Operationalizing Microsoft Workloads, AWS Federal Pop-Up Loft

Operationalizing Microsoft Workloads
Jason Opdycke
Sr. Solutions Architect
Department of DefenseTeam
jasonaws@amazon.com

Overall Agenda
• Part 1 – SystemsManager
• Part 2 - ManagedAD
• Bonus Round – CAC Auth to Workspaces

PU B L IC SE C T OR
SU M M I T
Operationalizing MicrosoftWorkloads
What comes tomind?
© 2019, Amazon Web Services, Inc. or its affiliates. All rightsreserved.

PU B L IC SE C T OR
SU M M I T
Agenda – Part1 Infrastructure
provisioning
Configuration
management
Governance &
compliance
Monitoring &
performance
Resource
optimization

PU B L IC SE C T OR
SU M M I T
Infrastructure
provisioning
Configuration
management
Governance &
compliance
Monitoring &
performance
Resource
optimization

PU B L IC SE C T OR
SU M M I T
What are the steps to build an environment?
AWS
CloudFormation
Availability Zone
Private Subnet
Availability Zone
Private Subnet
Remote
Users
IIS
App
IIS
Web
IIS
App
IIS
Web
AWS
Director
y
Service
AWS
Director
y
Service
MS
SQL
MS
SQL

PU B L IC SE C T OR
SU M M I T
AWS CloudFormation
• Automated
• Repeatable

PU B L IC SE C T OR
SU M M I T
AWS QuickStarts
https://aws.amazon.com/quickstart/

© 2019, Amazon Web Services, Inc. or its affiliates. All rightsreserved.RPU B L IC SE C T O
SU M M I T
Infrastructure
provisioning
Configuration
management
Governance &
compliance
Monitoring &
performance
Resource
optimization

PU B L IC SE C T OR
SU M M I T
Managing your Windowsinstances
Amazon Elastic
Compute Cloud
(Amazon EC2)
AWS Systems Manager
Run Command
AWS Systems Manager
Session Manager
Tools Tasks Target

PU B L IC SE C T OR
SU M M I T
Running PowerShell
AWS Systems Manager
Session Manager
Interactive
AWS Systems Manager
Run Command
Non-interactive
Good for bulk administrative changes Good for full, interactive access

PU B L IC SE C T OR
SU M M I T
Secure remote configurationmanagement
Availability Zone
Web security group
Private subnet
Accept traffic from SSM
WEB2
WEB1
AWS administrator
Corporate data center
AWS Systems Manager
Amazon S3
bucket
SNS topic Amazon CloudWatch
metric
Amazon
IAM policy

Demo
SystemsManagerIAMInstanceProfile
QuickSetup
Systems Manager HomePage
Run Command
SessionManager

PU B L IC SE C T OR
SU M M I T
Patching Microsoft Windows in thecloud
Up-to-date
instances
Out-dated
instances
AWS Systems Manager
Maintenance Windows
AWS Systems Manager
Patch Manager

PU B L IC SE C T OR
SU M M I T
AWS Systems Manager
Patch Manager
• Scan instances for missing patches
AWS Systems Manager
Maintenance Windows
Create recurring schedules to perform
administrative tasks
Create baselines that include
rules for auto approving patches
Apply missing patches individually
or to bulk instances using tags Integrates with AWS Systems Manager
Run command, Automation, AWS
Lambda, AWS Step Functions

PU B L IC S E C T OR © 2019, Amazon Web Services, Inc. or its affiliates. All rightsreserved.
SU M M I T
Demo
Configure Patching
Patch Baselines
ComplianceDashboard

PU B L IC SE C T OR
SU M M I T
Keeping your golden images up to date
Up-to-date AMIOut-dated AMI

PU B L IC SE C T OR
SU M M I T
Simplify common IT tasks
Express your workflow as automation steps in a JSON-
based document
Support for Run command, Lambda functions, AWS APIs

