Top Banner
AWS: Basic Architecture Session SUNEY SHARMA Solutions Architect: AWS [email protected]
87

AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Mar 17, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AWS: Basic Architecture Session SUNEY SHARMA Solutions Architect: AWS [email protected]

Page 2: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AWS Core Infrastructure and Services

AWSTechnicalEssen/als3.8ILT

Security

Network

Security

Network

Security Groups NACLs Access Mgmt

VPCVPC EC2 “Classic”

“Public”

ELB On-Demand Provision

Traditional Infrastructure Amazon Web Services

ServersAMI Amazon EC2 Instances On-Premises Servers

SecuritySecurity Groups NACLs AWS IAM Firewalls ACLs Administrators

NetworkingVPC ELB Router Network Pipeline Switch

Storageand

DatabaseRDBMS DAS SAN NAS Amazon

EBS Amazon

EFS Amazon

S3 Amazon

RDS

Page 3: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

PublicELB

InternalELB

RDSMaster

Usersoverinternet

InternetGateway

RDSStandby

CorporatePremises

VirtualPrivateGatewayCustomerGateway

VPNConnec@on

DirectConnect

CorporateUsers

S3

AZ1 AZ2

NatGateway NatGateway

InternetRoute53

Web-Autoscaling

App-Autoscaling

Mul/-AZRDS

Snapshot

PrivateSubnet

AmazonElas/Cache

PrivateSubnet

AmazonElas/Cache

AmazonCloudFront

Sta/

cCo

nten

t

DynamicContent

AmazonDynamoDB

Sessionstate

AmazonElas/Cache

SessionState

AmazonElas/Cache

SessionState

AmazonGlacier

Page 4: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

PublicELB

InternalELB

RDSMaster

Usersoverinternet

InternetGateway

RDSStandby

CorporatePremises

VirtualPrivateGatewayCustomerGateway

VPNConnec@on

DirectConnect

CorporateUsers

S3

AZ1 AZ2

NatGateway NatGateway

Internet

Web-Autoscaling

App-Autoscaling

Mul/-AZRDS

Snapshot AmazonElas/Cache

AmazonCloudFront

Sta/

cCo

nten

t

DynamicContent

AmazonGlacier

Page 5: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Usersoverinternet

InternetGateway

AZ1 AZ2

Internet

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

Page 6: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Let’sdiscuss

•  Whatisaregion?•  WhatisanAZ?•  WhatisaVPCandwhataresubnets?•  WhatareNACLandSecurityGroups

Page 7: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AWSGlobalInfrastructure

Page 8: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Achieving High Availability Using Multi-AZ

Availability

Zone - A Availability Zone - B

Availability Zone - C

Region

Page 9: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AmazonVirtualPrivateCloud(VPC)•  Provisionalogicallyisolatedsec/onoftheAWScloud

•  Controlyourvirtualnetworkingenvironment–  Subnets–  RouteTables–  SecurityGroups–  NetworkACLs

•  Connecttoyouron-premisesnetworkviahwVPN

•  ControlifandhowyourinstancesaccesstheInternet

Page 10: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2Instance

VPC

Page 11: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

172.31.0.128

172.31.0.129

172.31.1.24

172.31.1.27

VPC

VPC&Subnets

Page 12: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AvailabilityZone1a AvailabilityZone1b

Internet

10.0.0.5

10.0.0.6

10.0.3.17

10.0.3.5

10.0.1.5

10.0.1.25 10.0.1.8

10.0.1.6

VPCSubnet

VPCSubnet

VPCSubnet

VirtualPrivateGateway

CustomerGateway

VPNConnec@on

InternetGateway

CustomerDataCenter

Page 13: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

ChoosingIPaddressrangesforyoursubnets172.31.0.0/16

Availability Zone Availability Zone Availability Zone VPC subnet VPC subnet VPC subnet

172.31.0.0/24 172.31.1.0/24 172.31.2.0/24

eu-west-1a eu-west-1b eu-west-1c

Page 14: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Authorizingtraffic:NetworkACLssecuritygroups

Page 15: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

NetworkACLs=statelessfirewallrules

Englishtransla/on:Allowalltrafficin

Canbeappliedonasubnetbasis

Page 16: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

SecurityGroups

Page 17: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Securitygroups=statefulfirewall

InEnglish:HostsinthisgrouparereachablefromtheInternetonport80(HTTP)

Page 18: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Usersoverinternet

InternetGateway

CorporatePremises

CustomerGateway

VPNConnec@on

DirectConnect

CorporateUsers

AZ1 AZ2

Internet

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

VirtualPrivateGateway

Page 19: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Let’sdiscuss

•  WhataretheVPCconnec/vityop/ons?

