re:cap 2015 Mark Bate AWS Solutions Architect 2015, Amazon Web Services, Inc. or its affiliates. All rights reserved

Transcription

1 re:cap 2015 Mark Bate AWS Solutions Architect 2015, Amazon Web Services, Inc. or its affiliates. All rights reserved

2 Contacts & Thank You Thank you to the following SA s for contributing to this presentation Co-ordination, review & edits New Lambda features New WAF security feature New RDS DB Engine New Kinesis features QuickSight service CloudWatch Dashboards feature WorkSpaces encryption, BYOL EC2: Simple Spot & Fleet console, Spot Blocks Ben Dr Alastair Ben Chris Ganesh ganesraj Ganesh ganesraj Shiva Phil Rob Config Rules feature AWS Import/Export New Dev Portal New IOT service S3 Infrequent Access Visual Designer, updates New compliance service New Container registry feature Encryption with KMS, integrity verification New Amazon ElasticSearch Service Rob Rob Rob Rob Sebastien Andy Andy Shiva Shiva Shiva

3 Summary of Announcements

4 Day 1 Announcements Amazon QuickSight Fast, easy-to-use, cloud-powered business intelligence Amazon QuickSight is a fast, cloudpowered business intelligence (BI) service that makes it easy to build visualizations, perform ad-hoc analysis, and quickly get business insights from data. Amazon QuickSight integrates with AWS data stores, flat files, and third-party sources, and it remains super-fast and responsive while seamlessly scaling to hundreds of thousands of users and petabytes of data. Amazon Kinesis Firehose Easily load streaming data into S3 & Redshift Amazon Kinesis Firehose is the easiest way to load streaming data into AWS. It can capture and automatically load streaming data into Amazon S3 and Amazon Redshift, enabling near realtime analytics with existing business intelligence tools you re already using today. It is a fully managed service that requires no ongoing administration. AWS Import/Export Snowball Petabyte-scale data transport solution AWS Import/Export Snowball uses secure appliances to help accelerate petabyte-scale data transfers into and out of AWS. Using Snowball addresses common challenges with large-scale data transfers including high network costs, long transfer times, and security concerns. Transferring data with Snowball is simple, fast, secure, and can be as little as one-fifth the cost of high-speed Internet.

5 Day 1 (continued #1) AWS Inspector Analyze application security Amazon Inspector is an automated security assessment service that helps minimize the likelihood of introducing security or compliance issues when deploying applications on AWS. Amazon Inspector automatically assesses applications for vulnerabilities or deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed report with prioritized steps for remediation. Amazon RDS for MariaDB Fully-managed MariaDB deployment on AWS MariaDB is now available as a fullymanaged service on AWS with up to 6TB of storage, 30,000 IOPS, and support for high-availability deployments through the Amazon Relational Database Service. Amazon RDS for MariaDB is available in all commercial regions. You can start running production workloads from day one with high availability using multiple availability zones. AWS Database Migration Service Migrate databases to AWS with minimal downtime AWS Database Migration Service helps you migrate databases to AWS easily and securely with minimal downtime. It supports all widely used database platforms, and performs schema and code conversion for migrations between database engines. AWS Database Migration Service is low cost and simple to use. You only pay for the compute resources used during the migration process and can typically migrate a terabyte-size database for as little as three dollars.

6 Day 1 (continued #2) AWS WAF Filter malicious web traffic AWS WAF is a web application firewall that helps to protect web applications from attack by blocking common web exploits like SQL injection and crosssite scripting. AWS WAF integrates seamlessly with Amazon CloudFront, our global content delivery network, and includes an API that you can use to automate the creation, deployment, and maintenance of web security rules. AWS Config Rules Cloud governance & compliance AWS Config Rules is a new set of cloud governance capabilities that allow IT administrators to define guidelines for provisioning and configuring AWS resources and then continuously monitor compliance with those guidelines. AWS Config Rules ensures EBS volumes are encrypted, EC2 instances are properly tagged, and Elastic IP addresses (EIPs) are attached to instances. Amazon Elasticsearch Service Easily run Elasticsearch in AWS Amazon Elasticsearch Service is a managed service that makes it easy to deploy, operate, and scale Elasticsearch in the AWS Cloud. Elasticsearch is a popular open-source search and analytics engine for use cases such as log analytics, real-time application monitoring, and clickstream analytics. You can get started with Amazon Elasticsearch Service as part of the AWS Free Tier.

