BERLIN. 2015, Amazon Web Services, Inc. or its affiliates. All rights reserved

Size: px

Start display at page:

Aubrie Parrish
6 years ago
Views:

3 AWS Global Footprint EU Central (Frankfurt) US West (Oregon) GovCloud EU West (Ireland) China (Beijing) Asia Pacific (Tokyo) US East (Virginia) Asia Pacific (Sydney) US West (N.California) São Paulo Asia Pacific (Singapore)

4 AWS Global Footprint EU Central (Frankfurt) US West (Oregon) GovCloud EU West (Ireland) China (Beijing) Asia Pacific (Tokyo) US West (N.California) US East (Virginia) Region An independent collection of AWS resources in a defined geography A solid foundation for meeting locationdependent privacy and compliance requirements Asia Pacific (Sydney) São Paulo Asia Pacific (Singapore)

5 Disaster Recovery Highly Available Migration Cold Warm Hot Standby Hot Active Migration Operational data is regularly copied Critical system backbones only Critical systems fully replicated & running Systems are proactively operational All resources moved to another Resource procurement on demand Databases contain replicated data Databases contain replicated data Databases (usually) in sync Pre-configured ready-to-launch AMIs Ready to scale Able to receive production grade traffic at any time

6 Availability Zone Availability Zone

7 Availability Zone Availability Zone Route 53 highly available and scalable cloud DNS web service Elastic Load Balancer automatically distributes incoming application traffic EC2 provides resizable compute capacity in the cloud Elastic Block Store persistent block level storage volumes

8 Availability Zone Availability Zone RDS managed service that makes it easy to set up, operate, and scale a relational database in the cloud RDS Multi-AZ provide enhanced availability and durability for Database Instances

Availability Zone Availability Zone DynamoDB fast and flexible NoSQL database service for all applications that need consistent, single-digit

9 Availability Zone Availability Zone DynamoDB fast and flexible NoSQL database service for all applications that need consistent, single-digit millisecond latency at any scale Update Streams maintains a time ordered sequence of item level changes in any DynamoDB table in a log for a duration of 24 hours

10 DynamoDB Update Streams An ordered sequence of changes to items in a DynamoDB Table Puts, updates, and deletes performed in last 24 hours Deployment & Administration Application Services Sharded for Scalability Similar to Kinesis Streams Compute Storage Database Networking Global Infrastructure

11 Availability Zone Availability Zone DynamoDB fast and flexible NoSQL database service for all applications that need consistent, single-digit millisecond latency at any scale Update Streams maintains a time ordered sequence of item level changes in any DynamoDB table in a log for a duration of 24 hours

12 Availability Zone Availability Zone Amazon S3 secure, durable, highly-scalable object storage Event Notifications receive notifications when certain events happen in your bucket

13 Amazon S3 Event Notifications Deployment & Administration Application Services λ Compute Storage Database Networking Message Message Invocation Global Infrastructure

14 Availability Zone Availability Zone Amazon S3 secure, durable, highly-scalable object storage Event Notifications receive notifications when certain events happen in your bucket

15 Availability Zone Availability Zone

16 Availability Zone Availability Zone Availability Zone Availability Zone

17 Deploying your Resources EC2 Instance EBS Volume RDS Database DynamoDB Table S3 Objects

18 Deploying your Resources EC2 Instance AMI EBS Volume RDS Database DynamoDB Table S3 Objects

19 Deploying your Resources EC2 Instance AMI Copy AMI EBS Volume RDS Database DynamoDB Table S3 Objects

20 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume RDS Database DynamoDB Table S3 Objects

21 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot RDS Database DynamoDB Table S3 Objects

22 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot RDS Database DynamoDB Table S3 Objects

23 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database DynamoDB Table S3 Objects

24 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database Read Replica DynamoDB Table S3 Objects

25 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database Read Replica DynamoDB Table? S3 Objects

26 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database Read Replica DynamoDB Table? S3 Objects?

27 AWS Lambda

28 AWS Lambda λ Feature Details AWS Service Integration Event-Driven Compute No Infrastructure to Manage Automatic scaling Fine-grained pricing Event triggers from Amazon S3, DynamoDB, and Kinesis events Deployment & Administration Application Services Compute at any scale One request a month or 10,000 parallel invocations Simple, stateless approach, expressed in conventional languages Compute Storage Database Fast response No long delays for provisioning, deployment or scale-up Change and run code as fast as you can type Networking Never pay for idle Fine-grained pricing in 100ms, 64MB steps Global Infrastructure Economical at any scale

29 AWS Lambda λ S3 Handler Dynamo Handler Kinesis Handler App Event Handler Deployment & Administration AWS Event Integration Custom Invoke API Application Services Compute Storage Database AWS Lambda Networking Global Infrastructure

30 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database Read Replica DynamoDB Table? S3 Objects?

31 Deploying your Resources EC2 Instance AMI Copy AMI Launch EBS Volume Snapshot Copy Snapshot Create Volume RDS Database Read Replica DynamoDB Table Event Invoke λ DynamoDB API Call S3 Objects Event Invoke λ Amazon S3 API Call

32 Demonstration

33 Identity and Access Management Management Console CloudWatch

34 IAM & Security Considerations  arn:aws:elasticbeanstalk:us-east-1: :environment/my App/MyEnvironment  arn:aws:iam:: :user/brian  arn:aws:rds:eu-west-1: :db:mysql-db  arn:aws:s3:::my_bucket/* Amazon Resource Name examples

IAM & Security Considerations { } "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "*",

35 IAM & Security Considerations { } "Version": " ", "Statement": [{ "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "NotIpAddress": { "aws:sourceip": [" /24", " /24"] } } }] Sample IAM Policy

36 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

37 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

38 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

39 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

40 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

41 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

42 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

43 Compute & Networking Considerations SSH keys Security Groups AMIs EBS Volumes Elastic IP Addresses Elastic Load Balancing Launch Configurations & Auto Scaling Groups

44 BERLIN

Security Aspekts on Services for Serverless Architectures. Bertram Dorn EMEA Specialized Solutions Architect Security and Compliance

Security Aspekts on Services for Serverless Architectures Bertram Dorn EMEA Specialized Solutions Architect Security and Compliance Agenda: Security in General Services in Scope Aspects of Services for