This session covers best practices, features, and capabilities that users of Microsoft products can leverage in AWS. We emphasize Windows Server, Microsoft SQL Server, Active Directory, and .NET capabilities available and deeply integrated in AWS. With these learnings, you can extend the value of your Microsoft investments, lower total cost of ownership (TCO), and keep users working in familiar environments.

1. S U M M I T
Hong Kong

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Best Practices for Running
Windows Workloads on AWS
Rebeker Choi
Manager, Solutions Architecture
Amazon Web Services

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What to expect from today’s session
• Deploying Microsoft Directory
• 4 Rs’ migration pattern of your windows
workload (Re-host / Re-platform / Re-
architect / Re-purchase)
• Summary

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Windows momentum on AWS
10
Years
Helping customers run and scale
Windows Workloads in the cloud
400%
Growth
Between 2015 and 2018 of AWS
enterprise customers using Amazon
Elastic Compute Cloud (Amazon EC2) for
Windows Server

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Optimizing costs and performance with Windows,
Intel and AWS
• Over 57% of all Windows deployments in the cloud run on AWS, almost 2X over the closest provider
• AWS has over 10 years of experience running Windows applications
• AWS offers the broadest family of instances
• General purpose, compute and memory optimized
• Packaged, custom AMI’s
• Multiple pricing models
• Maximum performance with optimized instances
• High memory – Largest SAP certified in-memory instances
• Z1d – fastest compute with Intel Xeon Scalable processor for design automation

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Instance Types and Intel Technologies
WS Instance Type
High Memory
instances (6 TB, 9
TB, 12 TB)
Memory
Optimized z1d
Compute
Optimized
C5n
General
Purpose M5
Memory
Optimized
Burstable
I/O
Optimized
GPU GPU
Comput
e P3
Memory
Optimized X1e
R5 T3 I3 G3
Intel® processor
Intel® Xeon® Platinum
8176M
Intel® Xeon® Scalable
Processors
3.0 GHz Intel
Xeon Platinum
8000
Intel® Xeon®
Platinum 8175M
series processors
Intel® Xeon®
Platinum 8000
Series
Intel® Xeon®
Scalable Pro
cessors
Intel E5-2686
v4 processor
Intel Xeon E5-
2686 v4
processors
Intel® Xeo
n® E5-
2686 v4
Intel® Xeon® E7
8880 processors
Intel® process
technology
Skylake 14nm Skylake-SP Skylake Skylake 14nm Skylake-SP Yes
22nm Ivy
Bridge
14nm
Broadwell
14nm
Broadwell
22nm Haswell
Intel® AVX AVX-512 AVX-512 AVX-512 AVX-512 AVX-512 AVX-512 Yes Yes Yes AVX 2.0
Intel® AES-NI Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Intel® TSX - - - - - - - - - Yes
Intel® Turbo Boost Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
SSDC+1 - - - - - - - - - Y

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
TODAY: migrate individual servers FUTURE: migrate all servers as a single
app
Migrate your applications not just servers
Database Applicatio
n
Frontend

8. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Private subnet
VPC
AD Pattern – Option 1
Extending Active Directory Domain to AWS
Existing Active Directory domain extended to AWS; new Active Directory sites configured in each AZ; domain controllers on Amazon Elastic
Compute Cloud (Amazon EC2) Windows servers; site-link costs correctly configured; and “try next closest site” configured
VPN/DX
AD Replication
DC3
AD Domain:amazon.com
AZ1: AwsEastAZ1
DC4
AD Domain:amazon.com
AZ2: AwsEastAZ2
Cost 10
Cost 50
San Francisco
AD Domain: amazon.com
AD Site: SanFran
DC1
New York Corporate Network
AD Domain: amazon.com
AD Site: New York
DC2
Cost 100
Cost 100
Cost 100
Cost 100
Availability Zone 1 Availability Zone 2
Private subnet
Properly implemented site topology and “Try Next Closest Site” policy enabled. Clients use least cost path to DC.

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What AWS Managed Microsoft AD Is
AWS managed, actual Microsoft Active Directory
Windows 2012 R2 domain controllers (DC)
• ~3-click setup from directory service console
or script through API
• 2 DCs each in separate Availability Zones (AZs)
• Scale-out with additional DCs
• Amazon manages multi-AZ deployment, patching,
monitoring, DC snapshot and recovery, restore
• Compliance audited
Auth/
LDAP
App
Server
IIS
Server
AWS Managed
Services
AWS Managed
Microsoft AD
Auth/
LDAP
App
Server
IIS
Server
AWS Managed
Services
AWS Managed
Microsoft AD
EC2 EC2
EC2 EC2
VPC
Private subnet
Private subnet
Availability Zone 1
Availability Zone 2

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AD Pattern – Option 2
AWS Managed
Microsoft AD
Domain join & manage
(example.cloud)
https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/
Amazon EC2
.NET Apps SharePoint SQL Server
AWS Cloud
Managed Microsoft AD as Primary Directory
Administer
users & groups