7 Day 1 (continued #3) Amazon EC2 Dedicated Hosts A physical server dedicated to your use An Amazon EC2 Dedicated Host is a physical server with EC2 instance capacity fully dedicated to your use. Dedicated Hosts can help you address compliance requirements and reduce costs by allowing you to use your existing server-bound software licenses.

8 Day 2 Announcements Announcing AWS IoT AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. AWS IoT can support billions of devices and trillions of messages, and can process and route those messages to AWS endpoints, such as AWS Lambda and Amazon Kinesis, and to other devices reliably and securely. AWS Mobile Hub AWS Mobile Hub is the fastest way to build mobile apps powered by AWS. It lets you easily add and configure features for your apps, including user authentication, data storage, backend logic, push notifications, content delivery, and analytics all from a single, integrated console, and without worrying about provisioning, scaling, and managing the infrastructure. Amazon CloudWatch Dashboards With CloudWatch Dashboards, you can monitor operational metrics with custom graphs of your AWS resources from a single pane of glass. You can create text-based or graphical widgets, add custom text annotations and links to graphs, change the time range, resize and reorganize widgets, and reuse and share dashboards.

9 Day 2 (continued #1) AWS Lambda You can now develop your AWS Lambda function code using Python, maintain multiple versions of your function code, invoke your code on a regular schedule, and run your functions for up to five minutes. Amazon WorkSpaces Amazon WorkSpaces allows you to easily provision cloud-based desktops and provide users access to the documents, applications, and resources they need from any supported device including Windows and Mac computers, Chromebooks, ipads, Kindle Fire, and Android tablets. Amazon WorkSpaces now supports encryption and lets you bring your existing Windows 7 Desktop Licenses by providing physically dedicated hardware. Amazon EC2 Spot Instances You can now request Amazon EC2 Spot instances to run continuously, for up to six hours, at a flat rate that saves you up to 50% compared to On-Demand prices. This enables you to reduce costs when running finite duration tasks such as batch processing, encoding and rendering, modeling and analysis, and continuous integration jobs.

10 Day 2 (continued #2) Amazon EC2 Container Registry Amazon EC2 Container Registry (ECR) is a fullymanaged Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. Amazon ECR is integrated with Amazon EC2 Container Service (ECS), simplifying your development to production workflow. Amazon ECR eliminates the need to operate your own container repositories or worry about scaling the underlying infrastructure. Integration with AWS Identity and Access Management (IAM) provides resource-level control of each repository. Amazon EC2 Container Service You can now use the Amazon ECS CLI with Docker Compose to easily launch multi-container applications. We have also added availability zone awareness to the Amazon ECS service scheduler, allowing the scheduler to spread your tasks across availability zones.

11 Day 2 (continued #3) Amazon API Gateway now available in the Asia Pacific (Tokyo) Region Amazon API Gateway, is a fully managed service that makes it easy for you to create, publish, maintain, monitor, and secure Application Programming Interfaces (APIs) at any scale. Amazon Aurora now available in Asia Pacific (Tokyo) AWS region Amazon Aurora is a MySQL-compatible relational database management system (RDBMS) that combines the speed and availability of high-end commercial databases with the simplicity and cost-effectiveness of open source databases. Amazon Aurora provides up to five times better performance than MySQL at a price point one tenth that of a commercial RDBMS while delivering similar performance and availability.

12 Other Announcements CloudFormation Visual Designer Created and edit CloudFormation templates inside the Web Console. Simply drag and drop your AWS resources to the design surface and see your CloudFormation appear in the JSON editor.

13 Detailed Summary of All AWS Services & Updates

14 Detailed Summary of All AWS Services & Updates New Service Announcements: Web Application Firewall (WAF) Elasticsearch RDS Maria DB AWS Import/Export Snowball Mobile Hub IoT Inspector QuickSight Existing Service Updates

15 Web Application Firewall (WAF) AWS WAF is a web application firewall that runs together with CloudFront at every edge location Helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources Create custom rules to block common attack patterns designed specifically for a web application rules deploy in minutes Filter web requests based on IP addresses, HTTP headers, or URI strings

16 Using AWS WAF CloudFront Distribution > Web ACL > Rules > Conditions Conditions inspect incoming requests. They can look at the request URI, the query string, a specific HTTP header, or the HTTP method (GET, PUT, and so forth) Conditions can also look at the incoming IP address, and can match a range or single IP address Rules can allow, block or count condition matches