Demo
AutomationConsole
UpdateWindowsAMI

PU B L IC SE C T OR
SU M M I T
Visibility into Cloud Resources andApplications
Service and application availability
Monitor individual systems and applications
Detect and Troubleshoot problems
Set-up monitoring infrastructure and systems

PU B L IC SE C T OR
SU M M I T
Monitoring Windows workloads usingAmazon
CloudWatch
Monitor and Manage AWS, hybrid, and on-premises applications and infrastructure resources.
Get Visibility
• Windows Performance Counters
• IIS Logs, SQL Server Logs,
custom application log
Monitor
• High resolution alarms
• Custom dashboards
Take Action

PU B L IC SE C T OR
SU M M I T
Observability for N-tier .NETapplications

PU B L IC SE C T OR
SU M M I T
Amazon CloudWatch Application Insights for .NET&
SQL Server
Machine learning based
anomaly detection for
metrics and logs
Visualize root cause with
Amazon CloudWatch
Automatic Dashboards
Improved
customer experience
Easily and quickly detect and diagnose common problems with .NET and SQL Server
applications

PU B L IC SE C T OR
SU M M I T
Examples
• SQL Server errors such as Failed backups,
• .NET application problems such as Mem
• Elastic Load Balancer such as latencies d
Scheduler deadlocks
ory leaks, custom log errors
ue to high CPU on application server

Demo
CloudWatch Application Insights – App Onboarding
CloudWatch Application Insights – Example Problem

PU B L IC SE C T OR
SU M M I T
Keeping inventory
Amazon EC2
Tools Items Target
AWS Systems
Manager Inventory

PU B L IC SE C T OR
SU M M I T
AWS Systems Manager
Inventory
Collects information about your instances and the
software installed on them
Enables you to manage application assets, track licenses,
monitor file integrity, discover applications …

PU B L IC SE C T OR
SU M M I T
Managing configurationdrift
Amazon EC2
Tools Tasks Target
AWS Systems Manager
State Manager

PU B L IC SE C T OR
SU M M I T
AWS Systems Manager
State Manager
Configuration management
Configuration policies
Amazon EC2 instances or on-premises instances

Demo
AWS Systems Manager – State Manager – RDP Example

PU B L IC SE C T OR
SU M M I T
Fine-tuning your Microsoft workloads in thecloud
What to fine tune?
Amazon EC2
Target
AWS Trusted Advisor
Tools

PU B L IC SE C T OR
SU M M I T
Core checks and
recommendations available to all
AWS customers
Security
AWS Service limits
Full Trusted Advisor benefits
available with business or
enterprise support plans
Security
AWS service limits
Cost optimization
Performance
Fault tolerance
AWS Trusted Advisor

PU B L IC SE C T OR
SU M M I T
Infrastructure
provisioning
Configuration
management
Governance &
compliance
Monitoring &
performance
Resource
optimization
Summary
AWS
CloudFormation
AWS Systems Manager
AWS Systems Manager
AWS Trusted Advisor
Amazon CloudWatch Amazon CloudWatch
Application Insights for .NET
and SQL Server

Part 2
AWS Directory Service for Microsoft Active Directory

What we will cover
• What AWS Managed Microsoft AD is
• Key use cases
• How applications use
AWS Managed Microsoft AD
• Deployment models
(user vs. resource forest)
• How to install, administer, and configure
• Supported trust models
• Security event logging
• Directory sharing

What is AWS Managed MicrosoftAD?

