HLC305_How Verge Health Leverages Automation

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
How Verge Health Leverages Automation
to Provide a Mission Critical, 24x7x365 Health Solution on AWS
Verge Health and Cloudticity
November 27, 2017

Introductions
Gerry Miller, Founder/CEO/CTO, Cloudticity James Lawson, Chief Solutions Officer, Verge Health

Why Migrate?
James Lawson, Chief Solutions Officer, Verge Health

Verge Health
▶ 900 Hospital System Clients
▶ 14,000 Providers Monthly
▶ 17.25 Million Actions Managed
▶ 500,000 Active Users

The Verge Health Challenge
How to modernize a single on-premises
data center that does not have physical
redundancy, and that supports the
Converge platform for over 900 hospital
systems

Why Migrate?

The Migration Process
Gerry Miller, Founder/CEO/CTO, Cloudticity

AWS Configuration Principles
Config
CloudWatch
Flow Logs
Amazon S3
Configuration
Availability Zone A Availability Zone B
Public Subnet Public Subnet
Private Subnet Private Subnet

The Migration Process
GATHER CODE DEPLOY

Gather Inventory
Production xrgvrgdb07p Active 192.168.57.27 12 98 836 4160 SQL - BI - Active Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Production xrgvrgdb08p Active 192.168.57.28 12 98 836 2450 SQL - BI - Active Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Sandbox xrgvrgdb09p Active 192.168.57.29 8 64 3386 SQL - DBs Yes Windows 2008 R2 Enterprise SQL 2008 R2 Developer
Sandbox xrgvrgdb10p Active 192.168.57.30 8 64 3256 SQL - BI Yes Windows 2008 R2 Enterprise SQL 2008 R2 Developer
Production xrgvrgdb11p Active 192.168.57.19 12 128 836 2410 SQL - DBs - Active Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Production xrgvrgdb12p Active 192.168.57.20 12 128 836 SQL - DBs - Passive Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Production xrgvrgdb13p Active 192.168.57.21 12 128 836 3980 SQL - DBs - Active Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Production xrgvrgdb15p Active 192.168.57.17 24 128 6463 SQL - DBs - Active Node Yes Windows 2008 R2 Enterprise SQL 2008 R2 Enterprise
Production avxrgvrgad01p Active 10.162.175.13 4 8 120 Active Directory No Windows 2008 R2 Enterprise
Production avxrgvrgad02p Active 10.162.175.14 4 8 60 Active Directory No Windows 2008 R2 Enterprise
Development avxrgvrgbld01d Active 172.30.2.33 8 16 960 Build, Source Control No Windows 2008 R2 Enterprise
Development avxrgvrgbld02d Active 172.30.2.18 2 4 360 Build Agents No CentOS 7 Linux
Development avxrgvrgbld03d Active 172.30.2.42 2 4 200 Build Agents No Windows 2012 R2 Standard
Development avxrgvrgbld04d Active 172.30.2.43 4 8 610 Build Agents No Windows 2008 R2 Enterprise
Development avxrgvrgbpm01d Active 172.30.2.29 4 6 210 K2 No Windows 2008 R2 Enterprise
Production avxrgvrgbpm01p Active 172.31.171.16 4 12 230 K2 No Windows 2008 R2 Enterprise
Production Support avxrgvrgbpm01s Active 172.30.2.15 4 8 210 K2 No Windows 2008 R2 Enterprise
Staging avxrgvrgbpm01u Active 172.31.171.21 4 12 310 K2 No Windows 2008 R2 Enterprise
Utility/Management avxrgvrgchef01m Active 172.30.2.37 4 8 210 Configuration Management No Redhat 6 Linux
Development avxrgvrgdb01s Active 172.30.154.13 4 32 4140 SQL - DBs Yes Windows 2008 R2 Enterprise SQL 2008 R2 Developer
Production Support avxrgvrgdb02s Active 172.30.154.11 8 64 9110 SQL - DBs Yes Windows 2008 R2 Enterprise SQL 2008 R2 Developer
Staging avxrgvrgdb03s Active 172.30.154.12 8 32 4610 SQL - DBs Yes Windows 2008 R2 Enterprise SQL 2008 R2 Developer
Development avxrgvrgdc01s Active 172.30.2.26 2 4 60 Test Domain No Windows 2008 R2 Enterprise