17 Availability, Pricing & Next Steps Generally available now globally at all edge locations Web ACL monthly charge: $5 per Web ACL Rule ACL monthly charge: $1 per Rule per Web ACL Request charge $0.60 per million web requests Prices exclude CloudFront standard costs which is a requirement Learn more by visiting our web site:

18 Amazon Elasticsearch Service A scalable, managed Elasticsearch cluster Configurable Instance type and Instance count High availability Availability zone awareness Storage options (EBS or Instance store) Snapshots Secure access control Built in Kibana (v4) dashboard Cloudwatch Logs integration (Cloudtrail, VPC Flow logs and Lambda dashboards) Cloudwatch metrics

19 Using Amazon Elasticsearch Service

20 Using Amazon Elasticsearch Service

21 Availability, Pricing & Next Steps Generally available now in all public regions Free Tier : t2.micro.elasticsearch node for up to 750 hours per month, along with up to 10 gigabytes of EBS storage at no charge. You are charged for Amazon Elasticsearch instance hours, Amazon EBS storage (if you choose this option), standard data transfer fees Learn more by visiting our web site:

22 RDS for MariaDB Why MariaDB? It is a variant of MySQL showing increasing customer demand Customers have standardized on MariaDB and want the benefits of RDS MariaDB does not make you buy an enterprise license to take advantage of advanced features

23 Availability, Pricing & Next Steps Same as RDS MySQL Pricing Available in all public AWS regions, multi-az as well, up to 5 read replicas All RDS MySQL current generation instances (excl T1s,M1s,CR1s) Free tier available Different than MySQL XtraDB and Aria storage engines only Version MariaDB only Learn more by visiting our web site:

24 AWS Import/Export Snowball Petabyte-scale data transport solution that uses secure appliances to transfer large amounts of data into and out of AWS Scalable transport 50 TB per appliance and use multiple appliances in parallel High Speed 10Gbps network connectivity to device Secure Tamper resistant enclosure, 256-bit encryption and Trusted Platform Module Low Cost transfer hundreds of terabytes of data for as little as one-fifth the cost of using the internet End-to-end tracking via Amazon SNS, text message or the AWS Console

25 Using AWS Import/Export Snowball

26 Availability, Pricing & Next Steps Available in Virginia (us-east-1) via sign-up form to request access Pricing: Service Fee per Job: $200 First 10 days of onsite usage are free and each extra onsite day is $15 Data transfer IN to Amazon S3 is $0.00 per GB Data transfer OUT of Amazon S3 is $0.03 per GB Shipping charges are calculated based on standard carrier rates for the shipping location and shipping option (e.g. 2-day, overnight) you choose. The default shipping option is 2-day. Standard Amazon S3 storage and request pricing applies. Learn more:

27 AWS CloudWatch Dashboards Customized dashboards for CloudWatch metrics Display multiple metrics and accessorize with text and images Pull metrics from multiple regions for global status dashboard for complex, multi-region applications and deployments Resizable graphs you can interact with Link graphs and correlate between metrics, and zoom and take other actions across all linked graphs

28 AWS CloudWatch Dashboards

29 Availability, Pricing & Next Steps Generally available now in all public regions Free Tier : 3 dashboards, each with up to 50 metrics $3 per month for each additional dashboard. Learn more by visiting our web site: dwatch_dashboards.html

30 AWS Mobile Hub (Beta) The fastest way to build mobile apps powered by AWS lets you easily add and configure features for your apps, such as;; User Authentication Data Storage Backend Logic Push Notifications Content Delivery Analytics Provides easy access to testing your application on real mobile devices Easily track usage of your app through analytics dashboards

31 Using AWS Mobile Hub

32 Availability, Pricing & Next Steps Beta available in N. Virginia Pricing: Only pay for the usage of underlying AWS services used for example: Mobile analytics is free up to 100M events per month, then $1.00 per million events Learn more by visiting our web site:

33 AWS IoT (Beta) A managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices Connect and manage billions of devices via HTTP and MQTT Secure device connections and data with authentication and end-to-end encryption Devices can communicate securely even if they are using different protocols Define business rules to transform and act upon device data including routing messages to AWS endpoints such as Lambda, Kinesis, S3, DynamoDB and Amazon Machine Learning IoT Device SDK now available for C, JavaScript and Arduino Yún

34 Using AWS IoT (Beta)

35 Availability, Pricing & Next Steps Beta available in N. Virginia, Oregon, Ireland and Tokyo Pricing: No charge for deliveries to S3, DynamoDB, Lambda, Kinesis, SNS or SQS Free tier: 250,000 free messages published or delivered per month for 12 months $5 per million messages in N. Virginia, Oregon and Ireland $8 per million messages in Tokyo 1 message is one 512 byte block of data processed by AWS IoT Learn more by visiting our web site:

36 Amazon Inspector Automated Security Assessment Service Quickly and easily assess the security of your AWS resources for forensics, troubleshooting or active auditing purposes at your own pace Enables you to focus on the more complex security problems by offloading the overall security assessment of your infrastructure to this automated service Gain deeper understanding of your AWS resources: Amazon Inspector findings are produced through the analysis of the real activity and configuration data of your AWS resources.