AWS Managed
Microsoft AD DC
AWS D i re c to ry Se rv i c e f o r M i c ro so f t Ac ti v e D i re c to ry
“AWS Managed Microsoft AD”
AWS Managed
Microsoft AD DC

App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
Availability Zone 1 Availability Zone 1
10.0.2.0/24
10.0.3.0/24
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
AWS Di re c to ry S e rv i c e f o r M i c ro s o f t Ac ti v e Di re c to ry
AWS Managed VPC Customer VPC

App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
10.0.2.0/24
10.0.3.0/24

Domain controllers are
exclusively yours
App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
10.0.2.0/24
10.0.3.0/24

Domain controllers are
exclusively yours
Compliance audited
App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
10.0.2.0/24
10.0.3.0/24

https://aws.amazon.com/compliance/services-in-scope/

Amazon—operates
• Multi-AZ deployment, patch, monitor,
DC recovery, instance rotation, snapshot, restore
App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
10.0.2.0/24
10.0.3.0/24

Amazon—operates
• Multi-AZ deployment, patch, monitor,
DC recovery, instance rotation, snapshot, restore
Customer—administer and configure
• Administer users, groups, GPOs, other AD content
• Administration via Active Directory Users and
Computers (ADUC) and other standard AD tools
• Configure password policies
• Add domain controllers as needed
• Configure trusts (resource forest deployment)
• Configure certificate authorities (for LDAPS)
• Configure federation
App 1 App 2
App 1 App 2
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
10.0.2.0/24
10.0.3.0/24

Standard
Edition
Enterprise
Edition
Storage Capacity 1GB 17GB
Performance
Optimized
~5,000
employees
Over 5,000
employees

AWS Managed
Microsoft AD
AWS M a n a g e d M i c ro so f t AD u se c a se s
Domain Join & Manage with Group Policy

AWS Managed
Microsoft AD
Remote
Desktop
Licensing
.NET
Apps
SharePoint SQL Server Certificate
Services
Traditional AD Applications

AWS Managed
Microsoft AD
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
RDS for SQL Amazon Amazon
Server WorKSpaces QuickSight
Amazon
Chime
Compatible AWS Applications and Services
Learn more: https://aws.amazon.com/directoryservice
Remote
Desktop
Licensing
.NET
Apps
Services

Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
Chime
User Directory
Remote
Desktop
Licensing
.NET
Apps
Services
AWS Managed
Microsoft AD

Azure AD
Connect
AD FS
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
Chime
Azure AD
User Directory
Pass-
through
Use Microsoft Tools
with Web Applications
Remote
Desktop
Licensing
.NET
Apps
Services
AWS Managed
Microsoft AD

Azure AD
Connect
AD FS
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
Chime
AWS SSO
User Directory
Use AWS SSO with
Web Applications
Remote
Desktop
Licensing
.NET
Apps
Services
Azure AD
Sync
SAML
AWS Managed
Microsoft AD
Use Microsoft Tools

Azure AD
Connect
AD FS
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
Chime
AWS SSO
User Directory
Active Directory
Extend Existing AD
Remote
Desktop
Licensing
.NET
Apps
Services
SAML
Use AWS SSO with
Web Applications
Sync
Azure AD
AWS Managed
Microsoft AD
Use Microsoft Tools
Azure AD
Connect

How to install, administer, andconfigure

Prerequisites you must create
• Virtual Private Cloud (VPC)
• Two subnets in different AZs
• Optional on-premises link
• AWS Direct Connect or
Virtual Private Network (VPN)
• Optional AD on-premises
docs.aws.amazon.com/directoryservice/latest/admin-guide/tutorials_ad_test_labs.html
Customer VPC
Availability Zone 1
10.0.2.0/24
Availability Zone 2
10.0.3.0/24
Active
Directory
VPN
Connection
AWS Direct
Connect
Optional

During creation AWS creates
• 2 DCs with Dynamic DNS
• Elastic network interface in
your subnets
• One AWS security group
Customer VPC
Availability Zone 1
10.0.2.0/24
10.0.3.0/24
Availability Zone 2
AWS Managed VPC
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
Availability Zone 1
Availability Zone 2
VPN
Connection
AWS Direct
Connect
Active
Directory
Optional
Use extreme
caution modifying
the security groups!