Gather InventorySubnet Type Position Name Protocol Source IP Destination IP Port Action
StagingDMZ Inbound 166ftp TCP Any Any 21 Permit
StagingDMZ Inbound 165scp TCP Any Any 22 Permit
StagingDMZ Inbound 133SMTP from BPM02P TCP 10.162.171.22 Any 25 Permit
StagingDMZ Inbound 137UTL01S SMTP TCP Any 10.165.2.28 25 Permit
StagingDMZ Inbound 164SMTP from BPM01U TCP 10.162.171.21 Any 25 Permit
StagingDMZ Inbound 101default-101 TCP Any Any 80 Permit
StagingDMZ Inbound 122DCOM TCP Any 10.165.2.13 135 Permit
StagingDMZ Inbound 145DOC01P DCOM TCP 10.165.2.16 Any 135 Permit
StagingDMZ Inbound 102default-102 TCP Any Any 443 Permit
StagingDMZ Inbound 109SMB CIFS From StagingTrust TCP 172.32.0.0/24 172.32.0.0/24 445 Permit
StagingDMZ Inbound 111SMB CIFS From ProductionDMZ TCP 172.32.0.0/24 172.32.0.0/24 445 Permit
StagingDMZ Inbound 112SMB CIFS From ProductionTrust TCP 172.32.0.0/24 172.32.0.0/24 445 Permit
StagingDMZ Inbound 113SMB CIFS From ASH01 TCP 172.32.0.0/24 172.32.0.0/24 445 Permit
StagingDMZ Outbound 98default-98 TCP Any Any 587 Deny
StagingDMZ Outbound 102OpenVPN_udp_outbound UDP Any Any 1194 Permit
StagingDMZ Inbound 175OpenVPN_udp_inbound UDP Any Any 1194 Permit
StagingDMZ Inbound 105MSSQL to ASH01 Trust TCP 172.32.0.0/24 172.32.0.0/24 1433 Permit
StagingDMZ Inbound 125SQL Staging Web TCP Any 172.31.12.22 1433 Permit
StagingDMZ Inbound 134SQL WA02S TCP Any 172.31.12.22 1433 Permit
StagingDMZ Inbound 119MSSQL to ASH Trust 1434 TCP 172.32.0.0/24 172.32.0.0/24 1434 Permit
StagingDMZ Inbound 126SQL Staging Web RAPID TCP Any 172.31.12.22 1434 Permit
StagingDMZ Inbound 108Terminal Access to ASH01 TCP 172.32.0.0/24 172.32.0.0/24 3389 Permit
StagingDMZ Inbound 167LogShippingfromPROD TCP 172.32.0.0/24 172.32.0.0/24 3515 Permit
StagingDMZ Inbound 168IISLogShippingFromPROD TCP 172.32.0.0/24 172.32.0.0/24 3516 Permit
StagingDMZ Inbound 159Debugger port 4016 TCP 172.32.0.0/24 172.32.0.0/24 4016 Permit

Gather Inventory
ANX VPN Server
Description ANX VPN server used to connect AWS to client networks.
Servers ANXVPN01M
Operating System Windows 2012 R2 (ANXVPN01)
Installation Notes AWS Windows 2012 R2 AMI default Windows Roles and Features are not listed.
Windows Features
•.NET Framework 3.5 Features
• .NET Framework 3.5 (includes .NET 2.0 and 3.0)
•Remote Server Administration Tools
• Feature Administration Tools
• SNMP Tools
•SNMP Service
• SNMP WMI Provider
•Telnet Client
Notes
•Palo Alto VPN appliance from the AWS Marketplace for VPN01 and VPN02.
•VPN servers will need to provide connectivity between Dimension Data and AWS during the migration.
•VPN servers will need to provide connectivity from Verge employees computers to AWS servers. This is either for RDP or SSH access and
host name/URL access to resources that are not public.
•Possible site to site VPN tunnel from AWS to Charleston office.
•Windows Roles and Features are specific to ANXVPN01.