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AD Pattern – Option 2
AWS Managed
Microsoft AD
Manage, authenticate,
& authorize
Domain join & manage
Administer
users & groups
(example.cloud)
https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/
Amazon
Connect
Amazon
WorkMail
Amazon
WorKSpaces
RDS for
SQL Server
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
Amazon EC2
.NET Apps SharePoint SQL Server
AWS Cloud
AD-aware Workloads
Managed Microsoft AD as Primary Directory

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AD Pattern – Option 2
AWS Managed
Microsoft AD
Manage, authenticate,
& authorize
Domain join & manage
Administer
users & groups
SAML
authenticate
Synchronize
users
AD FS
Server
AD FS
Azure AD
Connect Server
Federate
ADSync
SaaS Applications
Azure AD
(example.cloud)
https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/
Amazon
Connect
Amazon
WorkMail
Amazon
WorKSpaces
RDS for
SQL Server
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
Amazon EC2
.NET Apps SharePoint SQL Server
AWS Cloud
AD-aware Workloads
Managed Microsoft AD as Primary Directory

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AD Pattern – Option 3
AWS Managed
Microsoft AD
Manage, authenticate,
& authorize
Domain join & manage
Administer
users & groups
(example.cloud)
https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/
Amazon
Connect
Amazon
WorkMail
Amazon
WorKSpaces
RDS for
SQL Server
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
Amazon EC2
.NET Apps SharePoint SQL Server
AWS Cloud
AD-aware Workloads
Managed Microsoft AD as Resource Directory
On-premises
Microsoft AD
On-premises user
credentials
Corporate data center
(example.local)
• Separate directories, single identity
• Identity mastered on-premises,
separate AD Forest in AWS with Forest
Trust(s) configured
Direct Connect
or VPN

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AD Pattern – Option 3
AWS Managed
Microsoft AD
Manage, authenticate,
& authorize
Domain join & manage
Administer
users & groups
(example.cloud)
https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/
Amazon
Connect
Amazon
WorkMail
Amazon
WorKSpaces
RDS for
SQL Server
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
Amazon EC2
.NET Apps SharePoint SQL Server
AWS Cloud
AD-aware Workloads
Managed Microsoft AD as Resource Directory
On-premises
Microsoft AD
On-premises user
credentials
Corporate data center
SaaS Applications
Azure AD
AD FS
Server
Azure AD
Connect Server
Synchronize
users
SAML
authenticate
(example.local)
• Separate directories, single identity
• Identity mastered on-premises,
separate AD Forest in AWS with Forest
Trust(s) configured
Direct Connect
or VPN

16. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
6R’s of migration pattern
Redesign
Application/
Infrastructure Architecture
App Code
Development
Full ALM /
SDLC
Integration
Purchase COTS/
SaaS & licensing
Manual Install
& Setup
Modify underlying
Infrastructure
Determine
new platform
Retain /
Revisit
Manual Config
Manual Deploy
Manual Install
Retire /
Decommission
Discover/Assess/Prioritize
Applications
Determine
Migration
Path
Use Migration Tools
Transition ProductionValidation
Automate

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Re-host
a.k.a Lift & Shift - like for like
migration to the cloud
Pros:
• Usually the fastest
migration strategy
• No architectural
modifications
Cons:
• Miss some “cloudy” benefits
of target platform – both
technical and financial

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Rehost: EC2 Reference Architecture for Windows on
AWS
 Improved high availability
across multiple availability
zones
 Improved scalability &
performance
 Offload operation tasks to
AWS
 AWS deals with Microsoft
licenses
Benefits:
Private subnet
Private subnetPublic
subnet
Public
subnet
VPC
Availability zone
Virtual private
gateway
Corporate
office
Internet
gateway
AWS
Directory
Service
AWS
Directory
Service
IIS
IIS App
AppRDGW
RDGW
Availability Zone 2
Always
On
Availabil
ity
Group
SQL
App
Availability Zone 1

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Re-platform
a.k.a Lift-Tinker & Shift - like for
like migration to the cloud with
some modifications
Pros:
• Realize some benefits of
cloud platform
• Minimal architectural
modifications
Cons:
• Can be some rework
required

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Options for Deploying SQL Server on AWS
Amazon RDS for SQL Server SQL Server on Amazon EC2
Customer managedAWS managed
Power, HVAC, net
OS Install/Maintenance
OS Patching
DBMS Install/Maintenance
DBMS Patching
Database Backups
High Availability
Scaling
Power, HVAC, net
OS Install/Maintenance
OS Patching
DBMS Install/Maintenance
DBMS Patching
Database Backups
High Availability
Scaling
• Consider RDS first
• Focus on business
value tasks
• High-level tuning
asks
• Schema optimization
• No in-house
database expertise
• Need full control over
DB instance
• Backups
• Replication
• Clustering
• Options that are not
available in RDS

