Over the past decade, Verizon built significant investments in on-premises technology. Migrating legacy applications and IT systems takes time, so architecting a secure and performant hybrid architecture is essential to Verizon’s cloud adoption. In this session, you see how Verizon operationalized their existing on-premises IT infrastructure with AWS while providing the flexibility needed for both modern and legacy applications. Verizon solved extremely challenging enterprise constraints. Learn from Verizon’s cloud experience, and see the resulting architectures designed to meet strict security and compliance requirements while delivering faster application and system migration.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Verizon : Modernizing Enterprise
Infrastructure with AWS
A r s h a d A z i z , S r . M a n a g e r - V e r i z o n
C h i t r a P r a k a s h , D i r e c t o r - V e r i z o n
P u n e e t A g a r w a l , P r i n c i p a l S o l u t i o n s A r c h i t e c t - A W S
N o v e m b e r 2 9 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Introducing Verizon
Verizon is a global leader delivering innovative communications and technology solutions that improve
the way our customers live, work and play
We are Verizon
• Verizon delivers the promise
of the digital world
• Fortune 500
rank: #14
• $31.7B Q3 2017 revenue
• 160,100 employees
Third quarter 2017
Wireless leadership
LTE covers more than 98% of U.S. population
115.3 M retail connections
LTE Advanced covers 470 markets
Largest all-fiber Fios network
5.8 M Fios internet and 4.6 M Fios video connections
Fios Gigabit downloads as fast as 940 Mbps and
uploads as fast as 880 Mbps.
Global IP network
99% of Fortune 500 customers
Media and technology
Innovating in entertainment, digital
media, the Internet of Things and broadband service

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Public Cloud Journey – Where are we now?
Public Cloud Journey
Begins
Dec, 2015
Open for non production
Sep, 2016
2017
Apps migrations
in progress
1H, 2017
Q3, 2017
Open for Production
Migrate mission / business critical workloads to AWS
Production Readiness Activities

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS and Verizon Integration
15 Major Verizon
Platforms Integrated with
Multiple AWS Services
Ansible
Server
Automation
Active
Directory
Binary
Repository
Inventory
Orchestration
LDAP
Admin
Access
Certificate
Mgmt
Firewalls
AWS Certificate
Manager

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Services Configuration
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Account & Network Planning
● Highly redundant connectivity
● Corporate firewalls
● Accounts and VPC setup
● Blast radius controls
● Internet facing access
InternalCorporate
Network
Verizon
SCI
Cloud
Verizon
SCI
Cloud
Verizon
SCI
Cloud
AWS
Region
1
AWS
Region
2
AWS
Region
3

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DNS Integration
● Seamless integration between
Corporate DNS and AWS
● AWS Cloudtrail & Lambda used to
populate Corporate DNS via API
● AWS Route 53 for future
App
VPC 1
Shared Service
VPC
AWS CloudWatch
Logs
App
VPC 2
DNS
V1
DNS
V2
DNS
A2
DNS
A1
AWS Lambda

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Windows Active Directory
Private Subnet
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Users & Apps
Domain
Controllers
AD on EC2 with Replication and Trust
Domain
Controller
Trust or Replication
Auth/
LDAP
Auth/
LDAP
AD
EC2
AD
Availability Zone
Private Subnet
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Domain
Controller
Auth/
LDAP
EC2
AD
SQL
Server
App
Server
IIS
Server
Domain
Controller
Auth/
LDAP
EC2
AD
● AD on AWS EC2
● Integration with Corporate
AD Infrastructure
● Role based sub OUs
(web, app, db)
● Auto domain join
● CloudWatch based
termination

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Takeaway – Shared Services
• Long term approach to AWS account planning & VPC
sprawl
• Plan for High Redundancy
• Minimize complexity via Route53
• Investigate AWS Managed AD

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security Enforcement
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DevSecOps – Secure Infrastructure Code
Infrastructure Certification
Platform
• Infrastructure as Code
• Cloud Formation scan
• Run Time Environment Scan
• Digitally Signed Artifacts
• CI/CD pipeline verifies
artifact signatures
CF-NAG scanning the
Cloudformation Template
Config Rules Status (CRS)
scanning Certification
Infrastructure Port Scan
Certification
3 Check Certification Process [PPP]
P
P
P

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Certification Process
CFN-NAG Scan
Config Rule Scan
Infra Vulnerability
Scan
P cfn-nag Passed
P CRS Passed
P Port Scan Passed
Repository

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Certificate Management
Corporate Certificate Management System
used for Internal and AWS Certificates
• Trusted Certificate Authority (CA) used to
issue SSL CERTs
• Automated SSL Certificate retrieved and
upload to AWS Certificate Manager
• Certificates download for EC2 web servers
• ELB / ALB configured using ACM ARN
AWS
Certificate
Manager
ACM
Certificate
ELBEC2
User
Corporate
Certificate
Mgmt System
Certificate
Authority
1
2
4
5 6
3

