Introduction to Amazon Cloud & EC2 Overview

Transcription

1 Introduction to Amazon Cloud & EC2 Overview 2017 Amazon Web Services, Inc. and its affiliates. All rights served. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon Web Services, Inc.

2 Overview Introduction to AWS Cloud Overview of AWS most used service: EC2 EC2 Security Details

3 What is AWS? AWS provides a highly reliable, scalable, low-cost infrastructure platform in the cloud that powers hundreds of thousands of businesses in 190 countries around the world. Benefits Low Cost Elasticity & Agility Open & Flexible Secure Global Reach

4 What sets AWS apart? Experience Building and managing cloud since 2006 Service Breadth & Depth 90+ services to support any cloud workload Pace of Innovation History of rapid, customer-driven releases Global Footprint 16 regions, 42 availability zones, 73 edge locations Pricing Philosophy 59 proactive price reductions to date Ecosystem Thousands of consulting/system integrator & technology partners *as of July 31, 2014

5 Experience with Operational Reliability We are driven to remove any all causes of failure. Our goal is to make our operational performance indistinguishable from perfect. We have spent over a decade building the world s most reliable, secure, scalable, and cost-effective infrastructure. Service SLAs between 99.9% and 100% availability. Amazon S3 is designed for % durability. Availability Zones exist on isolated fault lines, flood plains, and electrical grids to substantially reduce the chance of simultaneous failure. The AWS Service Health Dashboard provides 24/7 visibility in the real-time operational status of all services around the globe.

6 Pricing Philosophy High volume / low margin businesses are in our core DNA Trade CapEX for variable expense Our economies of scale provide us with lower costs Pricing model choice to support variable and stable workloads Save more money as you grow bigger 62 price reductions since 2006 On-demand Reserved Instances Tiered pricing Volume discounts Spot Custom pricing

7 AWS Positioned as a Leader in the Gartner Magic Quadrant for Cloud Infrastructure as a Service, Worldwide* AWS is positioned highest in execution and furthest in vision within the Leaders Quadrant *Gartner, Magic Quadrant for Cloud Infrastructure as a Service, Worldwide, Leong, Lydia, Petri, Gregor, Gill, Bob, Dorosh, Mike, August This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from AWS : Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

8 1 Introduction to AWS

9 AWS Global Infrastructure 16 Regions 44 Availability Zones 74 Edge Locations Region & Number of Availability Zones AWS GovCloud (2) EU Ireland (3) US West Frankfurt (3) Oregon (3) London (2) Northern California (3) Asia Pacific US East Singapore (2) N. Virginia (6), Ohio (3) Sydney (3), Tokyo (3), Seoul (2), Mumbai (2) Canada Central (2) China Beijing (2) South America São Paulo (3) Announced Regions Paris, Ningxia, Stockholm, Hong Kong, AWS Gov Cloud East, Bahrain

10 AWS Regions and Availability Zones AWS Regions US East (VA) US EAST (OH) US West (CA) EU (Ireland) EU (Frankfurt) Asia Pacific (Mumbai) AZ A AZ E AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ C AZ D AZ C AZ C AZ C US West (OR) GovCloud (US) S. America (Sao Paulo) China (Beijing)* EU(London) Asia Pacific China (Seoul) (Bejing) AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ C AZ C Asia Pacific (Tokyo) Asia Pacific (Singapore) Asia Pacific (Sydney) Canada AZ A AZ B AZ A AZ B AZ A AZ B AZ A AZ B AZ C AZ C *The China (Beijing) Region is available to a select group of China-based and multinational companies with customers in China. These customers are required to create a AWS Account, with a set of credentials that are distinct and separate from other global AWS Accounts.

11 The AWS Platform Account Support Support Managed Services Professional Services Partner Ecosystem Training & Certification Solution Architects Account Management Security & Pricing Reports Technical Acct. Management Marketplace Business Applications DevOps Tools Business Intelligence Security Networking Database & Storage SaaS Subscriptions Operating Systems Migration Hybrid Application Services Security Database Storage Compute Networking Infrastructure Mgmt. Tools Monitoring Auditing Service Catalog Server Management Configuration Tracking Optimization Resource Templates Automation Application Discovery Data Integration Transcoding Identity & Access Analytics Query Large Data Sets Elasticsearch Business Analytics Hadoop/Spar k Real-time Data Streaming Orchestration Workflows Managed Search Managed ETL Application Migration Integrated Networking Data Migration Identity Federation Artificial Intelligence Deep Learning Voice & Text Chatbots Machine Learning Text-to- Speech Image Analysis Database Migration Resource Management IoT Rules Engine Local Compute and Sync Device Shadows Device Gateway Registry Server Migration VMware on AWS Aurora MySQL PostgreSQL Oracle SQL Server Object Storage Virtual Machines Isolated Resources Regions Step Functions Key Storage & Management Archive Simple Servers Dedicated Connections Availability Zones Dev Tools Private Git Repositories Continuous Delivery Build, Test, and Debug Deployment Messaging Active Directory Exabyte-scale Data Transport Web Applications Global CDN Points of Presence DDoS Protection Block Storage Auto Scaling Load Balancing Application Analysis Managed File Storage Batch Scalable DNS Mobile Build, Test, Monitor Apps Push Notifications Build, Deploy, Manage APIs Device Testing Identity Devices & Edge Systems Certificate Management MariaDB Containers Enterprise Applications Messaging Service Document Sharing & Calendaring Hosted Desktops Application Streaming Backup Web App. Firewall Data Warehousing Event-driven Computing Game Development 3D Game Engine Multi-player Backends NoSQL

