PrivateLink provides private connectivity between VPCs, AWS Services and on-premises applications. Built with the same underlying technology that powers NAT Gateway, Network Load Balancer and AWS Service endpoints, PrivateLink is now available for use with your own applications. In the session, we’ll do a deep dive into the underlying network technology that is used by PrivateLink and explore how PrivateLink can be deployed to improve your network topologies and application architectures. We’ll also look at how PrivateLink improves micro-service architectures, allowing for services to be vended between AWS accounts and over DirectConnect connections.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
AWS PrivateLink Deep Dive
C o l m M a c C á r t h a i g h
N E T 3 1 0
D e c e m b e r 1 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS PrivateLink

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink
10.1.0.0/16
10.1.2.3

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink
10.1.0.0/16
10.1.2.3

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for AWS Services
• Launched on November 8, 2017
• APIs available as PrivateLink endpoints: Amazon Kinesis, Amazon
EC2, Elastic Load Balancing, Amazon EC2 Systems Manager,
AWS Service Catalog
• Works with Amazon VPC security groups
• Works with IAM policies

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for AWS Services
• IP connectivity is private—no public IP addresses
• Endpoints have regional and zonal names
• And again:
• Works with Amazon VPC security groups
• Works with IAM policies

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for AWS Services

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for AWS Services
• If a provider has targets and NLB in each zone, those zones will be
available to customers
• Best latency by being in as many zones as possible; use at least
two for availability
• Reminder: zone names vary between accounts!
• Cross-region setups come with availability and data-sovereignty
risks

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
• Great for vending SaaS services securely
• AWS Marketplace integration available for easy discovery and
billing
• Ideal for compartmentalizing microservices into their own
networks and accounts

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
NLB
“Provider” VPC“Client” VPC

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Notification of lifecycle events
available via Amazon SNS
You can automate signups,
leave, events
Invoke AWS Lambda from
Amazon SNS
PrivateLink for Customers and Partners

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
• Pro tip: treat endpoint names as you would ELB names; use
CNAMEs or Amazon Route 53 alias
• Allows the provider to give short and meaningful names to clients
• Integrate with wildcard DNS and wildcard SSL certificates

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
• Single-tenant mode: create a PrivateLink NLB for every
client/customer
• Multi-tenant mode: allow many customers to use the same
PrivateLink NLB
• How do we tell endpoint traffic from different VPCs apart?

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
• Method 1: use traditional accounts/passwords/security tokens at
application level
• Method 2: use separate NLBs and different listener ports on the
targets
• Method 3: enable the ProxyProtocolV2 preamble

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS PrivateLink for Snowflake
Matthew Glickman
V i c e P r e s i d e n t , P r o d u c t M a n a g e m e n t
S n o w f l a k e C o m p u t i n g

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS PrivateLink
is a BIG DEAL

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake
The data warehouse built for the cloud
Centralized storage
Service
Compute
Storage

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake Editions before Spring 2017
Standard
§ Complete SQL Data
Warehouse
§ Business hour
support M-F
§ 1 day of time travel
§ Always-on enterprise
grade encryption in
transit and at rest
• Customer-dedicated
virtual warehouses
Premier
Standard +
§ Premier Support 24 x
365
§ Faster support
response time
§ SLA with refund for
outage
Enterprise
Premier +
§ Multi-Cluster
warehouse
§ Up to 90 days of
time travel
§ Federated
authentication
§ Annual rekey of all
encrypted data
§ Audit log
§ Cross-region
replication (2018)
ESD
Enterprise +
§ HIPAA Support
§ PCI Compliance
§ Data encryption
everywhere
§ Enhanced security
policy
§ Tri-Secret Secure
Customer-managed
keys

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Enterprise Security from First Principles
• Encryption at rest and in transit
• Ultimate control over keys

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake Deployment
Snowflake Multi-Tenant Pod and VPC Customer VPC
AWSRegion Cloud
Services
Virtual
Warehouses
Metadata
Store
Amazon
S3
Load
Balancer
Encryption on disk
and in transit
Customer-Dedicated
Virtual Instances
ELB
AWS Region
Secure Traffic
Over Internet

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake ESD
AWSRegion Cloud
Services
Virtual
Warehouses
Metadata
Store
Load
Balancer
Encryption on disk
and in transit
Customer-Dedicated
Virtual Instances
ELB
Tri-Secret Secure
customer-managed keys
Customer VPC
AWS Region
Snowflake Multi-Tenant Pod and VPC
Secure Traffic
Over Internet
Amazon
S3

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tri-Secret Secure: Customer-Managed Keys
Tri-secret secure
Split Encryption Keys
Amazon has no access
to customer data
Two-factor logon
credential
Required for data access
Three Secrets
Snowflake can’t access data
without customer-provided key
Customer
Key
Snowflake
Key
Logon
Credential+ +
AWS KMS

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Encryption at rest and in transit
• Ultimate control over keys
• Dedicated instance
Enterprise Security from First Principles