Page 20: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Connec/vityOp/onsTobeginwiththereisinternetandaddi/onally:•  VPN•  DirectConnect

Page 21: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

VPNconnec/ons

Page 22: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

VPNconnec/ons

Page 23: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

DirectConnect

Page 24: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

PublicELB

InternalELB

Usersoverinternet

InternetGateway

CorporatePremises

VirtualPrivateGatewayCustomerGateway

VPNConnec@on

DirectConnect

CorporateUsers

AZ1 AZ2

NatGateway NatGateway

Internet

Web-Autoscaling

App-Autoscaling

Page 25: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Let’sdiscuss

•  NATGateway•  ELB

Page 26: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

NATGateway

Page 27: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

NATAvailableas:

•  EC2InstancerunningaLinuxAMI.•  ManagedNATservicefromAWS.

Page 28: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Elastic Load Balancing Example

Page 29: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

PublicSubnet PublicSubnet

PrivateSubnet PrivateSubnet

PrivateSubnet PrivateSubnet

PublicELB

InternalELB

Usersoverinternet

InternetGateway

CorporatePremises

VirtualPrivateGatewayCustomerGateway

VPNConnec@on

DirectConnect

CorporateUsers

AZ1 AZ2

NatGateway NatGateway

Internet

Web-Autoscaling

App-Autoscaling

Page 30: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Let’sdiscuss

•  EC2•  Autoscaling

Page 31: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AmazonElas/cComputeCloud(EC2)- Elas/cvirtualserversinthecloud

Physical Servers in AWS Global Regions

HostserverHypervisor

Guest1 Guest2 GuestnEC2Instances

Page 32: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2instances:FamiliesandGenera/ons

General-purpose: M1,M3,M4,T2Compute-op/mized: C1,CC2,C3,C4Memory-op/mized: M2,CR1,R3Dense-storage: HS1,D2I/O-op/mized: HI1,I2GPU: CG1,G2Micro: T1,T2

Page 33: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

c4.large Instance family

Instance generation

Instance size

EC2 instances: Types and Sizes

Page 34: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

StorageOp/ons•  Locallyafachedor“instancestorage”•  AmazonEBSGeneralPurpose(SSD)volumes•  AmazonEBSProvisionedIOPS(SSD)volumes•  AmazonEBSMagne/cvolumes•  AmazonS3andAmazonGlacierforobjectstorage

Page 35: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

AMIDetailsAnAMIincludesthefollowing:•  Atemplatefortherootvolumefortheinstance(forexample,anopera/ngsystem,anapplica/onserver,andapplica/ons).

•  LaunchpermissionsthatcontrolwhichAWSaccountscanusetheAMItolaunchinstances.

•  Ablockdevicemappingthatspecifiesthevolumestoafachtotheinstancewhenit'slaunched.

Page 36: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Amazon EC2 Instances

OS, Applications, & Configuration

AMI

Running or Stopped VM

Instances

AZ

VPC

Region

EBS

S3

EBS Snapshots S3 Buckets

EBS EBS EBS EBS EBS

AZ

Instances Instances

Page 37: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Page 38: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Page 39: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

Page 40: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

1serverfor8hours

Page 41: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

1serverfor8hours 1serverfor8hours

Page 42: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

1serverfor8hours 1serverfor8hours

1serverfor8hours

Page 43: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

1serverfor8hours 1serverfor8hours

1serverfor8hours

1serverfor8hours

Page 44: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Serverload

Hourofday

Capacityof1server

Tradi/onalcapacityrequired

1/3rdsaving

Page 45: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0

1

2

3

4

5

6

0 1 2 3 4 5 6 7 8 9101112131415161718192021222324252627282930

Instan

cecou

nt

Dayofmonth

Page 46: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0

1

2

3

4

5

6

0 1 2 3 4 5 6 7 8 9101112131415161718192021222324252627282930

Instan

cecou

nt

Dayofmonth

Monthlypredictable

peakprocessing

Page 47: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0

1

2

3

4

5

6

0 1 2 3 4 5 6 7 8 9101112131415161718192021222324252627282930

Instan

cecou

nt

Dayofmonth

Tradi/onalcapacityrequired

Page 48: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0

1

2

3

4

5

6

0 1 2 3 4 5 6 7 8 9101112131415161718192021222324252627282930

Instan

cecou

nt

Dayofmonth

Elas/ccapacity

Tradi/onalcapacityrequired

Page 49: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

0

1

2

3

4

5

6

0 1 2 3 4 5 6 7 8 9101112131415161718192021222324252627282930

Instan

cecou

nt

Dayofmonth

75%savings

Tradi/onalcapacityrequired

Elas/ccapacity

Page 50: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Trio of Services Elastic Load Balancing

