Hybrid architectures in AWS can integrate on-premises infrastructure and AWS services. This allows consuming infrastructure resources across both environments as a pooled set of resources. There are various forms hybrid can take including integrated patterns that combine services, split tiers across on-premises and AWS, and integrated infrastructure using VPN or Direct Connect. Financial services companies can realize benefits like increased agility, cost savings, and business opportunities by implementing hybrid architectures on AWS.

1. HybridArchitectures inAWS
AviewonFinServ
Felix Candelario
Global Solutions Architect – Financial Services
Time : 13:00 – 13:40

2. Hybrid Overview
Consumption of Cloud Services and On-Premises Infrastructure into an
aggregated pool of resources.
On-Premises
Infrastructure
Services
Platform
Solutions
Cloud
Services
Infrastructure

3. Layers
Data
Applications
Management Services
Operating Systems
Hypervisors
Network
Data Center
On-Premises
DC
AWS
Corporate Data
Centers
Store, Replicate, Archive
Burst, Scale, x86
Management Services
Operating Systems
Amazon EC2
VPC, Direct Connect
Availability Zones, Regions

4. Hybrid Comes in Many Forms
VPCVPN Backup &
archive
Storage
expansion
Integrated
Stacks
AWS Direct
Connect
Authentication Federation
Operations Tools
and Monitoring
Start
Integrated
Patterns
Integrated
Infrastructure
Integrated
Services
Integrated
Platform
Integrated
Solution
CI/CDManaged AWS
Services
Split Tiers

5. Integrated Patterns

6. Split Tiers – AWS Front End
AWS region
Web
Layer
Private
Connection
Your Data Center
Internet
App
Layer
Database
Layer

7. Split Tiers – On-premises DMZ
AWS region
Private
Connection
Internet
Web
Layer
App
Layer
DB
Layer
Your Data Center
Web
Layer

8. Split Tiers – One Arm
AWS region
Private
Connection
Internet
App
Layer
Web
Layer
DB
Layer
Web
Layer
Your Data Center
App
Layer

9. Integrated Infrastructure

10. AWS Virtual Private Network (IPSec VPN)
• IPSec hardware VPN connection
Supported VPN appliances:
• Encryption and Validation
• Private RFC 1918 Addressing
• Uses Border Gateway Protocol (BGP)
for routing and fail-over
• VPN Service provides managed
redundant end-points
http://docs.aws.amazon.com/AmazonVPC/latest/UserGui
de/VPC_VPN.html
Virtual
Gateway
On-Premesis
Users
Data center router
Servers
Internet
IPSec VPN
VPC Subnet
Availability
Zone
Security Group
VPC Subnet
Availability
Zone
Security Group

11. AWS Direct Connect
• Requires Layer 2 single mode fiber
1000BASE-LX or 10GBASE-LR
• Requires 802.1Q VLANs across
connection.
– Tagging of IP traffic
• Routing uses BGP A/A or A/P multipath.
• Each DX is mapped to a single AWS
Region
http://aws.amazon.com/directconnect/
Customer
router
AWS Direct
Connect Location
AWS Direct
Connect routers
On-Premises
Users
Data center router
Servers
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Virtual
Gateway

12. AWS Direct Connect + AWS VPN
• Dedicated network path with assured
bandwidth
• More secure than Internet-based IPSec
VPN – avoids internet traverse
• Reduced IPSec network transfer costs
• Additional Network Security
http://aws.amazon.com/directconnect/
Customer
router
AWS Direct
Connect Location
AWS Direct
Connect routers
On-Premise
Users
Data center router
Servers
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Virtual
Gateway
IPSec
VPN

13. Integrated Services

14. Active Directory and LDAP
• Reduced back-reach Traffic
• Reduced Latency for Authentication
• Additional Resiliency
• Enablement of both:
– Multi-Master Read/Write Domain
Controllers
– Read-only Domain Controllers (RODCs)
• Requires IPSec VPN or Direct Connect
connectivity
Customer
router
AWS Direct Connect
Location
AWS Direct
Connect routers
Virtual
Gateway
On Premises
Users
Data center router
Server
s
VPC Subnet
Availability Zone
Security Groups
VPC Subnet
Availability Zone
Security Groups
AD.Domain
Domain
controller
Domain
controller
Domain
controller
Active Directory
Replication

15. AWS Directory Service
• Three types of directories
– Microsoft AD
– AD Connector
– Simple AD - built on Samba 4 Active
Directory compatible server
• Simplifies IAM Federation
• Avoids complexity and cost of hosting
SAML-based federation infrastructure
• Acts as a proxy - no data is stored on
AWS infrastructure
• Supports existing RADIUS-based MFA
• Requires IPSec VPN or Direct Connect
connectivity
http://aws.amazon.com/directoryservice/
Customer
router
AWS Direct
Connect Location
AWS Direct
Connect routers
Virtual
Gatewa
y
On-Premesis
Users
Data center
router
Server
s
VPC Subnet
Availability Zone
Security Groups
VPC Subnet
Availability Zone
Security Groups
AD.Domain
Domain
controller
AD Connector
AD Connector
AD Connector

16. Identity Federation
Customer (Identity Provider) AWS Cloud (Relying Party)
AWS Resources
User
Application
Active
Directory
Federation Proxy
4
Get Federation
Token Request
3
2
Amazon S3
Bucket
with Objects
Amazon
DynamoDB
Amazon
EC2
Request
Session 1
Receive
Session6
5
Get Federation Token
Response
• Access Key
• Secret Key
• Session Token
APP
Federation
Proxy
• Uses a set of IAM user credentials to
make a GetFederationTokenRequest()
• IAM user permissions need to be the
union of all federated user permissions
• Proxy needs to securely store these
privileged credentials
Call AWS APIs7