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake Editions
Standard
§ Complete SQL Data
Warehouse
§ Business hour
support M-F
§ 1 day of time travel
§ Always-on enterprise
grade encryption in
transit and at rest
• Customer-dedicated
virtual warehouses
Premier
Standard +
§ Premier Support 24 x
365
§ Faster support
response time
§ SLA with refund for
outage
Enterprise
Premier +
§ Multi-Cluster
warehouse
§ Up to 90 days of
time travel
§ Federated
authentication
§ Annual rekey of all
encrypted data
§ Audit log
§ Cross-region
replication (2018)
ESD
Enterprise +
§ HIPAA Support
§ PCI Compliance
§ Data encryption
everywhere
§ Enhanced security
policy
§ Tri-Secret Secure
Customer-managed
keys
Virtual Private
Snowflake (VPS)
ESD+
• Customer-dedicated
virtual servers
wherever the
encryption key is in
memory
• Customer-dedicated
metadata store
• Secure proxy to
customer VPC or on-
premises data center
• Business Critical
Support

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake VPS
VPS Secure Pod and Dedicated VPC
AWSRegion Cloud
Services
Virtual
Warehouses
Metadata
Store
Amazon S3
(Separate Account)
Load
Balancer
Encryption on disk
and in transit
Customer-Dedicated
Virtual Instances
Customer VPC
AWS Region
Tri-Secret Secure
customer-managed keys
Proxy
Secure Traffic
Over Internet
ELB

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Encryption at rest and in transit
• Ultimate control over keys
• Dedicated instance
• Private network connectivity
Enterprise Security from First Principles

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake ESD with AWS PrivateLink
Snowflake Multi-Tenant Pod
AWSRegion
Cloud
Services
Virtual
Warehouses
Metadata
Store
Load
Balancer
Encryption on disk
and in transit
Customer-Dedicated
Virtual Instances
AWS PrivateLink
Customer VPC
Secure Traffic
Within Region
Tri-Secret Secure
customer-managed keys
NLB
Amazon
S3

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Snowflake VPS with AWS PrivateLink
VPS Secure Pod and Dedicated VPC
AWSRegion
Encryption on disk
and in transit
Customer-Dedicated
Virtual Instances
AWS PrivateLink
Tri-Secret Secure
customer-managed keys
Secure Traffic
Within Region
Cloud
Services
Virtual
Warehouses
Metadata
Store
Amazon S3
(Separate Account)
Load
Balancer
Customer VPC
NLB

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Direct Connect + PrivateLink + Snowflake VPS
VPS Secure Pod and Dedicated VPC
AWSRegion
On-Premises Customer
AWS Direct Connect
Secure Traffic
Within Region
Cloud
Services
Virtual
Warehouses
Metadata
Store
Amazon S3
(Separate Account)
Load
Balancer
Customer VPC
NLB

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Encryption at rest and in transit
• Ultimate control over keys
• Dedicated instance
• Private network connectivity
For more information: https://bit.ly/privatelink-snowflake
Enterprise Security from First Principles

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS HyperPlane

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS HyperPlane
• Evolution of the S3 load balancer
• First used with Amazon Elastic File System (Amazon EFS)
• Also powers NLBs and NAT gateways

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS HyperPlane
• Running in EC2, on EC2
• Distributed, transactional, connection-tracking machine
• Not a proxy!
• Rewrites packets and can even insert new ones

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink for Customers and Partners
NLB
“Provider” VPC“Client” VPC

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS PrivateLink at GE
Larry Hook
P r i n c i p a l I n f r a s t r u c t u r e A r c h i t e c t
G E D i g i t a l

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Who is GE?
Larry Hook, Cloud Architect
- Working on AWS since 2011
GE is the leading multi-national digital industrial company
- Multiple lines of business (digital, aviation, power, healthcare, transportation, current)
- Operating in 170+ countries worldwide
A multi-year cloud journey with 2,000+ applications migrated
- Began with 50 apps in 30 days
- Multiple migration types (lift & shift, re-architect, cloud-native)
- Multiple risk profiles

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Public Cloud Team
4-year journey
- Vend environments to internal GE customers
- Self-service deployment model (BU opt-in)
- BUs only call when support is needed
Provide corporate guardrails and services
- Multiple designs along the way
Additional functions:
- Commercial and cloud-native applications
- Engineering and manufacturing app optimization
- Traditional IT data center cleanup

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PrivateLink @ GE
Current environment
- Many accounts connected over Direct Connect
- Many accounts peered together
- Corporate services reside on-premises
PrivateLink benefits
- Secure connectivity to corporate services (authentication, security tools, vulnerability tools)
- Simplify peering, routing, and firewall designs (reduce/remove NACLs)
- DNS as a service registry
- Provides incentive to move corporate services to AWS
Excellent beta experience—AWS was always responsive and in touch with our team

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS PrivateLink
• Easy to get started
• Feels like an NLB: metrics, health checks, failover, and more
• Same capabilities for customers and partners as for AWS services
• Opens up on-premises/intranet applications

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!