CloudWatch Auto Scaling Execute Scaling

Policy

CPU Utilization

AWSomeDays3.8

Page 51: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSvolume

AvailabilityZone

AWSregion

EC2instance

Page 52: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSboot

volume

AvailabilityZone

AWSregion

EC2instance

EBSdata

volume

EBSdata

volume

Page 53: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSvolume

AvailabilityZone AvailabilityZone

AWSregion

Replica

Page 54: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSvolume

AvailabilityZone

AWSregion

AmazonS3 EBSsnapshot

AvailabilityZone

Replica

Page 55: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSvolume

AvailabilityZone

AWSregion

AmazonS3 EBSsnapshot

AvailabilityZone

EBSvolume

Replica Replica

Page 56: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatisAmazonEBS?

EBSvolume

AvailabilityZone

AWSregion

AmazonS3 EBSsnapshot

EBSvolume

AvailabilityZone

AWSregion

EBSsnapshot

Replica Replica

Page 57: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatifanEBSvolumefails?

EBSvolume

AvailabilityZone

EC2instance

AWSregion

EBSvolume

Replica

Page 58: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhatifanEBSvolumefails?

AvailabilityZone

EBSvolume

EC2instance

AWSregion

Replica

Page 59: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhataboutEC2instancefailure?

AvailabilityZone

AWSregion

EBSvolume

EC2instance

Replica

Page 60: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

WhataboutEC2instancefailure?

AvailabilityZone

AWSregion

EBSvolume

NewEC2instance

Replica

Page 61: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes

Page 62: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Afewdefini/ons…IOPS:Input/outputopera/onspersecond(#)

Throughput:Read/writeratetostorage(MB/s)

Latency:Delaybetweenrequestandcomple/on(ms)

Capacity:Volumeofdatathatcanbestored(GB)

Blocksize:SizeofeachI/O(KB)

Page 63: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes

HarddiskdriveSolidstatedrive

Page 64: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes

GeneralPurposeSSD

gp2!ProvisionedIOPS

SSD

io1!ThroughputOp/mized

HDD

st1!ColdHDD

sc1!

SSD HDD

Page 65: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes:I/OProvisioned

GeneralPurposeSSD

gp2!

Throughput:160MB/s

Latency:Single-digitms

Capacity:1GBto16TB

Baseline:3IOPSperGBupto10,000

Greatforbootvolumes,lowlatencyapplica6onsandburstydatabases

Page 66: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes:I/OProvisioned

ProvisionedIOPSSSD

io1!

Baseline:100to20,000IOPS

Throughput:320MB/s

Latency:Single-digitms

Capacity:4GBto16TB

Idealforcri6calapplica6onsanddatabaseswithsustainedIOPS

Page 67: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSVolumeTypes:ThroughputProvisioned

NEW!

ThroughputOp/mizedHDD

st1!

Baseline:40MB/sperTBupto500MB/s

Capacity:500GBto16TB

Burst:250MB/sperTBupto500MB/s

Idealforlargeblock,highthroughputsequen6alworkloads

Page 68: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

NEW!

ColdHDD

sc1

EBSVolumeTypes:ThroughputProvisioned

Baseline:12MB/sperTBupto192MB/s

Capacity:500GBto16TB

Burst:80MB/sperTBupto250MB/s

Idealforsequen6althroughputworkloadssuchasloggingandbackup

Page 69: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

IOProvisionedVolumes ThroughputProvisionedVolumes

sc1!st1!io1!gp2!

$0.10perGB $0.125perGB$0.065perPIOPS

*Allpricesarepermonthandfromtheus-west-2regionasofApril2016

$0.045perGB $0.025perGB

Page 70: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Performance:BandwidthMafers

EBSc3.2xlarge

EC2instances

Internet

Databases

~125MB/s

S3

c3.8xlarge

10Gbps~1250MB/s

Page 71: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Performance:EBS-Op/mizedInstances

Formaxthroughputsta/s/csperinstancetypes,see:hfp://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSOp/mized.html

•  DedicatednetworkbandwidthforEBSI/O

•  Enabledbydefaultonc4,d2,andm4instances

•  Canbeenabledatinstancelaunchoronarunninginstance

•  Notanop/ononsome10Gbpsinstancetypes(c3.8xlarge,r3.8xlarge,i2.8xlarge)

Page 72: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Performance:EBS-Op/mizedInstances

