Many organizations face hurdles in migrating to the cloud, including challenges in learning and adopting new tools, skills, and processes. They also seek a way to continue to optimize their existing IT investments. VMware Cloud on Amazon Web Services (AWS) is an integrated hybrid-cloud service that can help your company overcome these obstacles. It enables you to run business-critical applications — without having to re-architect or convert them — across VMware vSphere-based workloads, either on-premises or on AWS. In this workshop, we will talk about how VMware Cloud on AWS helps simplify and accelerate the migration process.

1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud on AWS
Technical Overview
Mike Colson – Solutions Architect Manager

2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Agenda
• VMware Cloud on AWS Overview
• VMware Cloud On AWS Cluster And Security Features
• VMware Cloud on AWS Network connectivity
• VMware Cloud on AWS Workloads
• Architecting for High Availability & Disaster Recovery
• How to build integration with native AWS services
• Up Coming Features & Services

3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud On AWS Overview

4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
FACTS
Within 4 years, 79% of enterprises expect to use both
on-premises and public cloud infrastructure to meet their data center capacity
needs.
ü Combine the best of both worlds
ü Get to the cloud faster and more seamlessly
ü Leverage consistent infrastructure and skills
Source: Gartner, Michael Warrilow, Rethink Your Internal Private Cloud, August 30, 2018

5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Leading compute, storage and network
virtualization capabilities
Support for a broad range of workloads
De-facto standard for the enterprise DC
Flexible consumption economics
Broadest set of cloud services
Global scale and reach
Jointly engineered solution delivers the best of VMware and AWS for customers
A truly compelling and differentiated solution

6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Amazon EC2 Amazon S3 Amazon RDS
Amazon Redshift AWS Direct
Connect
Amazon
DynamoDB
VMware Cloud on AWS overview

7. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Innovation jointly engineered by VMware and AWS
Connectivity
Direct Connect
High availability
and reliability
Stretch cluster
Security
vSAN encryption
with KMS
Storage
vSAN with instance
and EBS support
Integration
Private ENI access to
AWS services

8. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud on AWS target use cases
Cloud migrations
Consolidate Migrate
Application specific
Data center wide
Infrastructure refresh
Data center extension
Expand
Maintain
Footprint expansion
On-demand capacity
Test/dev
Disaster recovery
Primary Secondary
Protect additional workloads
DR data center replacement
Add or modernize
DR solutions
Next-generation
applications
Primary
Application modernization
Next-gen app build out
Enterprise workloads

9. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Expanding global reach in 2019
Available
US West – Oregon
US East – N. Virginia
Europe – London
Europe – Frankfurt
Asia Pacific – Sydney
Asia Pacific – Singapore
Europe – Paris
Asia Pacific – Mumbai
Asia Pacific – Tokyo
Europe – Ireland
US West – N. California
US East – Ohio
GovCloud US (West)
Canada – Central
Q2 2019
So. America – Sao Paulo
China – Hong Kong
Asia Pacific – Osaka
Asia Pacific – Seoul
H2 2019
GovCloud US (East)
Europe – Sweden
Middle East – Bahrain

10. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Consumption-based Billing
On-demand / hourly
model
1 or 3-year subscription
model
Buy add-on services
Various Payment Methods
VMware SPP or
HPP credits
Purchase orders
Credit Card*
Hybrid Loyalty Program
Leverage existing
investments with
VMware
% Purchase VMware
Cloud on AWS at a
lower rate
No trade-in of on-
premises licenses
required
AWS
Flexible Consumption Models

11. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
ESXi
NSX
vSphere
vSAN
Software Defined Data Center
Compute
• Bare Metal
• I3.metal, R5 metal instances
• I3: 36 Cores/72 vCPUs,
512GiB Memory
• R5: 48 Cores/96 vCPU,
768 GiB RAM
• 25Gb ENA
• Instance store/EBS backed
storage
Hypervisor
• ESXi
• 3 to 16 Host Cluster
• Maintained by VMware
• No SSH/Root
• No VIBs/Plugins
Storage
• Aggregate Instance Storage
• All Flash (Capacity/Cache)
• EBS backed vSAN for r5
metal
• No EFS as shared storage for
hosts,
• VM Storage Policies
Network and Security
• Logical Networks
• North/South Firewalling
• Micro segmentation
• Compute/Management Gateways
• IPSec Termination
vSphere
• VMware Managed
• Delegated Permissions
• Hybrid Linked Mode
VMware Cloud on AWS – Technical Components

12. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
New high-capacity storage option backed by AWS EBS
vSphere vSAN NSX
VMware Cloud on AWS
Amazon EC2 R5.metal
• Amazon EC2 R5.metal instance
with flexible storage
• Storage per host range from
15 to 35 TB in increments of 5 TB
• Choose the amount of storage used
on all hosts within the cluster
• R5.metal clusters can be added to
an existing SDDC with at least one
existing provisioned cluster
EBS EBS EBS EBS EBS

13. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud On AWS Cluster And
Security Features

14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Data Encryption by Default
Seamless, centralized control over your encryption keys using AWS KMS
across environments now integrated with VMware vSAN volume encryption
AWS Key
Management Service
Local SSD devices
vSANvSAN
EBS Volume
AWS KMS

15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
SOC 1, SOC 2, SOC 3
CSA STAR Self-Assessment
ISO 27001, 27017, 20718
GDPR compliance
Work in Process
FedRAMP+ (High baseline)
DoD, Cloud Computing Security
Requirements Guide (IL4/5)
HIPAA BAA
More Coming
Soon!
VMware Cloud on AWS Compliance Certifications

16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Elastic DRS
Scaling Hosts For On-Demand Requirements
• Enabled at the cluster level
• Disabled by default
• Automatically scale cluster based on
utilization
• Monitoring interval every 5 minutes
• Scales up when ANY resource crosses
pre-defined threshold
• Scales down when ALL resources
consistently remain below thresholds

17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
• Specify a lower number of
CPU cores you need per
host (applied cluster wide)
• Increased deployment
flexibility
• Reduce costs for running
applications licensed per
core
Custom CPU Core Counts
Illustrative
Regular Cluster
…
“Custom” Cluster
…

18. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Automatic Cluster Configuration
Host is Added
vSAN Cluster
1. Automatic Network
Configuration2.
vSAN Cluster
3.
vSAN Cluster
VSAN Datastore Capacity
Increase
Management Network
vMotion Network
vSAN Network
VXLAN Network
vSAN Cluster

19. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Automated Hardware Remediation
If a host fails or a problem
is identified1.
vSAN Cluster A new host is added to the
cluster then the data from
the problem host is rebuilt
and/or migrated
2.
vSAN Cluster The previous host is evacuated
from the cluster then replaced by
the new host
3.
vSAN Cluster
0101
01
0101010

20. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud On AWS Network
Connectivity

21. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Account structure for VMware Cloud on AWS
VMware Cloud
SDDC account
Is owned, operated, and paid directly by the customer
Private connectivity to VMware Cloud SDDC
Full access to the native AWS services
A new AWS account to run SDDC resources
Is owned, operated, and paid directly by VMware
Single tenant for all SDDC resources
AWS customer
owned account
VMware Cloud on AWS operates in a model whereby the VMware managed cloud offering operates in a separate AWS account
from a customer’s AWS account.

22. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Getting started
vmc.vmware.com
Create a new SDDC
• Specify AWS account
• SDDC Properties:
• AWS Region
• Stretched Cluster
• SDDC Name
• Number of hosts
• VPC and Subnet
• Management Subnet CIDR
VMware Cloud on AWS Console
• my.vmware.com credentials
• VMware Cloud Organizations
• Identity and Access Management

23. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Accessing VMware Cloud on AWS
• Hybrid Linked-Mode
• Logical network configuration
• Virtual machine administration
• VM storage policies
• Add and remove ESXi hosts
• Console user and role management
• Firewall configuration
• EIP and NAT configuration
• VPN connectivity
vmc.vmware.com
vSphere H5
Web Client

24. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud SDDC Account
NSX
Management Gateway
(MGW)
Compute
Gateway
(CGW)
NSX Tier-0
Router (T0)
Internet Gateway
Underlay vs Overlay Networks
vCenter
Server
Appliance
NSX
Controlle
r
Management Customer Workloads
VPC = Underlay
NSX = Overlay

25. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Subnet
SDDC Connectivity to customer VPC
VPC
AWS Cloud
Subnet
EC2
Instances
EC2
Instances
ENI
Region
VPC
Customer Account VMware Account
192.168.1.0/2
4
192.168.2.0/2
4
T0
IGW
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
ESXi
VPC Network 10.1.0.0/16 (Underlay)
VPC Network 10.2.0.0/16
Subnet1
10.2.1.0/24
Subnet1
10.2.2.0/24