Best practice after creation
Customer VPC
Availability Zone 1
10.0.2.0/24
10.0.3.0/24
Availability Zone 2
AWS Managed VPC
AWS Managed
Microsoft AD DC
AWS Managed
Microsoft AD DC
Availability Zone 1
Availability Zone 2
VPN
Connection
AWS Direct
Connect
Active
Directory
Optional
• DHCP option sets
• AWS security group
(for your EC2 creations)
• IAM role/policy for EC2
(AmazonEC2RoleforSSM)
• Key-pair (PEM) file
• EC2 Windows
(Install AD Administration Tools)
PEM File
DHCP Opt Set
IAM Role

Configure administration instance
1 RDP to Instance
yourdomainadmin
Add Features
Group Policy Management
AD DS and AD LDS Tools
DNS Server Tools
2
Verify Tools Added
Active Directory Administrative Center
Active Directory Domains and Trusts
Active Directory Module for
Windows PowerShell
Active Directory Sites and Services
Active Directory Users and Computers
ADSI Edit
DNS
Group Policy Management
3

Administer with AD tools Configure from AWS Console

Managing from AD Administration Tools
88-856-43-585
88-856-43-585
OU
“admin”
Customer
Domain
“administrator”

Managing from AD Administration Tools
88-856-43-58588-856-43-585
Customer
OU
“admin”
Add OU and on-premises
users/groups to reserved
security groups

Demo
Setup New AWS Managed Microsoft AD
Explore Existing ManagedAD
Explore ENIs, SG, IAM Roles
Seamless DomainJoin

Trusts
Trust
Access
Active Directory
Access requires
permissions to
resource in the
trusting domain
Active Directory

Forests, domains, treedomains
Active Directory
Root Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Tree Root Domain
Active Directory
Tree Child Domain
AWS Managed
Microsoft AD
Single
domain
forest
Active Directory
Root Domain

AWS Managed Microsoft AD forest trust support
Active Directory
Root Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Tree Root Domain
Active Directory
Tree Child Domain
AWS Managed
Microsoft AD
Single
domain
forest
Active Directory
Root Domain
Forest Trust

AWS Managed Microsoft AD domain trust support
Active Directory
Root Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Tree Root Domain
Active Directory
Tree Child Domain
AWS Managed
Microsoft AD
Single
domain
forest
Active Directory
Root Domain
Domain Trust
Domain Trust

AWS Managed Microsoft AD mixed trust support
Active Directory
Root Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Child Domain
Active Directory
Tree Root Domain
Active Directory
Tree Child Domain
AWS Managed
Microsoft AD
Single
domain
forest
Active Directory
Root Domain
Forest Trust
Domain Trust

Customer VPC
Availability Zone 1
10.0.2.0/24
AWS Managed VPC
AWS Managed
Microsoft AD DC
Availability Zone 1
VPN
Connection
AWS Direct
Connect
Active
Directory
RDS for SQL
Server
AWS applications and trusts for hybrid IT use cases
Traditional AD aware applications

AWS applications and trusts for hybrid IT use cases
Customer VPC
Availability Zone 1
10.0.2.0/24
AWS Managed VPC
AWS Managed
Microsoft AD DC
Availability Zone 1
VPN
Connection
AWS Direct
Connect
Active
Directory
Amazon
Connect
Amazon Amazon
WorkDocs WorkMail
Amazon
Chime
AWS SSO
Amazon Amazon
WorKSpaces QuickSight
RDS for SQL
Server
Traditional AD aware applications
AWS cloud-based applications

Security event logging to Amazon CloudWatch

Use existing or create a new log group

Cross-account sharing

Customer VPC1
Account A
Amazon
WorKSpaces
RDS for
SQL Server
EC2
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
AWS SSO
AWS Internal
DC APIs
Communication paths to AWS Managed Microsoft AD
Discover DCs
Domain Join
Read
AWS Managed VPC
DC1 DC2 DC3

Internal DC APIs inaccessible inother accounts
Customer VPC1
Account A
Amazon
WorKSpaces
RDS for
SQL Server
EC2
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
AWS SSO
AWS Internal
DC APIs
Account B
EC2
Customer VPC2
Peering
Discover DCs
Domain Join
Read
AWS Managed VPC
DC1 DC2 DC3