37 Amazon Inspector Benefits: Identify Security Issues in Your Web Applications Enforce your Organization s Security Standards Increased Agility without Compromising Security Apply AWS Security Expertise to your Application Streamline Security Compliance

38 Amazon Inspector Preconfigured Rules Amazon Inspector includes the following sets of rules: Common Vulnerabilities and Exposures Authentication Best Practices Operating System Security Best Practices Application Security Best Practices PCI DSS 3.0 Assessment

39 Using Amazon Inspector Define your application the specify the AWS components that make up the application.

40 Using Amazon Inspector Create and Run an assessment of the application Currently available in Preview. Apply for Preview Access at

41 QuickSight A Very Fast, Cloud-Powered Business Intelligence Service For 1/10 th the Cost of Traditional BI Software Get Started Quickly Requires no IT effort or complex dimensional modeling Auto-discovery of all AWS data sources Reduces time to first visualization down to a minute

42 Fast Calculations with SPICE Super-fast, Parallel, In-memory Calculation Engine ( SPICE ) Provides response time in milliseconds for most queries

43 Connect to Virtually Any Data AWS Data Sources Amazon Redshift, Amazon Aurora, Amazon RDS, Amazon DynamoDB, Amazon S3, Amazon EMR, Amazon Kinesis Partner Data Sources & Applications, Salesforce, Google Analytics, EC2 Databases Files CSV, TSV, CLF, XLS

44 Easy To Use and Share Reduces time to first visualization down to a minute Intuitive interface for ad-hoc analysis Best-fit visualizations for data sets create dashboards and publish Share your perspectives using story boards Embed your BI reports in applications and websites

45 Availability, Pricing & Next Steps Enterprise edition adds active directory integration, encryption at rest, fine-grained user access control, audit logs, custom domain, branded site, and up to 2X the query throughput of the Standard Edition. Supports SQL for analysis API and ODBC connectors for partner integration Working with Tableau, Qlik, Tibco/Jaspersoft, SAP

46 Updates

47 Elastic Container Service Updates Pre-announced : EC2 Container Registry (ECR) A fully managed registry, with S3 backend ECR will have integrations with docker CLI, ECS and IAM. launch partners including Shippable, CloudBees, CodeShip, and Wercker New features : EC2 Container Service Command line Interface with support for Docker Compose New docker container configuration options (working directory, privileged execution, read-only root filesystem, DNS servers, ulimits, log configuration etc) Availability zone aware scheduling

48 Elastic Container Registry Sneak peek of ECR

49 Availability, Pricing & Next Steps Elastic Container Registry will be available later in the year New features of ECS are generally available in all regions that have ECS. Learn more by visiting our web site:

50 Lambda New Features Python 2.7 Language Support Boto3 is available in the runtime environment Package dependencies with pip Scheduled Invocations Lambda as CRON Maximum function runtime increased to 300s Increased headroom for batch processing tasks Function Versions & Aliases Caller can specify a specific function version, the latest version or an alias Support for controlled roll-forward and roll-back of changes IAM Resource policies extend to function version level Access Resources in a VPC from Lambda (Coming Soon!)

51 AWS CloudTrail New Features Support for Encryption using SSE-KMS Additional layer of security by encryption at rest with user managed KMS keys Log File Integrity Validation Audit compliance by being able to validate the integrity of CloudTrail logs Available now at no additional cost

52 AWS CloudTrail

53 S3 Update: Infrequent Access (Standard-IA) For Warm Data = Infrequently Accessed Data Same features, durability and performance as S3 Standard Lower price point Generally available now in all public regions $0.0125/GB per month $0.01/GB retrieval fee 30 days minimum retention 128KB minimum object size

