Customers are using VMware Cloud on AWS to accelerate cloud migrations, deploy hybrid architectures, and replace their disaster recovery environments. In this session, we dive deep into how VMware Cloud on AWS works and how integration with native AWS services can enrich architecture options. We also take look at the new Amazon RDS on VMware capability and what is coming with AWS Outposts.

1. P U B L I C S E C T O R
S U M M I T
WASHINGTON, D C

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Going further with VMware Cloud
on AWS: New Integration Options
with Native AWS Services
Haider Witwit
Solutions Architect, VMware Specialist
AWS/WWPS
3 0 2 9 0 9

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Agenda
A recap of VMware Cloud on AWS
SDDC networking foundation
How to build integration with native AWS services
Example use cases: Migration, DR, and Business Continuity
Extending Cloud to On-Premises: Outposts & RDS on VMware

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VMware Cloud on AWS overview

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Innovation jointly engineered by VMware and AWS
Connectivity
Direct Connect
High availability
and reliability
Stretch cluster
Security
vSAN encryption
with KMS
Storage
vSAN with instance
and EBS support
Integration
Private ENI access
to
AWS services

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Reminder… AWS Account structure for VMware Cloud on AWS
VMware Cloud
SDDC account
Is owned, operated, and paid directly by the customer
Private connectivity to VMware Cloud SDDC
Full access to the native AWS services
A new AWS account to run SDDC resources
Is owned, operated, and paid directly by VMware
Single tenant for all SDDC resources
AWS customer
owned account
VMware Cloud on AWS operates in a model whereby the VMware managed cloud offering operates in a separate AWS account
from a customer’s AWS account.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VMware Cloud SDDC Account
NSX
Management Gateway
(MGW)
Compute Gateway
(CGW)
NSX Tier-0
Router (T0)
Internet Gateway
Underlay vs Overlay Networks
vCenter Server
Appliance
NSX
Controller
Management Customer Workloads
VPC
NSX

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Subnet
SDDC to customer connected VPC
VPC
AWS Cloud
Subnet
EC2
Instances
EC2
Instances
ENI
Region
VPC
Customer Account VMware Account
192.168.1.0/24
192.168.2.0/24
T0
IGW
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
ESXi
VPC Network 10.1.0.0/16 (Underlay)VPC Network 10.2.0.0/16
Subnet1
10.2.1.0/24
Subnet1
10.2.2.0/24

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Connectivity to other VPCs & On-Premises
VPC1 VPC
192.168.1.0/24
192.168.2.0/24
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
VPC2
VPC3
10.10.0.0/16
10.20.0.0/16
10.30.0.0/16 VGW
VGW
Connected VPC
Compute
Storage
Network
vSphere-based
data center
On-Premises Data Center
AWS Direct
Connect
172.16.0.0/16
AWS Direct Connect
Private, dedicated network
connection with guaranteed
connectivity performance
Best suited for customers with
critical workloads that need
predictable throughput
ENI

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Connectivity to other VPCs & On-Premises
VPC1 VPC
192.168.1.0/24
192.168.2.0/24
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
VPC2
VPC3
10.10.0.0/16
10.20.0.0/16
10.30.0.0/16
Connected VPC
Compute
Storage
Network
vSphere-based
data center
On-Premises Data Center
AWS Direct
Connect
AWS Transit Gateway
172.16.0.0/16
BGP
ECMP
AWS Direct Connect
Private, dedicated network
connection with guaranteed
connectivity performance
Best suited for customers with
critical workloads that need
predictable throughput
ENI
ENI
ENI

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Services access models
Private
VPC Gateway Endpoints
VPC Interface Endpoints (PrivateLink powered)
Service endpoints within a customer managed VPC
Public
Direct access to public endpoints

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Services access models
Private
VPC Gateway Endpoints
VPC Interface Endpoints (PrivateLink powered)
Service endpoints within a customer managed VPC
Public
Direct access to public endpoints

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Services access models
Private
VPC Gateway Endpoints
VPC Interface Endpoints (PrivateLink powered)
Service endpoints within a customer managed VPC
Public
Direct access to public endpoints