OS Configuration
Verge Health server hardening guidelines examples
1. Servers are not connected to the internet until it is fully hardened
2. IIS server is not installed on the domain controller
3. Two network interfaces are used in the server—one for admin and for the network
4. Remote administration of the server is secure and configured for encryption, low session time-outs and account
lockouts
5. Telnet, FTP, SMTP and NNTP services are disabled unless explicitly required
6. WebDAV is disabled unless explicitly required
7. Data Access Components are not installed unless explicitly required
8. NetBIOS and SMB are disabled
9. Etcetera

AWS CloudFormation Development

AWS CloudFormation Parameters
Parameters:
S3Bucket:
Description: The S3 bucket used to store Lambda zip file.
Type: String
Default: cloudticity-o2
S3Key:
Description: The Lambda zip file key name.
Type: String
Default: lambda-code/collector.zip
S3VersionId:
Description: The S3 file version.
Type: String
ClientName:
Description: The name of the client environment.
Type: String
Default: Cloudticity
...

AWS CloudFormation Conditionals
...
Conditions:
CreateAnalytics: !Equals [!Ref IncludeAnalytics, true]
UseExistingLogGroup: !Equals [!Ref CreateFlowlogGroup, true]
...
...
FlowlogCollectorFirehose:
Type: "AWS::KinesisFirehose::DeliveryStream"
DependsOn: LambdaExecutionRole
Condition: CreateAnalytics
...

AWS Chef Development

# set the parameters
AZ=`curl http://169.254.169.254/latest/meta-data/placement/availability-zone`
REGION=${AZ:0:${#AZ}-1}
INSTANCE_ID=`curl http://169.254.169.254/latest/meta-data/instance-id`
ENVIRONMENT=`aws ec2 describe-tags --filter "Name=resource-id,Values=$INSTANCE_ID" "Name=key,Values=o2:chef:environment" --region
$REGION | jq --raw-output '.Tags[0].Value'`
ROLE=`aws ec2 describe-tags --filter "Name=resource-id,Values=$INSTANCE_ID" "Name=key,Values=o2:chef:role" --region $REGION | jq
--raw-output '.Tags[0].Value'`
RUN_LIST='"role['$ROLE']"'
HOSTNAME=`curl http://169.254.169.254/latest/meta-data/hostname`
# create the client.rb file
printf 'organization = "'$ORGANIZATION'"nloglevel :infonlog_location STDOUTnchef_server_url
"https://chef.vergehealth.com/organizations/#{organization}"nvalidation_key
"/etc/chef/#{organization}-validator.pem"nvalidation_client_name "#{organization}-validator"nnode_name "'$HOSTNAME'"' | tee
/etc/chef/client.rb
# write the attributes file
echo '{ "chef_environment":"'$ENVIRONMENT'", "run_list":['$RUN_LIST']}' | tee /etc/chef/attributes.json
# install the chef-client
curl https://www.chef.io/chef/install.sh | bash -s -- -v 12.14.89
# run the chef-client for the first time
chef-client -j /etc/chef/attributes.json -l info -L /var/log/chef-client-userdata.log
AWS Chef Development

Data Movement

Special Considerations

Special Considerations
WSFC
Always-On
WSFC
Always-On
Synchronous Replication

The Cutover
(or, How to Spend a Saturday)
Stop
accepting
prod
connections
Allow
scheduled
data sync to
complete
Move VPN
connections
via ANX
PPRO
Update DNS
host
addresses
Start
accepting
connections

Post-Migration Optimization
Gerry Miller, Founder/CEO/CTO, Cloudticity

Cutting Edge Security

Agility
AWS Service Catalog

Agility

Availability
Public Subnet Public Subnet
Private Subnet Private Subnet

Cost

Cloudticity Oxygen

CLOUDTICITY OXYGEN™

The Results
James Lawson, Chief Solutions Officer, Verge Health

Thank you!
https://www.vergehealth.com
https://cloudticity.com

HLC305_How Verge Health Leverages Automation

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to HLC305_How Verge Health Leverages Automation

Similar to HLC305_How Verge Health Leverages Automation (20)

More from Amazon Web Services

More from Amazon Web Services (20)

HLC305_How Verge Health Leverages Automation