Moving Enterprise Windows Workloads to AWS – Peter Stanski

Moving Enterprise Windows Workloads to AWS 
Peter ‘Dr Pete’ Stanski, Principal Solutions Architect
Amazon Web Services

Business
101 Technical
201 Technical
301 Technical
401 Technical
Session Grading

Enterprise MSFT Applications
+
Windows OS
+
AWS Services
= Enterprise Grade IT
Workloads in your
Private Hybrid Cloud
AGENDA

Major Companies run Microsoft Exchange, SharePoint and
Lync on AWS….
– Some of the world’s largest enterprise websites run on
SharePoint
– .Net, ASP.Net, COM/COM+ and many other Wintel technologies
– Enterprise Voice and IM are also suitable workloads
– Large Enterprise Exchange email deployments
Microsoft Workloads on AWS…

Paul McManus  
Domain.com.au 
pmcmanus@domain.com.au 
http://tech.domain.com.au

Amazon EC2
Amazon
Route 53
AWS Direct
Connect
Amazon
S3
Amazon
Glacier
Dynamo DB Amazon RDS ElastiCache
Amazon SES Amazon SQS Amazon
SNS

MS SQL 2014 Migration
Private A Private B
Main
Main/Reporting
Reporting

MS SQL 2014 Migration
• Opportunity to upgrade to SQL 2014
• Achieved DR and HA by switching to
multi-subnet always-on clustering.
• Simplified database environment
• Reduction in MS Licensing costs i.e.
down from 64 cores to 24
• Ability to spin up new SQL Instances
quickly and easily
• Improved storage strategy - space,
performance, backup.
Private A Private B
Main
Main/Reporting
Reporting

Question: 
How would you build a Microsoft Enterprise IT Platform on AWS?

Lets start here….
Corporate
Data
Center

Lets start here….
Corporate
Data
Center
AWS
Cloud
Internet

Remote  
Users / Admins
Isolated VPC
in the Cloud

Availability Zone
Private SubnetPublic Subnet
Availability Zone
Remote  
Users / Admins
Isolated VPC
in the Cloud

Secure Administration via Remote Desktop
Availability Zone
AWS Administrator
Corporate Data Center

Availability Zone
AWS Administrator
Gateway Security Group
Accept TCP Port 443
from Admin IP
RDGW

Availability Zone
AWS Administrator
TCP 443
Requires one connection:
• Connect to the RD Gateway, and the gateway proxies the RDP connection to the back-end instance.
Web Security Group
Accept TCP Port 3389
from Gateway SG
WEB2
WEB1
TCP 3389
TCP 3389
Gateway Security Group
Accept TCP Port 443
from Admin IP
RDGW

Availability Zone
DC
Domain  
Controller
Availability Zone
DC
Domain  
Controller
RDGW
Remote  
Users / Admins
Isolated VPC
in the Cloud
with RDGW

Availability Zone
DC
Domain  
Controller
RDGW
Availability Zone
DC
Domain  
Controller
RDGW
Remote  
Users / Admins
Isolated VPC
in the Cloud
with RDGW

Availability Zone
DC
Domain  
Controller
RDGW
Availability Zone
DC
Domain  
Controller
RDGW
Remote  
Users / Admins
Isolated VPC
in the Cloud
with RDGW
UseRoute53,HealthCheck&
DNSFailover
Amazon
Route 53

Availability Zone
DC
Domain  
Controller
RDGW
Availability Zone
DC
Domain  
Controller
RDGW
Isolated VPC
in the Cloud
with NAT
Internet

Availability Zone
DC
Domain  
Controller
RDGW
Availability Zone
DC
Domain  
Controller
RDGW
Isolated VPC
in the Cloud
with NAT
Use NATinstances to provide
access to remote Internet
services
*YoucanuseWindowsRouting&
RemoteAccess(RRAS)NATService
NAT
NAT
Remote Systems
Internet

Remote Desktop Gateway Reference Architecture 
• Detailed instructions available in the
“Deploy Remote Desktop Gateway on
the AWS Cloud” White paper
Available from :
http://aws.amazon.com/windows/resources/whitepapers/rdgateway/

