,000 layoffs and counting: India’s IT bloodbath this year may just be the
start – Quartz India
•  India faces youth unemployment spike as automation threatens traditional
jobs – ABC
News Headlines

Democratisation of Artificial Intelligence
The democratisation of AI is the driving force behind automation across
industries, making AI capabilities available to every developer, as a service via
the cloud.
•  Amazon Comprehend
•  Amazon Lex
•  Amazon Rekognition
•  Amazon Polly
•  Amazon Transcribe
•  Amazon Translate

High Level Architecture
1.  User calls the service desk and asks for their password to be reset
2.  Amazon Lex manages conversational dialog and collects user verification information
3.  Amazon Lex passes the collected information to AWS Lambda
4.  AWS Lambda verifies the user with Active Directory
5.  Password is reset and sent to the user

{
"currentIntent": {
"slots": {
"DOB": "1983-04-14",
"MonthStarted": "April",
"UserID": "123456"
},
"confirmationStatus": "Confirmed",
"name": "ResetPW",
"slotDetails": {
"DOB": {
"originalValue": "fourteenth of april nineteen eighty three",
"resolutions": []
},
"MonthStarted": {
"originalValue": "April",
"resolutions": [
{
"value": "April"
}
]
},
"UserID": {
"originalValue": "one two three four five six",
"resolutions": []
}
}
},
"userId": "ijy54vlrxbg2uyjatb6ey6m8jbaqz7vn",
"bot": {
"alias": "$LATEST",
"version": "$LATEST",
"name": "UserAdministration"
},
"inputTranscript": "yes",
"requestAttributes": None,
"invocationSource": "FulfillmentCodeHook",
"outputDialogMode": "Text",
"messageVersion": "1.0",
"sessionAttributes": {
"Completed": "confirmed"
}
}

Lambda function
1.  Get encrypted AD service account using KMS
2.  Perform secure LDAP bind
3.  Query AD for user attributes
4.  Compares AD and slot values
5.  If successful, resets password and
SMS to user otherwise exit

Final words…
•  Implementation guide:
https://blog.kloud.com.au/2018/01/23/replacing-the-service-desk-with-bots-
using-amazon-lex-and-amazon-connect-part-4/
•  Reach out to me!
LinkedIn: www.linkedin.com/in/bobbiecouhbor
Email: Bobbie.Couhbor@kloud.com.au
•  Questions?

Prize Draw:
Amazon Dot Beats Pill + Speaker
Sponsored by
Sponsored by

Thanks For Coming:
Join Us Next Month – March 7th 2018
>> Register @ http://www.meetup.com/AWS-Sydney/ <<
In the Meantime Keep In Touch
http://bit.ly/polarseven-webinars

Amazon Web Services User Group Sydney - February 2018

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Amazon Web Services User Group Sydney - February 2018

Similar to Amazon Web Services User Group Sydney - February 2018 (20)

More from PolarSeven Pty Ltd

More from PolarSeven Pty Ltd (20)

Recently uploaded

Recently uploaded (20)

Amazon Web Services User Group Sydney - February 2018