17. Operational Tools and Monitoring
• Security Monitoring integration points
with with CloudTrail and SIEM
Aggregator.
• Logging with CloudTrail and SNMP
MIBs to SIEM Aggregator.
• Platform and App Health to SIEM
Aggregator via agent on EC2 guest.
• Access to Patching and Updates for
AMI by on premises Update Server.
Customer
router
AWS Direct
Connect Location
AWS Direct
Connect routers
Virtual
Gatewa
y
On-Premises
Users
Data center router
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Update
Server
s SIEM
Aggregator
CloudTrail
CloudWatch
CloudTrail
S3 Bucket

18. Integrated Platform

19. Continuous Integration and Deployment
• Automates application deployments for
both On-Premise and AWS EC2
instances with use of CodeDeploy
• Reuse existing scripts and tools
– Bash, PowerShell, Chef, Puppet,
anything…
• Integrate with developer tool chain
– GitHub, Jenkins, CloudBees, TravisCI,
Eclipse…
Customer
router
AWS Direct
Connect Location
AWS Direct Connect
routers
Virtual
Gateway
On-Premises
Users
Data center router
VPC Subnet
Availability
Zone
Security Group
VPC Subnet
Availability
Zone
Security Group
AWS CodeDeploy
Servers
AWS
CloudFormation
S3 bucket
AgentAgentAgent
AgentAgentAgent

20. Managed AWS Services
• AWS Managed Services:
– Compute: Amazon ECR/ECS AWS
Lambda, AWS Elastic Beanstalk
– Storage: Amazon EFS
– Databases: Amazon RDS, Amazon
DynamoDB, Amazon Elasticache
– Analytics: Amazon EMR, Amazon
Elasticsearch Service, Amazon Kinesis,
Amazon Redshift
– Security:: AWS Directory Service, AWS
KMS
• Managed Services Advantages
– Flexibility and Agility, Scalability
– Security
– Automated Maintenance & Upgrade
Customer
router
AWS Direct
Connect Location
AWS Direct
Connect routers
Virtual
Gateway
On-Premises
Users
Data center router
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Servers
S3 bucket
Apache
Kafka
Amazon RedshiftAmazon EMR
Amazon RedshiftAmazon EMR

21. Integrated Solution

22. Backup and Archive
• Backup gateways integrated with
Amazon S3
– Leverage Amazon S3 archival to
Amazon Glacier
• Take advantage of current investments
and solutions for options
– De-duplication
– Compression
– WAN Acceleration
Customer
router
AWS Direct Connect
Location
AWS Direct
Connect routers
Virtual
Gatewa
y
On-premises
Users
Data center router
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Amazon S3
Amazon
Glacier
AWS Storage
Gateway
iSCSI
Backup
System
AWS Storage
Gateway
iSCSI
Servers
AWS
Storage
Gateway

23. Hybrid Examples

24. “For our market
surveillance systems, we
are looking at about 40%
[savings with AWS], but the
real benefits are the
business benefits: We can
do things that we physically
weren’t able to do before,
and that is priceless.”
- Steve Randich, CIO
What FINRA needed
• Infrastructure for its market surveillance platform
• Support of analysis and storage of approximately 30
billion market events every day
Why they chose AWS
• Fulfillment of FINRA’s security requirements
• Ability to create a flexible platform using dynamic
clusters (Hadoop, Hive, and HBase), Amazon EMR,
and Amazon S3
Benefits realized
• Increased agility, speed, and cost savings
• Estimated savings of $10-20m annually by using AWS
Case Study: Re-architecting Compliance

25. “Using AWS helps us
reduce a 10-day process
to 10 minutes.
That’s trans-formative: it
broadens our ability to
discover.”
- Peter Phillips,
Managing Director
What Aon needed
• Perform actuarial calculations with greater computing
power
• Information delivery within shorter time frames and less
cost
Why they chose AWS
• Ability to spin up large numbers of Graphical Processing
Units (or GPUs) quickly and inexpensively
• Quick delivery of an entire environment and functionality
Benefits realized
• By processing on AWS, recalculating policies takes
minutes rather than hours or days
• Ability to deliver client solutions more quickly, with richer
risk assessments
Case Study: High Performance Computing (HPC)

26. What Nasdaq needed
• Replacement of on-premises legacy warehouse
• Reduction of cost and increase in data capacity
Why they chose AWS (specifically Amazon Redshift)
• Fulfillment of security and regulatory requirements
• Cost efficiencies without sacrificing functionalities
Benefits realized
• System that moves an average of 5.5 billion rows into
Amazon Redshift every day (with 14 billion on a peak
day in Oct of 2014)
• Ability to increase accessibility of historic data to a
growing number of internal groups
“The Nasdaq Group has
been a user of Amazon
Redshift since it was
released and we are
extremely happy with it….
Currently, our system is
moving an average of 5.5
billion rows into Amazon
Redshift every day.”
- Nate Simmons,
Principal Architect
Case Study: Big Data Analytics

27. What ISE needed
• SEC determined ISE’s disaster recovery was not
geographically diverse. They needed to build a robust
and resilient DR solution with a 2 hour RTO
Why they chose AWS
• Global reach to enable geographic diversity
• Performance of products and services
• Easy automation
Benefits realized
• Abstracted away physical infrastructure
• Ability to add capacity as required
• Mobility associated with global reach
Case Study: Re-architecting ISE’s DR Solution

28. Thank you