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Subnet
Gateway Endpoints – S3
VPC
AWS Cloud
ENI
Region
VPC
Customer Account VMware Account
192.168.1.0/24
192.168.2.0/24
T0
IGW
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
ESXi
Amazon S3
Subnet
EC2
Instances

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VPC Gateway Endpoints
VPC Interface Endpoints (PrivateLink powered)
Service endpoints within a customer managed VPC
AWS Services access models
Public
Direct access to public endpoints
Private

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What services can be accessed using PrivateLink?
• AWS Services:
• Amazon CloudWatch Logs
• AWS CodeBuild
• Amazon EC2 API
• Elastic Load Balancing API
• AWS Key Management Service (AWS KMS)
• Amazon Kinesis Data Streams
• AWS Service Catalog
• Amazon Simple Notification Service (Amazon SNS)
• AWS Systems Manager
• And more…
• Endpoint services hosted by other AWS accounts
• Supported AWS Marketplace partner services

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS PrivateLink- AWS Systems Manager
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
10.2.0.0/16
VPC
AWS Cloud
Region
AWS Service Account VMware AccountCustomer Account
Amazon VPC PrivateLink
NLB
AWS Systems Manager
Amazon Route 53
VPC .2 resolver
Service provider Service consumer
Interface
endpoint
Route53
Resolver
10.2.1.11
10.2.2.11
ENI

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VPC Gateway Endpoints
VPC Interface Endpoints
Service endpoints within a customer managed VPC
Private
AWS Services access models
Public
Direct access to public endpoints

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Application protection with Amazon ALB
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Compute Network (Overlay)
CGW
AWS Cloud
VMware AccountCustomer Account
ENI
IGW
Users
ALB
AWS WAF
AWS Shield
IP Target Group
• 192.168.1.10
• 192.168.1.11

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon RDS
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
10.2.0.0/16
AWS Cloud
Region
VMware AccountCustomer Account
Amazon RDSAmazon Elastic File
System
ENI

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon FSx
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
10.2.0.0/16
AWS Cloud
Region
VMware AccountCustomer Account
Amazon FSxAWS
Directory Service
ENI

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Migrate existing files to Amazon FSx
VPC
VPC
Compute Network
CGW
AWS Cloud
Region
VMware Account
Customer Account
Corporate data center
Amazon FSx
AWS
Directory Service
Active
Directory
Internet
AWS Direct Connect
File Server
One-way forest-level trust
1. Deploy AWS Managed
Microsoft AD.
2. Establish trust relationship
to AD on-prem.
3. Add on-prem AD ”Domain
Administrators” to the
“AWS Delegated FSx
Administrators” group.
4. Create Amazon FSx file
system
5. Create/add VMC VM to
the AWS Directory
Service
6. Map drives to the VM:
• SourceShare (on-prem)
• TargetShare (FSx)
7. Use RoboCopy command
to copy files from source
to target shares
ENI

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Migrate data using AWS DataSync
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
AWS Cloud
Region
VMware Account
Corporate data center
Shared file
systems
Internet
AWS Direct Connect
AWS
DataSync
agent on
VMware
AWS DataSync
TLSNFS
Amazon S3
Amazon EFS
ESXi
Fast Up to 10Gbps transfer rate per agent,
multi-threaded, incremental transfers, inline
compression, configurable throughput
Secure and reliable TLS 1.2, AWS KMS
support, data validation, automatic
recovery from I/O errors
Cloud integration CloudWatch monitoring,
AWS IAM & CloudTrail control and audit,
PCI-DSS compliant & HIPAA eligible

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Migrate VMs using vMotion
AWS Cloud
VPC
192.168.1.0/24
192.168.2.0/24
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
ESXi
AWS Direct
Connect
Corporate data center
ESXi
NSX
standalone
edge
Customer
gateway
DX
RoutervCenter
192.168.1.0/24
192.168.2.0/24
Amazon EC2 Network (Underlay)
vMotion and host mgmt.
vCenter mgmt.L2 VPN
DX Private VIF
Compute Network
Management Network
VGW
vMotion
and host
Mgmt.