Microsoft DirectAccess for Client Devices

Microsoft DirectAccess for Client Devices
• DirectAccess is a feature that allows connectivity to organization’s
network resources without the need for traditional Virtual Private
Network (VPN) connections
• With DirectAccess, client computers are always connected to your
corporate data network
• IT administrators can manage DirectAccess client computers
whenever they are running and connected to the Internet
• Summary: Always-on light-weight VPN into your corporate network

Availability Zone
10.0.0.0/24 10.0.2.0/24
Remote Windows
Client Computer 
(Users / Admins)
Isolated VPC in
the Cloud with
DirectAccess

Availability Zone
10.0.0.0/24 10.0.2.0/24
Remote Windows
Client Computer 
(Users / Admins)
Isolated VPC in
the Cloud with
DirectAccess
ENI
+
EIP
Windows
NAT
instance
ENI
+
Private IP
Security
Group
Security
Group

Availability Zone
10.0.0.0/24 10.0.2.0/24
DC +
Certs
Domain  
Controller
Remote Windows
Client Computer 
(Users / Admins)
Isolated VPC in
the Cloud with
DirectAccess
ENI
+
EIP
Direct
Access
Windows
DirectAccess Edge
Windows
NAT
instance
ENI
+
Private IP
Security
Group
Security
Group

Availability Zone
10.0.0.0/24 10.0.2.0/24
DC +
Certs
Domain  
Controller
Remote Windows
Client Computer 
(Users / Admins)
Isolated VPC in
the Cloud with
DirectAccess
ENI
+
EIP
Direct
Access
Windows
DirectAccess Edge
Internet
Windows
NAT
instance
ENI
+
Private IP
Security
Group
Security
Group

Availability Zone
10.0.0.0/24 10.0.2.0/24
DC +
Certs
Domain  
Controller
Remote Windows
Client Computer 
(Users / Admins)
Isolated VPC in
the Cloud with
DirectAccess
Always on VPN into
Enterprise from Windows
Client(s)
ENI
+
EIP
Direct
Access
Windows
DirectAccess Edge
Internet
Windows
NAT
instance
ENI
+
Private IP
Security
Group
Security
Group
VPN

Microsoft DirectAccess Server Role & NAT
• Detailed instructions available in the
“Implementing Microsoft DirectAccess and
NAT in the AWS Cloud” White paper
Available from :
http://aws.amazon.com/windows/resources/whitepapers/ms-direct-access/

RDGW and DirectAccess Considerations

• Secure RDGW connections require SSL certificates
– Available from public Root Certificate Authority; OR
– Deployed to the client device (manually / AD GPO)

• DirectAccess requires a domain joined client device
– You will need to perform an offline domain join + Certs + DC + ….

• DirectAccess requires a domain joined client device
– You will need to perform an offline domain join + Certs + DC + ….
• Direct connectivity into the VPC simplifies setup
– Requires cooperation across a wider set of IT team members

Corporate
Data
Center
AWS

Cloud
Internet

Corporate
Data
Center
AWS

Cloud
VPN TUNNEL1
1
Internet

• IP SEC VPN Tunnel connects over the public
Internet but has a variable performance
• Supports Static and BGP Routing
• Supports varying multi-Mbps speeds
Corporate
Data
Center
AWS

Cloud
VPN TUNNEL1
Telco
Direct Connect Link2
1
• AWS Direct Connect (DX) service allows for
dedicated telco links from your location
• Telco provides SLAs and predictable performance
• AWS provides multiple 1 Gbps & 10 Gbps links
• BGP for dynamic routing + AWS API endpoints
2
Internet

Availability Zone
NAT
DC
Domain  
Controller
RDGW
Availability Zone
NAT
DC
Domain  
Controller
RDGW
Remote  
Users
Your
Hybrid
Cloud

Availability Zone
NAT
DC
Domain  
Controller
RDGW
Availability Zone
NAT
DC
Domain  
Controller
RDGW
Remote  
Users
Your
Hybrid
Cloud
virtual private
gateway
VPN
connection
corporate
data network
AWS Direct
Connect

Availability Zone
NAT
DC
Domain  
Controller
RDGW
Availability Zone
NAT
DC
Domain  
Controller
MS
SQL DB
SQL
Server
MS
SQL DB
SQL
Server
APP
App 
Server
APP
App 
Server
WEB
IIS 
Server
WEB
IIS
Server
RDGW
Remote  
Users
Your
Hybrid
Cloud
virtual private
gateway
VPN
connection
corporate
data network
AWS Direct
Connect