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 26
vMotion networking with Direct Connect
AWS Cloud
VPC
192.168.1.0/2
4
192.168.2.0/2
4
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
ESXi
AWS Direct
Connect
Corporate data center
ESXi
NSX
standalone
edge
Customer
gateway
DX
RoutervCenter
192.168.1.0/24
192.168.2.0/24
Amazon EC2 Network (Underlay)
vMotion and host mgmt.
vCenter mgmt.L2 VPN
DX Private VIF
Compute Network
Management Network
VGW
vMotion
and host
Mgmt.

27. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VGW
VGW
Connectivity to other VPCs & On-Premises
VPC1 VPC
192.168.1.0/2
4
192.168.2.0/2
4
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW
vCenter
CGW
VPC Network 10.1.0.0/16
VPC2
VPC3
10.10.0.0/16
10.20.0.0/16
10.30.0.0/16
Connected VPC
Compute
Storage
Network
vSphere-based
data center
On-Premises Data Center
AWS Direct
Connect
172.16.0.0/16
AWS Direct Connect
Private, dedicated network
connection with guaranteed
connectivity performance
Best suited for customers with
critical workloads that need
predictable throughput
ENI

28. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Connectivity to other VPCs & On-Premises
VPC1 VPC
192.168.1.0/2
4
192.168.2.0/2
4
T0
Management Network (Overlay)
Compute Network (Overlay)
MGW vCente
r
CGW
VPC Network 10.1.0.0/16
VPC2
VPC3
10.10.0.0/16
10.20.0.0/16
10.30.0.0/16
Connected VPC
Compute
Storage
Network
vSphere-based
data center
On-Premises Data Center
AWS Direct
Connect
AWS Transit Gateway
172.16.0.0/16
BGP
ECMP
AWS Direct Connect
Private, dedicated network
connection with guaranteed
connectivity performance
Best suited for customers with
critical workloads that need
predictable throughput
ENI
ENI
ENI

29. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
VMware Cloud on AWS Workloads

30. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Run Your Business Critical Applications in the Cloud
SAP S/4 HANA
SAP BW/4 HANA
SAP HANA Data Management
SAP WORKLOADS
SQL Database
Custom Applications
MICROSOFT SQL WORKLOADS
Microsoft SharePoint
Microsoft SQL 2008 nearing EOL
– opportunity to leverage AWS
Native Database services
Oracle Business Applications
Oracle Database
Custom Applications
ORACLE WORKLOADS

31. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Migrate VMs live with HCX vMotion with vSphere Replication
•Capability
• App Mobility between any vSphere
versions across on-premises and
VMware Cloud on AWS
• Best-In-Class migration, VMware
Cloud Motion with vSphere
Replication with zero downtime
• Secure, Bi-Directional, Traffic
Engineered, Network
Extension with Auto VPN set up
Infrastructure Hybridity
App Mobility
vSphere
On-Prem
vSphere
Internet / Direct Connect/WAN
VMware Cloud
on AWS
vSphere
HCX
Infrastructure Abstraction
Use Cases
• DC Evacuation
• DC Consolidation
• Hardware Refresh
• DC Extension
Accelerated Cloud Adoption And Migration With HCX, App Mobility and Hybridity Services
Best-In-Class Cloud Migration With VMware Cloud Motion

32. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Architecting For High Availability And
Disaster Recovery

33. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Stretched clusters for VMware Cloud on AWS
AWS availability
zone A
AWS availability
zone B
… …
vSphere HA/DRS span across AZ
NSX logical networks
Stretched clusters
… …
vSAN stretched cluster
VMware Cloud on AWS SDDC
AWS Region
• Zero RPO high availability across
AZs
• No necessity to architect in the
application
• Common logical networks with
vSphere HA/DRS enabled
• Synchronous replication between
AZs for mission-critical
applications
• AZ availability issues treated as
vSphere HA event and VM is
restarted in the other AZ

34. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Inter-AZ traffic flow for stretched clusters
VMware Cloud on AWS - Stretched Cluster
AZ AZ
AWS Region
AZ
Witness
Synchronous
Writes
Read
Locality
vSAN Stretched Cluster – Replication Traffic
Traffic types include:
• Read traffic serviced by AZ
that VM resides on
• Synchronous replication
commits writes to both AZ’s
• Witness traffic dependent on
number of objects

35. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Disaster Recovery to the cloud with VMware Site
Recovery

36. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Protecting multiple sites with VMware Site Recovery
multiple sites
• Reduce
on-
premises or other cloud
SDDCs
multi-site topologies
SRM
On-prem site 1
(Production)SRM
On-prem site 2
(Production)
VMware Site
Recovery
VMware Cloud on AWS
SDDC 2 (DR site)
VMware Cloud on AWS
SDDC 1 (Production)
VMware Site
Recovery

37. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
How To Build Integration With Native
AWS Services

38. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Private subnet Private subnetPrivate subnet
AWS account connectivity
VMware Cloud on AWS SDDC account Customer owned AWS account
VPC Subnet 1 VPC Subnet 2
Customer workloads
Amazon
Redshift
Logical network
Route table
Host-1
Host-2
Host-3
Host-4
NSX-T0
VPC
AWS Cloud
VPC
VPC Subnet 1
X

39. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Services access models
Private
VPC Gateway Endpoints
VPC Interface Endpoints (PrivateLink powered)
Service endpoints within a customer managed VPC
Public
Direct access to public endpoints

40. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Private subnet Private subnetPrivate subnet
VPC Gateway Endpoint - Amazon S3
Amazon S3
Amazon S3
Endpoint
192.168.1.0/24
192.168.2.0/24
Router
IGW
ENI
Customer managed VPC
VPC Network 10.2.0.0/16
VMware managed VPC
VPC Network 10.1.0.0/16
Management Network (Overlay)
Compute Network (Overlay)
MGW
Amazon EC2
Metal Instance
vCenter
CGW
AWS Cloud
VPC VPC
ESXi
Subnet2
10.2.2.0/24
Subnet1
10.2.1.0/24
Amazon EC2

41. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What services can be accessed using AWS PrivateLink?
• Native AWS Services:
- Amazon CloudWatch Logs
- AWS CodeBuild
- Amazon EC2 API
- Elastic Load Balancing API
- AWS Key Management Service
- Amazon Kinesis Data Streams
- AWS Service Catalog
- Amazon SNS
- AWS Systems Manager
- and more…
• Endpoint services hosted by other AWS accounts
• Supported AWS Marketplace partner services

42. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Application protection with Amazon ALB
VPC
VPC
192.168.1.0/2
4
192.168.2.0/2
4
Compute Network (Overlay)
CGW
AWS Cloud
VMware AccountCustomer Account
ENI
IGW
Users
ALB
AWS WAF
AWS Shield
IP Target
Group
192.168.1.10
192.168.1.11

43. Integration with native AWS services: Amazon RDS
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
10.2.0.0/16
AWS Cloud
Region
VMware AccountCustomer Account
Amazon RDS
ENI

44. Integration with native AWS services: Amazon FSx
VPC
VPC
192.168.1.0/24
192.168.2.0/24
Management Network (Overlay)
Compute Network (Overlay)
MGW vCenter
CGW
VPC Network 10.1.0.0/16
10.2.0.0/16
AWS Cloud
Region
VMware AccountCustomer Account
ENI
Amazon FSxAWS
Directory Service

45. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Upcoming Features & Services

46. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Amazon RDS on VMware vSphere
• Automates OS provisioning
• Database set up
• Full OS and DB patching
• Backups with point-in-time restore
• Storage and compute scaling
• Instance health management of RDS instances
running on vSphere.
With same user experience as in AWS

47. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Outposts
Expected Availability 2H‘19
Run AWS services, infrastructure and operating models in virtually any data
center, colocation space or on premises facility
AWS Outposts +
VMware Cloud Foundation for EC2
AWS OutpostsAWS designed
and fully
managed
infrastructure

48. VMware Cloud on AWS
Hybrid cloud solution delivering the best of both worlds
Learn more on the web
vmware.com/go/vmc-aws or aws.amazon.com/vmware
Get started now
https://cloud.vmware.com/vmc-aws/single-host-access
Learn about our roadmap
vmware.com/go/vmc-aws/roadmap
Hands-on Labs
https://www.vmware.com/try-vmware/vmc-aws-hol-labs.html
Give us a shout on Twitter
#VMWonAWS
Follow us on Twitter
@vmwarecloudaws

49. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark