This document discusses strategies for higher education institutions migrating to the cloud. It outlines a typical journey from initial projects to full migration and references case studies of schools that have adopted AWS cloud services. Key challenges addressed include managing workloads, ensuring security and compliance, and developing cloud-native applications to take advantage of scalable infrastructure.

1. © 2019, Amazon Web Services, Inc. or its Affiliates.
Dickson Yue
Manager, Solutions Architecture
27 July 2019
Cloud adoption of
Higher Education Institutions
Trends and Challenges

2. “typical” journey to Cloud
TIME
VALUE
PROJECT FOUNDATION MIGRATION

3. “typical” journey to Cloud
TIME
VALUE
PROJECT FOUNDATION MIGRATION

4. “typical” journey to Cloud
TIME
VALUE
PROJECT

5. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Digital workload
User experience uplifting, cost savings, redundancy, reliability,
and a better disaster recovery posture

6. © 2019, Amazon Web Services, Inc. or its Affiliates.
Idaho State University
Migrated Mission-
Critical Academic and
Administrative Systems
to the Cloud

7. © 2019, Amazon Web Services, Inc. or its Affiliates.

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
“It’s about innovation and
ensuring our graduates are
equipped to play a leadership role
as voice-enabled technology
becomes part of everyday life.”
– Kyle Squires, Dean
New engineering dorm
equipped with 1,600 Echo Dots
for freshmen
Arizona State University
Courtesy of Arizona State University.

9. © 2019, Amazon Web Services, Inc. or its Affiliates.

10. © 2019, Amazon Web Services, Inc. or its Affiliates.

11. © 2019, Amazon Web Services, Inc. or its Affiliates.

12. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Education & Research
resource
Machine learning, Robotic simulation, HPC, Virtual lab

13. © 2019, Amazon Web Services, Inc. or its Affiliates.
Virtual lab with Amazon WorkSpaces

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
“We can rethink how we
teach with Amazon WorkSpaces.
We can offer more to students –
more interesting class content
and more interactivity – without
adding complexity for
instructors.
The sky is the limit.”
- Jeff Christen
Instructor
Courtesy of Cornell University.
Cornell University

15. © 2019, Amazon Web Services, Inc. or its Affiliates.
Development Environment SimulationCloud Extensions for ROS Fleet Management
AWS RoboMaker for Higher Education
A service that makes it easy for developing, simulating, and deploying robots with AWS
services to provide robot capabilities and a ready-to-use Cloud IDE

16. © 2019, Amazon Web Services, Inc. or its Affiliates.

17. © 2019, Amazon Web Services, Inc. or its Affiliates.

18. © 2019, Amazon Web Services, Inc. or its Affiliates.
U.C. Berkeley Researchers Uses AWS to Look At More Accurate
Data, Faster
• The AMP Lab is a multidisciplinary
research effort at the University of
California, Berkeley aimed at building
scalable machine learning and data
analysis technology
• Needed to be able to scale compute
resources quickly to analyze algorithms
that are used in genomics work
• Researchers are able to easily scale
Amazon EC2 instances simultaneously
to process genome data faster and
more cost effectively
We’re able to solve real world
problems because AWS gives us
access to real world resources
Michael Franklin
Director, AMP Lab
”
“

19. © 2019, Amazon Web Services, Inc. or its Affiliates.

20. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Question:
If there is infinite compute & storage
available and disposable
what problems would you solve?

21. “typical” journey to Cloud
TIME
VALUE
PROJECT

22. “typical” journey to Cloud
TIME
VALUE
PROJECT
PROJECT
PROJECT
PROJECT
PROJECT

23. “typical” journey to Cloud
TIME
VALUE
PROJECT FOUNDATION

24. © 2019, Amazon Web Services, Inc. or its Affiliates.
Start Accounts Network Security
Identity &
Access
Cloud
Users
What’s
Next ?
• Account Goverance
• Identify/Access
• Network Design
• Security/Visibility
• Shared Service
• Automation/Change
• …….

25. © 2019, Amazon Web Services, Inc. or its Affiliates.
Domains Direct
Connect
Start Accounts
End User
Interaction
AutomationService
Catalog
Central
Services
Migrate
Iterate
Operate &
Optimize
Logging Audit
trail
Access Identities Federation
Network Security
Identity &
Access
Cloud
Users
What’s
Next ?
Golden
image
Cloud Journey

26. © 2019, Amazon Web Services, Inc. or its Affiliates.
Why one account isn’t enough
Billing
Many Teams
Security / Compliance
Controls
Business Process
Isolation

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Team Shared
Services
Developer Accounts Data Center
Orgs: Account management
Log Archive: Security logs
Security: security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct Connect
Dev Sandbox: Experiments, Learning
Dev: Development
Pre-Prod: Staging
Prod: Production
Team SS: Team Shared Services, Data Lake

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Team Shared
Services
Developer Accounts Data Center
Orgs: Account management
Log Archive: Security logs
Security: security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct Connect
Dev Sandbox: Experiments, Learning
Dev: Development
Pre-Prod: Staging
Prod: Production
Team SS: Team Shared Services, Data Lake

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Multi-account approach
Developer
Sandbox
Dev Pre-Prod
Team/Group Accounts
Security
Core Accounts
AWS Organizations
Shared
Services
Network
Log Archive Prod
Team Shared
Services
Developer Accounts Data Center
Orgs: Account management
Log Archive: Security logs
Security: security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: Direct Connect
Dev Sandbox: Experiments, Learning
Dev: Development
Pre-Prod: Staging
Prod: Production
Team SS: Team Shared Services, Data Lake