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Private subnet Private subnet
What does it look like after RDS is up?
10.1.1.0/24 10.1.2.0/24
Synchronous replication
Same
instance
type as
master
• Managed high availability
across multiple datacenters
• No application code change
• 60-120 seconds failover
time
• RPO = zero
Automatic failover
Synchronous replication
dbinstancename.1234567890.us-west-2.rds.amazonaws.com:3006
Application
VPC
Availability Zone Availability Zone

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Data Migration – SQL Server
Target Options Optimization
MS SQL Server
on EC2
Migration Pattern
Initial Data load
SQL Server
with Initial
Seed
AWS Snowball S3
Incremental changes
MS SQL Server
on EC2
MS SQL Server
Distributed Always On Availability
Group replication over Direct
Connect
MS SQL Server AWS DMS
Incremental changes
RDS
RDS
Optimized vCPUs
R4.4XL 16 8 50%
MS SQL
instance
Storage Optimization

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon FSx for Windows File Server
Native Windows
compatibility
Integrates with
Microsoft AD
and supports
Windows ACLs
AD
NTFS
Windows Server
Native SMB
2.0 to 3.1.1
SMB
Fully managed
Secure and
compliant
including PCI-DSS,
ISO, and HIPAA
Up to 10s of GB/s
throughput with
sub-millisecond
latencies

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Re-platform: AWS Managed Services for
Windows
Private subnet
Private subnetPublic
subnet
Public
subnet
VPC
Availability zone
Virtual private
gateway
Corporate
office
Internet
gateway
AWS
Directory
Service
AWS
Directory
Service
IIS
IIS App
AppRDGW
RDGW
Availability Zone 2
RDS for
MSSQL
(Multi-AZ
deployment)
 Improved high availability
across multiple availability
zones
 Improved scalability &
performance
 Offload operation tasks to
AWS
 AWS deals with Microsoft
licenses
Benefits:

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Re-architect
a.k.a Rewrite Application:
rearchitect application leveraging
cloud-native features and services
Pros:
• Realize full
potential of target
cloud platform
Cons:
• Requires the largest
investment and level of
effort to realize

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Lambda and Amazon ECS
AWS Lambda
• Supports C#
• function of application logic
• Run your code without managing servers
• Pay only for the compute time (duration in
response to an event/request)
Amazon ECS
• managed container orchestration service
• support Docker containers
• Placement strategies
• Auto-scaling
• Native integration with other AWS services
(load balancer, VPC, etc)

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Compute:
EC2
Three EC2 Instances:
= $10.44 / day
vs.
1042MB, HA, Bursts:
Scenario: 1,000,000 requests/day @ 200ms avg = 200,000,000ms / day
Compute:
Lambda
= $3.33 / day
c
4large
c
4large
c
4large
Re-architect: Serverless .NET Core on Lambda

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Frontend of the AWS Serverless architecture
• Expose Lambda functions as HTTP API
• Manages authentication, versioning, monitoringAmazon API Gateway
API Gateway
CloudFront S3 Bucket
S3://www.yourspa.com
GetSchedule()
UpdateSchedule()
AddEvent()
AWS Lambda
DynamoDB
Route 53
AWS
Re-architect: Serverless .NET Core on Lambda

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Re-purchase
a.k.a Replace-Drop & Shop:
replace application with
Software-as-a-Service platform
Pros:
• Minimize O&M going
forward
Cons:
• Lose Command &
Control

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Repurchase: Amazon WorkSpaces & Amazon
AppStream

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
App Migration Automation/Tools
Data Transfer
AWS Storage and
File Gateway
S3 Transfer
Acceleration
AWS Direct
Connect
Amazon Kinesis
Firehose
AWS Snowball &
Snowmobile
AWS Database
Migration Service
Server and Database
migrations
AWS Server
Migration Service
Application Monitoring /
Profiling
Amazon
CloudWatch
AWS Config
Discovery and planning
AWS Application
Discovery Service

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Summary
• Leverage what AWS has developed for you as much as possible
• For new applications, using a cloud-native approach is preferred
• Refactoring application is a journey. ”Rehost” as the 1st step of cloud
migration.

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Additional Resources
Microsoft on AWS
http://aws.amazon.com/windows/
AWS Windows and .NET Developer Center (with
sdk)
http://aws.amazon.com/net/
Amazon EC2 Windows Guide
http://docs.aws.amazon.com/AWSEC2/latest/Win
dowsGuide/
Microsoft Licensing on AWS
http://aws.amazon.com/windows/resources/licens
ing/
Windows Whitepaper
(http://aws.amazon.com/microsoft/whitepapers)
• Implementing Microsoft Windows Server
Failover Clustering and SQL Server AlwaysOn
Availability Groups in the AWS Cloud
• Implementing Active Directory Domain Services
on AWS
• Remote Desktop Gateway Reference
Architecture
• Secure Microsoft Applications on AWS

35. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Rebeker Choi
rebeker@amazon.com

36. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.