12 With AWS, Security Is a Shared Responsibility Customers concentrate on systems and apps while AWS manages infrastructure. Security expertise is a scarce resource; AWS oversees the big picture, letting your security team focus on a subset of overall security needs. Facilities Physical security Compute infrastructure Storage infrastructure Network infrastructure Virtualization layer (EC2) Hardened service endpoints Rich IAM capabilities Network configuration Security groups OS firewalls + Operating systems = Application security Proper service configuration AuthN and account management Authorization policies More secure and compliant systems than any single entity could normally achieve on its own 12

13 Any Questions?

14 2 EC2 Overview

15 EC2 Terminology Instance VPC VPC AMI EBS EBS EBS EBS EBS EBS Virtual Machine Configuration Running or Stopped VM AZ Availability Zone EBS S3 Buckets Snapshots Amazon S3 Region

16 EC2 Network Environment VPC Virtual Private Cloud Bring your own network Customer-managed subnets and routing Additional network controls (Security Groups, NACLs, routing) Hardware VPN options between corporate networks Instances have Security Group controlled private IPs (dynamic public IPs or EIPs optional Default VPC Automatically assigned network and subnets (can now include NAT)

17 Broad Set of Compute Instance Types General purpose Compute optimized Storage and IO optimized GPU enabled Memory optimized M4 C4 I2 D2 P2 X1 M3 C3 R3

18 Purchasing options at a glance On-Demand Instances Pay as you go Flat hourly rate No commitment Reserved Instances Pay a low upfront price Reserve an instance slot Secure a low hourly rate Sell & modify reservations if your needs change Spot Instances Bid what you like your Spot instances run while your bid > the Spot price Save up to 90% off of On- Demand Run 1,000s of instances 10:00 10:05 10:10

19 EC2 Operating Systems Supported Windows 2003R2/2008/2008R2/2012/2012R2/2016 Amazon Linux Debian Suse CentOS Red Hat Enterprise Linux Ubuntu

20 Layer your options

21 3 EC2 Security and Design

22 Details of a Virtual Machine VM Workspace One or more ephemeral (temporary) drives Network I/O EBS Amazon S3 EBS Snapshot EBS Snapshot EBS Snapshot Hypervisor One or more EBS (persistent) drives

23 EBS AMI First Time Boot VM Workspace Network I/O EBS Drive attaches to hypervisor & boots Amazon S3 EBS Snapshot EBS Snapshot EBS Snapshot Hypervisor

24 EBS AMI Restart VM Workspace Network I/O EBS Drive reattached Amazon S3 EBS Snapshot EBS Snapshot EBS Snapshot Hypervisor

25 EBS AMI Terminate (Default behavior) VM Workspace Network I/O EBS Default behavior: Drive deleted Amazon S3 EBS Snapshot EBS Snapshot EBS Snapshot Hypervisor

26 EC2 Host Virtualization Customer Instances Small Large Small Physical Host Hypervisor Virtual Interfaces Security Groups Security Groups Security Groups Firewall Physical Interfaces

27 EC2 Security Groups Security Group Rules Name Description Protocol Port range IP address, IP range, Security Group name

28 Tiered EC2 Security Groups Hierarchical Security Group Rules Dynamically created rules Based on Security Group membership Create tiered network architectures Web Security Group: TCP /0 TCP 22 Mgmt App Security Group: TCP 8080 Web TCP 22 Mgmt DB Security Group: TCP 3306 App TCP 22 Mgmt Mgmt Security Group: TCP /32

29 EC2 IP Addressing Default VPC Dynamic Private IP Dynamic Public IP Optional Static Public IP (EIP) AWS-provided DNS names Private DNS name Public DNS name Virtual Private Cloud Dynamic or Static Private IP Address None by default (can be created with publicip=true) Optional Static Public IP (EIP) AWS-provided public DNS lookup AWS-provided private DNS names Customer-controlled DNS options

30 EC2-Specific Credentials EC2 key pairs Linux SSH key pair for first-time host login Windows Retrieve Administrator password Standard SSH RSA key pair Public/Private Keys Private keys are not stored by AWS AWS approach for providing initial access to a generic OS Secure Personalized Non-generic (NIST, PCI DSS) Public Half inserted by Amazon into each EC2 instance that you launch Private Half downloaded to your desktop

31 EC2 Instance access and Key Pairs Linux launch (first boot) Public key made available through metadata Public key inserted into ~/.ssh/authorized_keys User connects with SSH using their private key Instance Instance metadata RSA public key

32 EC2 Instance access and Key Pairs Linux launch (first boot) Public key made available through metadata Public key inserted into ~/.ssh/authorized_keys User connects with SSH using their private key Windows launch (first boot sequence) Public key made available through metadata Sysprep Random Administrator password Password encrypted with public key User decrypts password with their private key Instance Instance metadata RSA public key System log <Password> agihplgoqrjqmbjw K9gTD31Q== </Password>

33 Instance Metadata contains a wealth of info ami-id local-hostname ami-launch-index local-ipv4 ami-manifest-path mac block-device-mapping/ network/ hostname placement/availability-zone instance-action profile instance-id public-hostname instance-type public-ipv4 kernel-id public-keys/

34 Any Questions?