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Migrate VMs live with HCX vMotion with vSphere Replication
Capability
• App Mobility between any vSphere
versions across on-premises and
VMware Cloud on AWS
• Best-In-Class migration, VMware
Cloud Motion with vSphere
Replication with zero downtime
• Secure, Bi-Directional, Traffic
Engineered, Network
Extension with Auto VPN set up
Infrastructure Hybridity
App Mobility
vSphere
On-Prem
vSphere
Internet / Direct Connect/WAN
VMware Cloud on
AWS
vSphere
HCX
Use Cases
• DC Evacuation
• DC Consolidation
• Hardware Refresh
• DC Extension
Accelerated Cloud Adoption And Migration With HCX, App Mobility and Hybridity Services
Best-In-Class Cloud Migration With VMware Cloud Motion

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
DR design approaches
Backup &
Restore Pilot light
Warm standby
in AWS
Hot standby
Active/Active
 Lower priority use cases
 Solutions: Storage
Gateway, S3, R53, launch
SDDC in response to a
DR event
 Meeting lower RTO & RPO
requirements
 Solutions: Storage Gateway,
S3, DMS, EC2, R53, launch
SDDC resources in
response to a DR event
 Solutions that require
RTO & RPO in Minutes
 Solutions: S3, DMS, EC2,
R53, Direct Connect,
Scale SDDC resources in
response to a DR event.
 Auto-failover of your
environment in SDDC
 Solutions: R53, Direct
Connect, SDDC
Low High
RPO: Hours
RTO: Hours
Cost: $
RPO:
Minutes
RTO: Hours
Cost: $$
RPO: Minutes
RTO: Minutes
Cost: $$$
RPO:
Seconds
RTO: Real
time
Cost: $$$$

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Backup and Restore
VPC
192.168.1.0/24
192.168.2.0/24
Compute Network
CGW
AWS Cloud
Amazon EC2
Metal Instance
ESXi
Corporate data center
Internet
Amazon Route 53
AWS Direct Connect
ESXi
AWS Storage
Gateway *Or
any other
partner
appliance
vSphere Environment
AWS Storage
Gateway
backend
Virtual tape
library
S3 Bucket
IGW
RPO: ~24H
RTO: ~4-6H
Cost: $
X

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Pilot Light
VPC
192.168.1.0/24
192.168.2.0/24
Compute Network
CGW
AWS Cloud
Amazon EC2
Metal Instance
ESXi
Corporate data center
Internet
Amazon Route 53
AWS Direct Connect
ESXi
AWS Storage
Gateway *Or
any other
partner
appliance
vSphere Environment
AWS Storage
Gateway
backend
S3 Bucket
IGW
RPO: Minutes
RTO: ~4-6H
Cost: $$
X
VPC (connected VPC)
EC2
Secondary DatabaseAWS Database
Migration Service

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Protecting multiple sites with VMware Site Recovery
multiple sites
• Reduce
on-
premises or other cloud
SDDCs
multi-site topologies
SRM
On-prem site 1
(Production)SRM
On-prem site 2
(Production)
VMware Site
Recovery
VMware Cloud on AWS
SDDC 2 (DR site)
VMware Cloud on AWS
SDDC 1 (Production)
VMware Site
Recovery

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Outposts
*Expected Availability 2H‘19
Run AWS services, infrastructure, and operating models in virtually any
data center, colocation space, or on-premises facility
AWS Outposts +
VMware Cloud Foundation for EC2
AWS Outposts

39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon RDS on VMware vSphere
• Automates OS provisioning
• Database set up
• Full OS and DB patching
• Backups with point-in-time restore
• Storage and compute scaling
• Instance health management of RDS instances
running on vSphere.
With same user experience as in AWS

40. VMware Cloud on AWS
Hybrid cloud solution delivering the best of both worlds
Learn more on the web
vmware.com/go/vmc-aws or aws.amazon.com/vmware
Get started now
https://cloud.vmware.com/vmc-aws/single-host-access
Learn about our roadmap
vmware.com/go/vmc-aws/roadmap
Hands-on Labs
https://www.vmware.com/try-vmware/vmc-aws-hol-labs.html
Give us a shout on Twitter
#VMWonAWS
Follow us on Twitter
@vmwarecloudaws

41. Thank you!
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Haider Witwit

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T