AWS Foundations Well Architected Framework and AWS Trusted Advisor Global Infrastructure Demo - Designing the network (VPC) for HA and FT VPC Network security

1. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Module 1 – Introduction to AWS
@AWS_UKI
@AWS_actus
#AWSomeDay

2. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Module 1 - Overview
Introduction to AWS
Well Architected Framework and Trusted Advisor
Hands on Demo – Trusted Advisor
Global Infrastructure
VPC Design and Security
Hands on Demo – Creating a HA/FT VPC

3. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.* As of 1 January 2017
2010
61
516
1,017
159
2012 2014 2016
AWS Pace of Innovation
AWS has been continually expanding its servicesto
support virtually any cloud workload, and it now has
more than 100 servicesthat range from compute,
storage, networking, database, analytics, application
services, deployment, management, developer,
mobile, Internet of Things (IoT), Artificial Intelligence
(AI), security, hybrid and enterprise applications.
Over 3000 features and services since 2006
1,430
2017

4. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Advantages and Benefits of AWS Cloud Computing
Trade capital expense for
variable expense.
Benefit from massive
economiesof scale.
Stop guessing capacity. Go global in minutes.
Increase speed and agility.
Stop spending money on
running and maintaining data
centers.

5. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
AWS Well Architected Framework
Performance
Efficiency
Cost
OptimizationSecurity Reliability
Operational
Excellence

6. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
AWS Trusted Advisor
Core Checks and Recommendations
Available to all AWS customers
Access to the six core Trusted Advisor checksto
help increase the security and performance of
your environment. Checksinclude:
Security: Security Groups - Specific Ports Unrestricted,
IAM Use, MFA on Root Account, EBS Public Snapshots,
RDS Public Snapshots
Service Limits
Full Trusted Advisor Benefits
Available with Business or Enterprise support plans
Access to the full set of Trusted Advisor
checks to help optimize your entire AWS
infrastructure, helping to increase security
and performance, reduce your overall costs,
and monitor service limits. Additional
benefits include:
Notifications: Stay up-to-date with your AWS
resource deployment with weekly updates, plus
create alerts and automate actions with
Programmatic access: Retrieve and refresh Trusted
Advisor results programmatically using AWS Support
API.

7. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Demo – Trusted Advisor

8. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
AWS Global Infrastructure
Regions ( 18 )
Availability Zones ( 54)
US East: N. Virginia (6), Ohio (3)
US West: N. California (3), Oregon (3)
AWS GovCloud (US-West) (3)
Asia Pacific
Mumbai (2), Seoul (2), Singapore (3), Sydney (3), Tokyo
(4), Osaka-Local (1)
Canada: Central (2)
China: Beijing (2), Ningxia (2)
Europe: Frankfurt (3), Ireland (3), London (3), Paris (3)
South America: São Paulo (3)
New Regions ( 4 coming soon )
New Availability Zones ( 12 coming soon )
Sweden
Bahrain
Hong Kong SAR, China
AWS GovCloud (US-East)

9. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Availability
Zone - A
Availability
Zone - B
Availability
Zone - C
Region
Distributed Architecture & Replicated Data
Distribute your application
architecture over multiple availability
zones to achieve high availability
and/or fault tolerance.
For example instead of 1 large EC2
server consider2 smaller servers in
differentAZ’s.
Typically the costof 2 small servers =
1 large server
Low latency and High bandwidth
connections betweenAZ’s

10. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
AWS Global Infrastructure – Edge Locations
More than 100 edge locations
Local points of presence that support certain AWS services:
AWS Shield
Amazon CloudFront
Amazon Route 53
AWS WAF

11. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
VPC network design (Virtual Private Cloud)
Subnet 1B Subnet 1C
Public RT Public RT
Subnet 1A
Public RT
Subnet 1A Subnet 1B Subnet 1C
Private RT Private RTPrivate RT
EC2 EC2
RDS RDS
Internet Gateway (IGW)
NAT Gateway
VPC Peering
VPN Gateway (VPG)
Direct Connect
Customer
Datacenter
VPC in Region – EU-WEST-1
VPC Default RT
Private RTPrivate RT

12. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
VPC Network Security
Subnet 1A
Subnet 1A
VPC in Region – EU-WEST-1
EC2
EC2
Security Group
Stateful port based firewall
Assigned to EC2
Multiple EC2’scan share the same security group
Can reference other security groups
Network Access Control List (NACL)
Assigned to subnet
Stateless port based firewall
User must write inbound and outbound rules
We can also turn on Flow logs for:
VPC
VPC Subnet
ENI (Elastic Network Interface)
Network traffic will be logged to CloudWatchfor storage
and analysis by your own applications or third-party
tools.
VPC Flow Logs and CloudWatchevents can be
analyzed with AWS GuardDuty

13. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
Demo – Creating a VPC

14. © 2018, Amazon Web Serv ices, Inc. or its Af f iliates. All rights reserv ed.
End of Module 1
@AWS_UKI
@AWS_actus
#AWSomeDay