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Takeaway – Security
• Automated Securing of Infrastructure code
• End to End Encryption via Keys and SSL Certificates

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Deployment Automation
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Deployment Pipeline
● Common standards between Internal and AWS
● Multi stage Jenkins pipelines
● IAM Role for Ansible
● CloudFormation Templates and Application
playbooks
● Integrated artifact repositories
● Challenges : Deployment failures, roll back and
pipeline monitoring / logging
● Future State : AWS CodeDeploy and CodePipelines
Ansible
Playbooks
Software
Packages
KMS

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Custom AMI Life Cycle Management
CF template
launch
1
2
publish
re-encrypt
3
6
re-encrypt
5
deployed
Instance
CI/CD
toolchain
customized
instance
encrypted AMI
encrypted AMI
4
End to End KMS Encryption based
customized AMI creation process
1. Encrypted Base AMI
2. Launch Stack to Deploy Instance
3. Install App / Middleware
4. Create AMI (encrypted with Base
KMS Key)
5. Copy Image to other region
6. Share to other accounts / regions
7. Re-encrypt again using Application
specific KMS Key
AWS
Region 1
AWS
Region 2
AWS Production
Environment
AWS Nonprod
Environment
AWS Staging
Environment
copy

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
EC2 Deployment Automation
• Starts with Verizon Core
Image
• Environmental
Configuration
• Register with Enterprise
Services
• Enable Access Control
• Critical Patches/Fixes
Access Control
Registration
Configuration
Critical Patching
Server Automation
Elevated Privileges
LDAP
Logging
Inventory
Patch Mgmt.

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Takeaway – Deployment Automation
• Infrastructure as Code
• Automated pipeline to stitch enterprise platform with
AWS
• AMI Customization with Encryption

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Governance & Monitoring
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Governance Automation
Resource
Tagging
Policy
Enforcement
Financial
Governance
Resource Governance
● Lambda based automation to Tag Resources
● EC2, EBS, RDS, S3 .. devices terminated for missing tags
Policy Enforcement
● Use Lambda for enforcing security policies
● VPC End Point Encryption for S3 Buckets
● Snapshot Policy Management
Tag Based Cost Allocation
● Setup for ingesting AWS usage via S3 buckets
● Tags used to allocate cost per Line of Business

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Logging Architecture on AWS
AWS
Apps
Log
Publishers
SNS
IAM
Aggregation
Cloud
Trail
AWS Lambda
Mitigation &
Alarming
Kinesis
Publishing
S3
Storage
Glacier
LTR
IAM
IAM
AWS Lambda
Cloud
Watch
S3

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
EC2 Build Tracking Dashboards
Proactive Patterns & TrendsReactive
Check all APIs and services in the
instance build flow
Shows real time instance build status
and timings
Provide historical trends and
patterns on instance builds, failures
& timings
Service Health Checks Build Health Checks Build & Error Patterns

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Sample: Macro Level Dashboards
2
6

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Takeaway – Governance & Monitoring
• Lambda based automation will save the day
• Dashboards for proactive/reactive trending

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Database Strategy & Approach
2
8
Overview
• AWS Cloud Journey
• Verizon & AWS Integration
Shared Services Configuration
• Account / Network Planning
• DNS Architecture
• Active Directory Design
Deployment Automation
• Integrated Deployment Pipeline
• Integrated AMI Life Cycle Management
• EC2 Build Automation
Security Enforcement
• DevSecOps
• Certificate Management
Governance & Monitoring
• Lambda Based Automation
• Logging & Monitoring Dashboards
Databases
• DB Strategy
• MS SQL Automation

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DB Strategy & Approach
Database Methodology
• Modernize the stack – end goal
• Slow process - Requires refactoring
• Leverage DBaaS offerings
• Lift & evolve
DB Rehydration
• Mandate to refresh all instances every 90
days
• Difficult for databases
• Technical challenges
• Disruptive processes
• Process challenges
DB on EC2 vs DBaaS
• Both options provide values / trade-offs
• All DBaaS have limitations
• Technical & process challenges
• On-prem integration matters
DB Automation
• Automated deployments & lifecycle
management via CI/CD tool chain
• Patterns to refresh one DB node at a time

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
MSSQL DB HA Instance [Always On]
EC2
AD
SQL Always On
MS SQLMS SQL
EBS
EBS
EBS
EBS
Cluster
Cloud
Formation
Template
Ansible
playbook
Reference HA Architecture using MSSQL
Always On
● MSSQL on EC2 setup via custom DB AMIs
● EC2 instances auto joined to AD
● Ansible Playbook used to create Windows
AD Cluster
● MSSQL instance configured with SQL
Always-On
● Automated Failover between Availability
Zones

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Takeaway – Database
• Enterprise DB process needs to be revamped for AWS
DBaaS
• Plan long term for stack modernization

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Next steps for us!

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
THANK YOU!