SharePoint Reference Architectures on AWS

SharePoint Reference Architectures on AWS
White Papers Available from:
• http://aws.amazon.com/windows/resources/whitepapers/sharepoint-2010/
• http://aws.amazon.com/windows/resources/whitepapers/sharepoint-2013/
SPS2010
SPS2013

Microsoft Active Directory
• Create a new AD or Extend Existing?
– Lots of customers create a new “fresh” AD in AWS on EC2
– Extend trusts to existing AD for Single Sign On (SSO) experience

• If you run your own AD servers
– Treat each Availability Zone as an AD Site…
– Read Only Domain Controllers still need network connectivity

• If you run your own AD servers
– Treat each Availability Zone as an AD Site…
– Read Only Domain Controllers still need network connectivity
• AWS can simplify this for you…..

• A Microsoft Windows compatible directory service as a managed
AWS service. Usage options are:
A. Simplifies connecting to your existing on-premises Microsoft Active
Directory via an “AD Connector”;
B. Or set up and operate a new directory in the AWS cloud as a “Simple
AD”
Use AWS Directory Service

• A Microsoft Windows compatible directory service as a managed
AWS service. Usage options are:
A. Simplifies connecting to your existing on-premises Microsoft Active
Directory via an “AD Connector”;
B. Or set up and operate a new directory in the AWS cloud as a “Simple
AD”
• AWS DS is easy to manage: use the standard Windows AD admin
tools

• A Microsoft Windows compatible directory service as a managed AWS
service. Usage options are:
A. Simplifies connecting to your existing on-premises Microsoft Active Directory
via an “AD Connector”;
B. Or set up and operate a new directory in the AWS cloud as a “Simple AD”
• AWS DS is easy to manage: use the standard Windows AD admin tools
• Your directory users and groups can access the AWS Management
Console, and AWS applications, such as Amazon WorkSpaces, Amazon
WorkDocs, and Amazon WorkMail, using their existing credentials

Simple AWS Directory Service Supports
• Microsoft Internet Information Services (IIS) on:
– Windows Server 2003 R2
– Windows Server 2008 R1 & R2
– Windows Server 2012 & R2
• Microsoft SQL Server:
– SQL Server 2005 R2 (Express, Web, and Standard editions)
– SQL Server 2008 R2 (Express, Web, and Standard editions)
– SQL Server 2012 (Express, Web, and Standard editions)
– SQL Server 2014 (Express, Web, and Standard editions)
• Microsoft SharePoint:
– SharePoint 2010 Foundation
– SharePoint 2010 Enterprise
– SharePoint 2013 Enterprise

Availability Zone
NAT
RDGW
Availability Zone
NAT
MS
SQL DB
SQL
Server
MS
SQL DB
SQL
Server
APP
App 
Server
APP
App 
Server
WEB
IIS 
Server
WEB
IIS
Server
RDGW
Your
own
AD
on EC2
virtual private
gateway
VPN
connection
corporate
data network
AWS Direct
Connect
Domain  
Controller
Domain  
Controller
DC
DC

Availability Zone
NAT
AWS
Directory
Service
RDGW
Availability Zone
NAT
AWS
Directory
Service
MS
SQL DB
SQL
Server
MS
SQL DB
SQL
Server
APP
App 
Server
APP
App 
Server
WEB
IIS 
Server
WEB
IIS
Server
RDGW
Replaced
With
AWS
DS
virtual private
gateway
VPN
connection
corporate
data network
AWS Direct
Connect

From the AWS Console GUI
– Launch Instance Wizard

Computer Name
Domain Details

AWS Directory Service (Console)

AWS Directory Service (Console)
DNS IPs for your Domain Controllers in each AZ
Enabled Services

AWS Simple Systems Manager (SSM)

AWS Simple Systems Manager (SSM)
• Simple Systems Manager (SSM) facilitates the automatic configuration of AWS
Elastic Compute Cloud (EC2) instances running Windows Server OS
• SSM is implemented through the EC2Config windows service already included in
Windows Server AMIs
• EC2-Config service polls SSM every 5 minutes for configuration documents (in
JSON format) containing system configurations OR force it from CLI
• SSM currently supports configuration documents that allow for:
– Automated Domain Join
– MSI Package Installation/Repair/Uninstallation
– PowerShell Module Installation
– Delivery of Performance Monitor, Event Log, IIS Log, and custom log file data to CloudWatch and
CloudWatch Logs

