With cloud maturity comes operational efficiencies and endless potential for innovation and business growth. However, the complexities of governing cloud infrastructure are impeding without the right strategy. Visibility, accountability, and actionable insights are some of the most invaluable considerations. The AWS cloud clearly enables convenience and cost savings for organizations that know how to leverage its full potential. Amazon EC2 Reserved Instances (RIs), in particular, present a tremendous opportunity when scaling to save significantly on capacity but there are many considerations to fully reaping the benefits of RIs. In this session, CloudCheckr CTO Patrick Gartlan will present issues that every organization runs into when scaling, provide best practices for how to combat them and help you show your boss how RIs help you save money and move faster. This session is brought to you by AWS Summit Chicago sponsor, CloudCheckr.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Patrick Gartlan, CTO, CloudCheckr
July 26, 2017
Keeping Pace with the Cloud
Managing and Optimizing as You Scale

2. What are critical elements of your cloud strategy?
Tagging strategy?
Reserved Instance strategy?
DevOps plan?
SSO implementation?
Auditing requirements?
Cost governance?
Security monitoring?
VPN / Direct Connect requirements?
Hybrid cloud setup?
Public & private network requirements?
Multi-factor authentication?

3. Dev/Testing
Load test
POC
App #1
App #2
Executive team
starts truly caring
Typical AWS growth

4. Having effective visibility
and control
Turning data into action to
maximize agility and
eliminate waste
Clarity and accountability
across all key stakeholders
Maintaining secure
configurations
Security state + activity
visibility across the IaaS attack
surface
Inability to rapidly assess
security & compliance posture
Mismanaged spend
without an actionable
way to track,
manage & optimize
Visibility across
an organization’s
multiple accounts
Managing cost
allocation
efficiently
Right sizing on
instances and being
notified of idle or
unused resources
Customer challenges

5. AWS and you share responsibility for security

6.  Configure Amazon VPCs securely
 Reduced attack surface with network ACLs
 Setup subnets/route tables
 Least privileges in security groups
 Set up ELB balancers/ALBs
 Set up VPC endpoints
 Don’t forget about resources not in VPCs
 Amazon SNS, Amazon SQS, DynamoDB
 Watch for VPC endpoints for these services
Controlling Access to Workload
Reduce attack surface; limit access to minimum ports and IPs necessary
Security & compliance – best practices

7.  First job for security is to inventory and discover what is running in the environment
 Can't run ping sweeps, IP scans against my networks
 Against the terms of service in AWS
 Works differently (how does ARP work, how do UDP packets responding, broadcast
packets, how do closed IPs/ports respond to packets)
 Using the AWS API for inventory
 The security holes are what you don't even know about
 Can I see what resources are running?
 Can I see who has access to what?
 Can I see what applications are running?
 Can I see what people are doing?
You can't protect what you can't see
Inventory/change monitoring – best practices

8. Monitor your deployments

9. 400+ best practice checks
• Amazon Redshift Cluster <1 GB of Free
Storage
• Amazon WorkSpaces with Unhealthy
State
• Amazon SES Domains with Failure Status
• DynamoDB System Errors
• EBS Volumes Without a Snapshot
• Amazon EC2 Errors in Console Output
• Amazon RDS Instance <10% Free
Storage
• AWS CloudFormation Stack with no
Policy
Availability (50+)
• Idle Elastic Load Balancing Balancers
• Unused Elastic IP Addresses
• ElastiCache Reserved Nodes Not Utilized
• Unused AMIs
• Amazon EC2 RI Types with Unused
Hours
• Excessive Costs for an Amazon Glacier
Restore
• RDS Reserved Instance Payment Failed
• Idle RDS DB Instances
Cost Management (100+)
• Amazon EBS Volumes with Excessive
Snapshots
• Elastic Load Balancers with HTTP Errors
• Over-Utilized RDS DB Instances
• Amazon Redshift Clusters in
Maintenance Mode
• Under-Utilized Amazon EC2 Instances
• Auto Scaling Groups Not Being Utilized
• Excessive Log Files
• Failed Activities in RDS Events
Utilization & Performance (70+)
• Root Access Has Access Keys
• Ineffective Network ACL Deny Rule
• Regions Without AWS Config Enabled
• Amazon VPC Traffic Allowed from any IP
• Amazon S3 Public Sensitive Objects
Stored
• AWS CloudTrail Unauthorized Access
Attempts
• Publicly Accessible Amazon RDS Instances
• SNS Topic with Permission Set to All
Security & Compliance (160+)

10. Actionable
Insights
VPC
flowlogs
CloudWatch
CloudTrail
Detailed
billing
reports
API
calls
Server
access
logs
Goal: Simple integration into your processes & tools

11. OpEx Reduction Through AWS Visibility
Spend Optimization
Summary Reports:
• Daily
• Monthly
• 12-month Historic
Advanced Filtering for
Tags
Cost Allocation
• Budget Alerts
• Cost Warnings
• Asset Inventories
• Tracking
Consolidated Billing
• Generate Invoices for
Business Units and
Clients
• Customize invoices
• Unblended reporting
On average, CloudCheckr customers save over 30% on their monthly AWS bill
Cost optimization

12. Visualize your usage

13. The power of Reserved Instances

14. 10%
34%
47%
51%
73%
0
500,000
1,000,000
1,500,000
2,000,000
2,500,000
3,000,000
3,500,000
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
60.0%
70.0%
80.0%
90.0%
100.0%
AMAZON EC2 USAGE
Reserved Instance On Demand RI Coverage %

15. $.20 $.20 $.20 $.20 $.19 $.17 $.16 $.17
$.13 $.12
0%
3%
-3% -4%
-11%
-7%
10%
-23%
-7%
34%
47%
51%
73%
335,635
994,179
1,447,509
2,246,103
3,068,454
(1,800,000)
(800,000)
200,000
1,200,000
2,200,000
3,200,000
-30%
-10%
10%
30%
50%
70%
90%
AMAZON EC2 USAGE
Instance Hourly Cost Cost Change RI Coverage % Total Instance Hours

16. MSP Toolkit
Generate invoices
Provide chargebacks
Rerate bills
List price translation
Assign credits & discounts
Amortize costs
Uncompress pricing tiers
Analyze profitability
Analyze spending
Analyze savings
Analyze inventory
Analyze utilization
Purchasing recommendations
RI rebalancing & resizing
Targeted RI billing
Map RIs
Profit
Analytics
Amazon EC2
Reserved
Instances
Cost
Management

17. Cloud governance
Unify IT, security & finance teams
DevOps
Security
Cloud
Finance
VISIBILITY
INSIGHT
AUTOMATION

18. Try CloudCheckr free for 14 days
Questions?

19. Thank you!
Stop by Booth 500