Cross-account directory sharing
Customer VPC1
Account A
Amazon
WorKSpaces
RDS for
SQL Server
EC2
Amazon
Connect
Amazon
WorkMail
Amazon
WorkDocs
Amazon
QuickSight
Amazon
Chime
AWS SSO
AWS Internal
DC APIs
Account B
EC2
Customer VPC2
AWS Internal
DC APIs
Peering
Discover DCs
Domain Join
Read
AWS Managed VPC
DC1 DC2 DC3

Sharing across multiple VPCs andaccounts
DC1 DC2 DC3
AWS Managed VPC
Account A
Customer VPC2
Customer VPC3
Customer VPC4
Account B
Customer VPC5
Account C
Customer VPC6
Customer VPC1

Recap
• What AWS Managed Microsoft AD is
• Key use cases
• How applications use
AWS Managed Microsoft AD
• Deployment models
(user vs. resource forest)
• How to install, administer, and configure
• Supported trust models
• Security event logging
• Directory sharing

BONUS!!
CAC/PIV AUTH TO AWSWorkspaces

VPC
AWSGovCloud
Availability Zone1 Availability Zone2
NAT
Gateway
RDP
Gateway
Proxy
NAT
Gateway
RDP
Gateway
Proxy
ADDomain Controller DC-1
AmazonWorkSpaces AmazonWorkSpaces
ADDomain Controller DC-2
AWSDirectConnect
Internet
gateway
or
Private
Subnets
Users
AmazonEC2Auto Scaling
External network routed Subnets
Port443
ADConnector
Private
Subnets

RDGateway Manage r
File Action View Help
X
RDGatewayManager
v i EC2AMAZ-NTOAJFQ(Local)
" Policies
.....Connection Authorization Policies
Resource Authorization Policies
Monitoring
< >
Connection Authorization Policies
ARemoteDesktopconnectionauthorizationpoicy{ROCAP)allowsyou tospeafytheus= whocanconnecttothisRDGatewayserver.
.O
rnrd
,er
-3
Poicy C,ApptiedinOrderUsted) UserGroups OientComputerGroups Status
Default-CAP vaecdemoOomainAdmins;vae...Not applicableviocomputer gr... Enabled
••
Alowed-RO{i atewayAccess vaecdemoOoman Admns;vae... Not applicableviocomputergr... Enabled
Apply this policywhen a user attempts to connect to the RDGatewayserver:
If the user isa member of any of the following usergroups:
vaecdemo Domain Users
If the client computer isa member of anyof the following compu te r groups:
Not applicable (no computer group is specified)
If the user uses the following supported Windows aut hentication methods:
Password or smart card
Allow the user to connect to this RD Gateway server and disable device redirection for the following client devices:
Not applicab le(device redirectionis allowed for all clientdevices )
After the idle timeout is reached:
-Not applicable (no idle timeout)
After the session timeout is reached:
- Not applicable(no session timeo ut)
Ifthe userdoes not meet the conditions of thi.s policy, then RDGateway attempts to verify wheth er the user meets the conditions for the next policyin the list.
..,
=
Actions
Connection Authorization Policies ..
►
►
Create New Policy
61Configure Central RDCAP
View
19.Refresh
6 Help
..PIVauthorization
Move Up
• MoveDown
@ Disable
)( Delete
□ Properties
6 Help