30. © 2019 Amazon Web Services. All rights reserved.
JUCC DX Architecture
HK VPC1
CUHK
HKU
JUCC
MEGA-I HK
AWS Cloud
AWS HK
POP port
JUCC AWS Direct
Connect
CUHK AWS Direct
Connect Gateway
HKU AWS Direct
Connect Gateway
CUHK AWS ACCOUNT
HK VPC
HKU AWS ACCOUNT
HK VPC2
OTHER
REGION
VPC
BlackBoard, ServiceNOW, S3 + public AWS IPs
Cross
Connect
JUCC AWS ACCOUNT
Other
Users
Network Design

31. © 2019, Amazon Web Services, Inc. or its Affiliates.
AWS Automated
Landing Zone

32. © 2019, Amazon Web Services, Inc. or its Affiliates.
Account Governance Network DesignIdentity / Access
 Scalable cloud adoption
model based on
Organizational Hierarchies
 Security Policies for groups of
accounts / OUs
Services and APIs Blacklisted
vs Whitelisted (cannot be overridden
by local admins)
 Centralized billing
management
 Extensible code-driven policy
security baseline.
 Single Sign-On
 Security Baseline with Job /
Function cross-account roles
 Easy to integrate with
corporate or 3rd party
identity solutions (OpenID,
SAML)
 Extensible code-driven
authorization security
baseline.
 Standard Network
Architecture Patterns
 AWS Hybrid Network
Architecture best practices
AWS Public and Internal DNS
design for automated
governance
 Extensible for On-Premise
multiple facilities.
AWS Organizations AWS Single
Sign-On
AWS VPC AWS Route53
AWS Transit Gateway
AWS VPN
AWS Directory
Service
AWS IAMAWS Config

33. © 2019, Amazon Web Services, Inc. or its Affiliates.
Security / Visibility Automation / ChangeShared Services
 Threat detection based on
AI/ML with AWS GuardDuty
 Continuous Compliance
based on automated
compliance rules
 Centralized Logs archive for
auditing
 Security Events Notifications
 Extensible Automated Policies
Security Baseline
 Centralized Account for
Sharing Services (Analytics,
antivirus consoles, code
repos)
 Optional Centralized Logging
Add-On Solution
 Optional Centralized
Directory Services for SSO
 Landing Zone 100% Code for
Automated Governance
 Extensible templates based
on CloudFormation
 Supports Service catalog
extensibility for future
patterns
 Supports new Add-Ons to
extend ALZ
AWS
GuarDuty
AWS
Cloudwatch
AWS
CloudFormation
AWS
Lambda
AWS System
Manager
AWS Service
Catalog
AWS Directory
Service
AWS
ElasticSearch
AWS
Config
AWS
Cloudtrail

34. © 2019, Amazon Web Services, Inc. or its Affiliates.
Connect ServiceNow to AWS Services
ServiceNow users browse
and request AWS services
Catalog administrators procure,
publish, and govern AWS services
Operators monitor and manage
AWS services
Amazon CloudWatch
AWS Config
AWS resource info and event triggers are
published to ServiceNow incident management
1 2 3
4
Amazon SNS
Amazon EC2 Amazon S3 Amazon RDS Amazon VPC
Amazon
EMR
Amazon
SQS
Amazon
Machine
Learning
AWS Mobile
Hub
AWS IoT Amazon
WorkSpaces

35. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Workshops :
Enterprise Governance: Build
Your AWS Landing Zone
(Workshop)

36. “typical” journey to Cloud
TIME
VALUE
PROJECT FOUNDATION MIGRATION

37. © 2019, Amazon Web Services, Inc. or its Affiliates.
Migration Strategies for a 100 applications
Strategy # App
? ?
? ?
? ?
? ?
? ?
? ?
Total 100

38. © 2019, Amazon Web Services, Inc. or its Affiliates.
Comparing Cloud Migration Strategies
Strategy Time Cost Business Value # App
Retain N/A 20
Retire N/A 5
Relocate
vmware to VMC
10
Re-host
any to AWS EC2
10
Re-platform
NGNIX to ALB, DB to AWS RDS
20
Re-purchase
SaaS
5
Re-architect
Cloud native
30
Low
High
MigrationComplexity

39. © 2019, Amazon Web Services, Inc. or its Affiliates.
Pilot
Migration heat map
Easy to migrate
High business value
Low business value
Hard to migrate

40. © 2019, Amazon Web Services, Inc. or its Affiliates.
Migration planning
Disconnected and incomplete data Discover and organize data 7 Rs
Applications
Performance
Infrastructure
Automation
and guidance
AWS Application
Discovery Service
Amazon Athena
Level
of
effort
Retire
Retain
Relocate
Rehost
Repurchase
Re-platform
Refactor
Tribal knowledge
SLA/OLA
App configuration data
Asset inventories
CMDB
Architecture
Performance Information

41. © 2019, Amazon Web Services, Inc. or its Affiliates.
Agile application migration methodology
Agile Migration Factory
AWSMigrationProcess
AWSCloudAdoptionFramework(CAF)
Operate &
Optimise
Application
s
Initiation
Application Analysis
Design
Sprint 0 Sprint 2 Sprint 3Sprint 1
Application
Portfolio
Discovery
Application
Portfolio
Discovery
Application
Portfolio
Discovery
Migrate
Integrate
Validate
Application Analysis
Design
Migrate
Integrate
Validate
Application Analysis
Design
Migrate
Integrate
Validate
Operate Operate
Application Portfolio Discovery
Until Complete
Application Analysis
Until Complete
Design
Until Complete
Migrate
Until Complete
Integrate
Until Complete
Validate
Until Complete
Sprint 4+
Operate
Post Sprints
Continuous
feedback
into the
Migration
Factory
1st batch 2nd batch 3rd batch 4th batch

42. How does you cloud journey looks like?
TIME
VALUE
PROJECT FOUNDATION MIGRATION