54 WorkSpaces Updates BYOL You can now bring your existing Windows 7 Desktop license to Amazon WorkSpaces and run the Windows 7 Desktop OS on hardware that is physically dedicated to you. This option delivers a $4 per month saving and also enables you to use the same Windows 7 Golden image as on-premises Encrypted Volumes To meet the most stringent compliance requirements, Workspaces storage volumes can now be encrypted using AWS Key Management Service (KMS) Client App for Chromebook Additional Client App so customers can make use of low cost thin client style Chromebooks reducing their overall TCO for providing desktop services Smaller Public Gateway IP range The range of IP addresses supporting the PCOIP Gateway for Workspaces has been reduced so that customers can set more finely grained firewall policies

55 Using WorkSpaces Encryption

56 Availability, Pricing & Next Steps Generally available now in US East (N.Virginia), US West (Oregon), EU (Ireland), Asia Pacific (Singapore), Asia Pacific (Sydney), or Asia Pacific (Tokyo) AWS regions BYOL delivers a $4/month price reduction on the standard pricing at Learn more by visiting our web site:

57 EC2 Updates Simple Spot & Fleet Console Simplified interface for managing spot instances and spot fleets Save up to 90% compared to On-Demand pricing Spot Instance for Specific Duration Workloads Request Amazon EC2 Spot Instances to run continuously for up to six hours Specify duration you wish instances to run for when capacity is available for the requested duration, the instances will launch EC2 Dedicated Hosts (Coming Soon) A physical server with EC2 instance capacity fully dedicated to your use Assists in meeting compliance requirements and may enable the use of existing server-bound licenses

58 Availability, Pricing & Next Steps Simple Spot & Fleet Console Generally available now in all public regions Access via the Spot Requests menu in the EC2 console Spot Instance for Specific Duration Workloads Generally available now in all public regions Pricing is based on the requested duration and the available capacity, and is typically 30% to 45% less than On-Demand, with an additional 5% off during non-peak hours for the region Available via the CLI (console support coming soon) EC2 Dedicated Hosts (Coming Soon) Contact us for more information:

59 AWS Config Rules (Preview) Cloud governance capability that allows IT Administrators to define guidelines for provisioning and configuring AWS resources and then continuously monitor compliance with those guidelines Governance Dashboard AWS Config Rules provides a visual dashboard to help you quickly spot non-compliant resources Easy to get started Enable with a few clicks and use predefined rule templates Flexible Create your own rules using AWS Lambda functions to enable more advanced compliance checks Continuous Monitoring A near real-time view of AWS resource compliance with policies and guidelines Simplified Management An easy-to-navigate interface to support compliance audits and configuration troubleshooting

60 Using AWS Config Rules

61 Using AWS Config Rules

62 Availability, Pricing & Next Steps Sign up to Preview now for regions where AWS Config is available Pricing: $2 per active rule per month which includes 20,000 evaluations per rule $0.10 per thousand evaluations when the 20,000 inclusion is exceeded Standard rates for SNS and S3 storage apply Learn more:

63 AWS CloudFormation Designer Visual tool allows you to create and modify CloudFormation templates using a drag-and-drop interface. Easily add, modify, or remove resources and the underlying JSON will be altered accordingly. Running stacks can be simply updated update to ensure conformance with any template modifications.

64 Using AWS CloudFormation Designer Simply drag and drop your AWS resources to the design surface and see your CloudFormation appear in the JSON editor.

65 CloudFormation Updates We have also added support for the following services: Amazon Aurora AWS CodeDeploy AWS Directory Service Simple AD EC2 Spot Fleet Amazon WorkSpaces The new CloudFormation designer and support for additional services is available now and you can access them in the CloudFormation console at Like CloudFormation itself, there is no charge to use the Designer;; you pay only for the AWS resources that you use when you launch a stack.

66 Amazon Kinesis Firehose Easiest Way to Load Streaming Data into AWS Zero administration: Capture and deliver streaming data into S3, Redshift, and other destinations without writing any applications or managing infrastructure. Direct-to-Data Store Integration Batch, compress, and encrypt streaming data for delivery into data destinations in as little as 60 secs using simple configurations. Seamless Elasticity: Seamlessly scales to match data throughput without intervention. Generally available in: us-east-1, eu-west-1, us-west-2.

67 Amazon EMR Release Amazon EMR is a managed service that simplifies running and managing distributed data processing frameworks Support for latest versions of Apache Spark and Hue Spark HUE Hadoop KMS for HDFS Transparent Encryption EMR Sandbox Early access to new software on the EMR Cluster Presto Zeppelin 0.6 (Snapshot) Oozie Intelligent Resize Feature Shrink EMR clusters with minimal impact to running job Generally Available in all public regions.

68 Thank You! Mark Bate AWS Solutions