RDGateway Manager
.;--.. 1_.rmliJ tim
X
RDGatewayManager
,:l EC2AMAZ-NTOAJFQ(Local)
K2AMAZ-NTOAJFQ(LocaO
EC2AMAZ-NTOAJFQPropert iesRDGateway Server Status:EC2AMAZ
ConnectionStatus
Total number of connections
ServerFann
General
Audlng
SSLCertificate
SSLBndong
TransportSettings
Messaong
RDCAPStore
X
Number of users connected to this server
Number of resources thatusers are connec
ConfigurationStatus
CertificateisneededfOfsecurecoomunicatlonal HTTPSIUDPUstenersandforNAP
messaging.CertificateisautomaticallyboundtotheconfiguredHTTPand UDPports.
i. Thefollowiig certificateisn staled onEC2AMAZ-NTOAJFQ
.DConnection authorization policies
':.tJResource authorization policies
,:l RDGateway server farm members
Issuedto:
Issuedby :
E,cpirationdate: 2/25/2020
corrc:,ute-1.amaoznaws.com
compute-1.amaoznaws.com
Specifythetype al SSLcertilcate toImport forthe RDGatewayserverby doingoneal
the folowing:
0 Createasef-s ignedcertficate
I
=@ Select an eiostingcertificate fromthe RDGatewayEC2AMAZ-NTOAJFQ
Certificates(LocalComputer)/Personalstore
ImportCertiicate...
0 Importacertilcate into the RDGatewayEC2AMAZ-NTOAJFQ
Certiicates (LocalComputer)/Personalstore
I
OK Cancel I fpply
Actions
...
EC2AMAZ-NTOAJFQ(Local)
Do not manage thisserver
Export policyand configuration settings
Import policy and configuration settings
@ Properties
View ►
LQ;Refre sh
6 Help
Imports RDGateway configuration and policies from an xml file
2:41 PM
== p (OJ e P!'I 0 c1x 09/6/2019

RDGateway Manage r
X
RDGatewayManager
,:lEC2AMAZ-NTOAJFQ(Local)
K2AMAZ-NTOAJFQ(LocaO
EC2AMAZ·NTOAJFQPropertiesRDGat ewayServer Status: E C 2 A M A Z
ConnectionStatus
Total number of connections
ServerFann
General
Audlng
SSLCertificate
SSLBndgng
TransportSettings
Messagng
RDCAPStore
X
Number of users connected to this server
Number of resources thatusers are connec
Configuration Status
Usingthesettlngsbelow.youcan modifytheIP/PortsforHTTPandUDPtransports.Note:
BothRPC-HTTPandHTTPtransport sharethesamesettings.
Connection authorization policies HTTPTransportSettings
Resource authorization policies
:JRDGateway server farm members
IPAddress /!JIUnassigned V
I
••
HTTPS Port ( defaut 443) ._4_143 I.
TTPPortd au 80
UDPTransport Settings
0 EnableUDPtransport
IPAddress /!JIUnassigned v
Port( default3391)
OK Cancel I fpply
Actions
..EC2AMAZ-NTOAJFQ(Loca l)
Do not manage this server
Export policy and configuration settings
Importpolicy and configurationsettings
ffi Properties
View ►
LQ;Refresh
6 Help
2:42 PM
== p [OJ e e'.'I r.a O c1x 09/6/2019

Reference information
Documentation
AWS Directory Service—aws.amazon.com/directoryservice
AWS Security Blog—aws.amazon.com/blogs/security/ (search for “AWS Managed
Microsoft AD”)
• AWS What’s New—aws.amazon.com/new/ (Security, Identity & Compliance)
AWS Managed Microsoft AD—aws.amazon.com/documentation/directory-service/
RDS for SQL Server—aws.amazon.com/documentation/rds/
AWS Quick Starts— aws.amazon.com/quickstart/
Active Directory Domain Services
Exchange Server 2013
SharePoint Server 2016 Enterprise
Lync Server 2013
SQL Server 2014 AlwaysOn
Windows PowerShell DSC

Operationalizing Microsoft Workloads, AWS Federal Pop-Up Loft

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Operationalizing Microsoft Workloads, AWS Federal Pop-Up Loft

Similar to Operationalizing Microsoft Workloads, AWS Federal Pop-Up Loft (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Operationalizing Microsoft Workloads, AWS Federal Pop-Up Loft