Cloud computing is the on-demand delivery of compute power, database storage, applications, and other IT resources through a cloud services platform via the internet with pay-as-you-go pricing. In this presentation, we present the building components that enable developers and IT professionals, to implement World-Class, high resiliency applications. Designed to withstand disasters, and provide a highly resilient solution for IT workloads.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Global Capabilities of the AWS
Platform
Building for Resilience on AWS
July 2017

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global Infrastructure

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global Infrastructure: Regions

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global Infrastructure: Availability Zones
• Logically isolated
• Separate power
• Separate networking
• Geographic distance
• Connected by low-
latency links

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Availability Zones enable you to build your own
high-availability infrastructure
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Availability Zones enable you to build your own
high-availability infrastructure
Availability Zone Availability Zone Availability Zone
AWS region: eu-west-1
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions: Complete Isolation of Resources
• Shared-nothing
• Separate endpoints
• Data does not leave
the region
• AWS Regional
services are
themselves built using
AZs
Region 1
Region 2
Amazon
S3
Amazon
S3
Amazon
DynamoDB
Amazon
DynamoDB
AWS KMS
AWS KMS
…
…

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Your Virtual Data Center in AWS:
Virtual Private Cloud

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC Network
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC :
Your Infrastructure (EC2)
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1
EC2
instance
EC2
instance
EC2
instance

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC :
Your Infrastructure (EC2)
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1
EC2
instance
EC2
instance
EC2
instance
AutoScaling
Group

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC :
Your Infrastructure (EC2)
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1
EC2
instance
EC2
instance
EC2
instance
AutoScaling
Group

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC :
Building for Resilience and High Availability
Availability Zone Availability Zone Availability Zone
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1
AutoScaling
Group
Application Load Balancer

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regions, Availability Zones, and Your VPC :
AWS Services That Run In Your VPC
Availability Zone Availability Zone Availability Zone
eu-west-1a eu-west-1b eu-west-1c
AWS region: eu-west-1
Amazon RDS:
Master database instance
Amazon RDS:
Slave database instance
Non-exhaustive list of other AWS services that
can run in a VPC:
• Amazon Redshift (data warehouse)
• Amazon ElastiCache (redis/memcached)
• Amazon Elastic File System
• AWS Lambda functions
• ...

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regional AWS Services
AWS region: eu-west-1
Amazon
DynamoDB
Availability Zone Availability ZoneAvailability Zone
Regional AWS services are built, using
Availability Zones, to be highly available.
DNS name:
dynamodb.eu-west-1.amazonaws.com

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regional AWS Services
AWS region: eu-west-1
AWS Key Management
Service (KMS)
Availability Zone Availability ZoneAvailability Zone
Regional AWS services are built, using
Availability Zones, to be highly available.
DNS name:
kms.eu-west-1.amazonaws.com

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Regional AWS Services
AWS region: eu-west-1
Amazon
S3
Availability Zone Availability ZoneAvailability Zone
Regional AWS services are built, using
Availability Zones, to be highly available.
DNS name:
s3.eu-west-1.amazonaws.com
VPC Endpoint for S3

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Serverless is Regional
AWS region: eu-west-1
Amazon API Gateway
AWS Lambda
Running Lambda Functions
Regional AWS services are built, using
Availability Zones, to be highly available.

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Build for Global Reach on AWS: CloudFront CDN
Region 1
Availability Zone
S3 bucket
Availability Zone
Amazon
CloudFront
edge
location
edge
location
edge
location
edge
location
edge
location
edge
location

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Build for Global Reach on AWS: Route53 DNS
Region 1
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
S3 bucket S3 bucket
Availability Zone
Region 2
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
Availability Zone
Amazon
Route 53

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Build for Global Reach on AWS: Route53 DNS
Region 1
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
S3 bucket S3 bucket
Availability Zone
Region 2
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
Availability Zone
Amazon
Route 53

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Build for Global Reach on AWS: Route53 DNS
Region 1
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
S3 bucket S3 bucket
Availability Zone
Region 2
Availability Zone
RDS DB
instance
RDS DB
instancestandby
(multi-AZ)
Availability Zone
Amazon
Route 53

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Way: Repeatable, testable
configurations

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in a Data Center
Production

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in a Data Center
Production Test
?
?
?

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in AWS
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load BalancerAWS CloudFormation
Production
Template
(YAML or JSON)
Stack
Recommendation:
Define all AWS infrastructure
in CloudFormation templates.

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in AWS
AWS CloudFormation
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Test
Template
(YAML or JSON)
Stack
Recommendation:
Define all AWS infrastructure
in CloudFormation templates.

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in AWS
AWS CloudFormation
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Test
Template
(YAML or JSON)
Stack
Recommendation:
Define all AWS infrastructure
in CloudFormation templates.

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Provisioning in AWS
AWS CloudFormation
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Test
Template
(YAML or JSON)
Stack
Recommendation:
Define all AWS infrastructure
in CloudFormation templates.

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Way: Stop Guessing Capacity

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Guessing Capacity in a Data Center

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Guessing Capacity in a Data Center

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load BalancerAWS CloudFormation
Scale Test
Template
(YAML or JSON)
Stack

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Scale Test
Amazon CloudWatch
Example: CloudWatch EC2 monitoring.

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS: Vertical scaling
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Scale Test
AWS CloudFormation
Template
(YAML or JSON)
CloudFormation
Change Set

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS: Horizontal scaling
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Scale Test
Amazon CloudWatch
Auto Scaling Group
Auto Scaling Action
Automated action

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS: Horizontal scaling
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
Scale Test
Amazon CloudWatch
Auto Scaling Group
Auto Scaling Action

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Getting Capacity Right in AWS With Serverless
AWS region: eu-west-1
Amazon API Gateway
AWS Lambda
Running Lambda Functions

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Way: Visibility

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility Challenges in a Data Center

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility Challenges in a Data Center
?

43. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility Challenges in a Data Center
?
?
?

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Inventory of Resources With AWS
Config
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
AWS
Config
{
configurationItems: [
“configuration”: {
“dbInstanceIdentifier: “myDB”,
…

45. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Continuous Compliance Checks
With AWS Config Rules
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
AWS
Config
AWS
Config
Rule
• AWS-defined rules
• Custom rules

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Audit Changes to Your
Environment with AWS Cloud Trail
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
{
“eventTime”: “2017-07-20T12:00:00Z”,
“eventSource”: “s3.amazonaws.com”,
“eventName”: “DeleteBucket”,
“awsRegion”: “eu-west-1”,
“userIdentity”: …
“sourceIPAddress”: …
AWS
CloudTrail

47. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Take Automated Actions in Your
Environment with AWS Cloud Trail + AWS Lambda
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
AWS
CloudTrail
Lambda
function

48. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Understand Your Network Traffic
With VPC Flow Logs
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
VPC Flow
Logs
Amazon
CloudWatch
Logs
2 683052973665 eni-0ddefd4d 192.168.0.165 10.10.20.66 51514 22 6 40 5543
1492204449 1492204506 ACCEPT OK
2 683052973665 eni-0ddefd4d 185.110.132.232 192.168.0.165 48756 80 6 1 40
1492620413 1492620467 REJECT OK

49. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility in AWS: Access to InfoSec Roles
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
AWS region: eu-west-1
Application Load Balancer
InfoSec Account
IAM Role for InfoSec
Human users
Automated Security
Tasks

50. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Wrap-Up / Q&A / Thank You!