SSM Document Example
{
"schemaVersion": "1.0",
"description": "MSI Install Script",
"runtimeConfig": {
"aws:applications": {
"properties": [
{
"action": "Install",
"source": "https://S3region.amazonaws.com/mybucketname/MSIs/CustomApp-x64.msi"
},
{
"action": "Install",
"source":
"http://location.s3.amazonaws.com/Firefox/Firefox-33.0.2/Firefox-33.0.2-en-US.msi",
"parameters" : "INSTALLEVEL=1000 custompath="c:foldername""
}
]
}
}
}

SSM Configuration & EC2Config Service
Setup & Config Tasks
• Domain Join
• Package Installations
• Deploy PowerShell Modules
• Logs & Performance Monitor
integration with CloudWatch

Configuration

Document
• Domain Join
Definition

Simple System Manager
Configuration

Document
Associated with
Instance ID(s)
• Domain Join
Definition

Configuration
Document
Associated with
Instance ID(s)

Configuration
Document
Associated with
Instance ID(s)
EC2Config
Windows
Service
Windows Instance

Configuration
Document
Associated with
Instance ID(s)
EC2Config
Windows
Service
Windows Instance
AWS Directory Service

Configuration
Document
Associated with
Instance ID(s)
EC2Config
Windows
Service
CloudWatch & Cloudwatch Logs
Windows Instance
AWS Directory Service

EC2 Instance Options
new
existing
Increasing customer choice
introduced

Elastic Block Storage (EBS) Updates

Amazon
EC2

EBS
snapshots
Amazon
EC2

Max EBS volume size up from: 1TiB to 16TiB & 4,000 to 20,000 PIOPS
EBS
snapshots
Amazon
EC2
16TiB

MS Exchange Reference Architectures on AWS
Both White Papers & Case Studies Available from:
• http://aws.amazon.com/windows/products/exchange/
2010 2013

MS Exchange Reference Architectures on AWS
Both White Papers & Case Studies Available from:
• http://aws.amazon.com/windows/products/exchange/
2010 2013
Use AWS
SES as a
Send
Connector

Amazon WorkMail
• WorkMail is a secure, managed business email and calendaring service
with support for existing desktop and mobile email clients
• WorkMail gives seamless access to email, contacts, and calendars
using native Microsoft Outlook Client, a web browser, or native iOS and
Android email applications
• You can integrate Amazon WorkMail with existing corporate directory
and control both the keys that encrypt your data and the location in
which your data is stored
• Useful when you would like a managed Exchange as a service

Amazon Workspaces
• AWS managed desktop computing service in the cloud
– virtual desktop infrastructure (VDI)
• Cloud-based desktops that allow end-users to access
their documents, applications and resources they need
with the device of their choice
• Accessed from laptops, iPad, Kindle Fire, Android tablets,
and zero clients

The Services Landscape on AWS
AWS Directory
Service

The Services Landscape on AWS
AWS Management
Console
Amazon
WorkSpaces
Amazon
WorkDocs
AWS Directory
Service
Amazon
WorkMail

• Single Sign On (SSO) & MFA is supported….

Compelling Windows Event (Don’t Forget)
• Microsoft is ending support for Windows Server 2003 on
July 14, 2015
• Options include:
– Keep running it but do it on AWS
– Migrate to the newer versions of Windows
– Do both….
• Find more info at: http://aws.amazon.com/windows/products/
ec2/server2003/

Summary
• You can readily run Enterprise Microsoft and many other
mission critical workloads on AWS….
• You can run your own Workloads on EC2; or
• Replace them with native AWS services
– Directory Services, WorkSpaces, WorkMail, WorkDocs, SQL
Server RDS, SES for bulk email sending….

Moving Enterprise Windows Workloads to AWS – Peter Stanski

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Moving Enterprise Windows Workloads to AWS – Peter Stanski

Similar to Moving Enterprise Windows Workloads to AWS – Peter Stanski (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Recently uploaded

Recently uploaded (20)

Moving Enterprise Windows Workloads to AWS – Peter Stanski