EBS

EC2instances InternetDatabases

c3.2xlarge

~125MB/s

S3

Page 73: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

BestPrac/ce:RAID

WhentoRAID?•  Storagerequirement>16TB

•  Throughputrequirement>500MB/s

•  IOPSrequirement>20,000@16K

Page 74: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

BestPrac/ce:RAID

EBSvolume

AvailabilityZone

AWSregion

EC2instance

EBSvolume

RAID0RAID0

Replica Replica

Page 75: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

BestPrac/ce:RAID

AvoidRAIDforredundancy

•  RAID1halvesavailableEBSbandwidth

•  RAID5/6loses20–30%ofusableI/Otoparity

Page 76: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

BestPrac/ce:Security

EBSencryp@on

•  Afachbothencryptedandunencrypted

•  Novolumeperformanceimpact

•  Anycurrentgenera/oninstance

•  SupportedbyallEBSvolumetypes

•  Snapshotsalsoencrypted

•  Noextracost

Page 77: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

BestPrac/ce:Security

EBSencryp@on:datavolumes

Page 78: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

HowAWSpricingwork•  Payasyougo:Nominimumcommitments•  Paylesswhenyoureserve•  Payevenlessperunitbyusingmore•  PayevenlessasAWSgrows:44pricedropssince2006

•  CustomPricing

Page 79: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

PlusServicesofferedfreeofcost•  AmazonVPC•  AWSElas/cBeanstalk•  AWSCloudforma/on•  AWSIden/tyandAccessManagement•  Autoscaling•  AWSOpsworks

Page 80: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

FundamentalPricingCharacters/cs•  Fundamentalcharacters/csyoupayfor:

–  Compute–  Storage–  Datatransferout

•  Customersarechargedfordataxferout.•  DataxferintoAWSisfree.•  OutbounddatatransferisaggregatedacrossAmazonEC2,AmazonS3,AmazonRDS,AmazonSimpleDB,AmazonSQS,AmazonSNS,andAmazonVPC

Page 81: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2PurchasingOp/ons•  OnDemand•  Reserved•  Spot•  DedicatedHosts

Page 82: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2ReservedInstances

Page 83: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2DedicatedHosts&Instances

Page 84: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EC2costs:Pointstoconsider•  Serverclockhours•  Instanceconfigura/on•  InstancePurchaseop/on•  NumberofInstances•  LoadBalancing•  Detailedmonitoring•  Autoscaling•  Elas/cIP•  OSandSoxware

Page 85: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

S3costs:Pointstoconsider•  Storageclass•  Storage•  Numberofrequests•  DataTransfer

Page 86: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

EBSCosts:Pointstoconsider•  Volume(GB)provisioned•  IOPsprovisioned•  Snapshot•  DataTransfer

Page 87: AWS: Basic Architecture Session · 2016-09-02 · AWS Core Infrastructure and Services AWS Technical Essen/als 3.8 ILT Security Network Security Network Security Groups NACLs Access

Complicated?Wellyouhaveagreattool

•  hfp://calculator.s3.amazonaws.com/index.htmlAWSSimplemonthlycalculator


Related Documents
Introduction to AWS Security - AWS Whitepaper · 01/07/2015  · Introduction to AWS Security AWS Whitepaper Abstract Introduction to AWS Security Publication date: January 2020 (Document

Introduction to AWS Security - AWS Whitepaper · 01/07/2015...

Category: Documents
Aws meetup aws security 06112015 final 1

Aws meetup aws security 06112015 final 1

Category: Presentations & Public Speaking
Network Security & Access Control in AWS - … · © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Ian Massingham, Technical Evangelist Network Security

Network Security & Access Control in AWS - … · © 2015,....

Category: Documents
AWS Security Strategy

AWS Security Strategy

Category: Technology
Network Security & Access Control in AWS - · PDF fileNetwork Security & Access Control in AWS ... AWS Network Security - VPC Building a Trust Zone architecture. Availability Zone

Network Security & Access Control in AWS - · PDF...

Category: Documents
AWS Webcast - Security Best Practices on AWS

AWS Webcast - Security Best Practices on AWS

Category: Technology
Security Pillar - AWS

Security Pillar - AWS

Category: Documents
AWS network and infrastructure security - deloitte.com · One component of Deloitte’s Cyber framework describes reference security architecture patterns to protect the AWS network

AWS network and infrastructure security - deloitte.com ·.....

Category: Documents
AWS Security Overview · | #cloudsec AWS Security Overview Ridge XU, Solutions Architect, AWS

AWS Security Overview · | #cloudsec AWS Security Overview...

Category: Documents
AWS Security Incident Response Guide - AWS Technical Guide...AWS Security Incident Response Guide AWS Technical Guide AWS Security Incident Response Guide Publication date: November

AWS Security Incident Response Guide - AWS Technical...

Category: Documents
AWS Security Reference Architecture (AWS SRA)

AWS Security Reference Architecture (AWS SRA)

Category: Documents
AWS Security Whitepaper

AWS Security Whitepaper

Category: Documents