AWS: Basic Architecture Session SUNEY SHARMA Solutions Architect: AWS

Size: px

Start display at page:

Download "AWS: Basic Architecture Session SUNEY SHARMA Solutions Architect: AWS"

Lynn Hicks
6 years ago
Views:

1 AWS: Basic Architecture Session SUNEY SHARMA Solutions Architect: AWS

2 AWS Core Infrastructure and Services Traditional Infrastructure Amazon Web Services Security Security Firewalls ACLs Administrators Security Security Groups NACLs AWS IAM Security Groups NACLs Access Mgmt Network Router Network Pipeline Switch Networking Provision On-Demand Servers Public ELB EC2 Classic Network ELB VPC VPC VPC On-Premises Servers AMI Amazon EC2 Instances Storage DAS SAN NAS RDBMS and Amazon AWS Technical Essen/als 3.8 ILT Database EBS Amazon EFS Amazon S3 Amazon RDS

3 Corporate Premises Users over internet Internet AZ1 Nat Gateway Public Subnet Route 53 Public ELB Internet Gateway Dynamic Content AZ2 Nat Gateway Public Subnet Amazon CloudFront Sta/c Content S3 VPN Customer Gateway Virtual Private Gateway Session State Web -Autoscaling Session State Session state Corporate Users Amazon Elas/Cache Internal ELB Amazon Elas/Cache Amazon DynamoDB Direct Connect App-Autoscaling Amazon Elas/Cache Private Subnet Private Subnet Private Subnet RDS Standby Private Subnet Mul/-AZ RDS RDS Master Snapshot Private Subnet Amazon Elas/Cache Private Subnet Amazon Glacier

4 Corporate Premises Users over internet Internet AZ1 Nat Gateway Public Subnet Public ELB Internet Gateway Dynamic Content AZ2 Nat Gateway Public Subnet Amazon CloudFront Sta/c Content VPN S3 Customer Gateway Virtual Private Gateway Web -Autoscaling Corporate Users Internal ELB Direct Connect App-Autoscaling Private Subnet Private Subnet RDS Standby Private Subnet Mul/-AZ RDS RDS Master Snapshot Private Subnet Amazon Elas/Cache Amazon Glacier

5 Users over internet Internet AZ1 Internet Gateway AZ2 Public Subnet Public Subnet Private Subnet Private Subnet Private Subnet Private Subnet

6 Let s discuss What is a region? What is an AZ? What is a VPC and what are subnets? What are NACL and Security Groups

7 AWS Global Infrastructure

8 Achieving High Availability Using Multi-AZ Region Availability Zone - A Availability Zone - B Availability Zone - C

9 Amazon Virtual Private Cloud (VPC) Provision a logically isolated sec/on of the AWS cloud Control your virtual networking environment Subnets Route Tables Security Groups Network ACLs Connect to your on-premises network via hw VPN Control if and how your instances access the Internet

10 VPC EC2 Instance

11 VPC & Subnets VPC

12 Internet Internet Gateway VPC Subnet VPC Subnet VPC Subnet Availability Zone 1a Virtual Private Gateway Availability Zone 1b VPN Customer Data Center Customer Gateway

13 Choosing IP address ranges for your subnets /16 eu-west-1a eu-west-1b eu-west-1c / / /24 VPC subnet VPC subnet VPC subnet Availability Zone Availability Zone Availability Zone

14 Authorizing traffic: Network ACLs security groups

15 Network ACLs = stateless firewall rules Can be applied on a subnet basis English transla/on: Allow all traffic in

16 Security Groups

17 Security groups = stateful firewall In English: Hosts in this group are reachable from the Internet on port 80 (HTTP)

18 Users over internet Internet AZ1 Internet Gateway AZ2 Corporate Premises Public Subnet Public Subnet VPN Customer Gateway Virtual Private Gateway Corporate Users Direct Connect Private Subnet Private Subnet Private Subnet Private Subnet

19 Let s discuss What are the VPC connec/vity op/ons?

20 Connec/vity Op/ons To begin with there is internet and addi/onally: VPN Direct Connect

21 VPN connec/ons

22 VPN connec/ons

23 Direct Connect

24 Users over internet Internet AZ1 Internet Gateway AZ2 Corporate Premises Nat Gateway Public Subnet Public ELB Nat Gateway Public Subnet Customer Gateway VPN Virtual Private Gateway Web -Autoscaling Corporate Users Internal ELB Direct Connect App-Autoscaling Private Subnet Private Subnet Private Subnet Private Subnet

25 Let s discuss NAT Gateway ELB

26 NAT Gateway

27 NAT Available as: EC2 Instance running a Linux AMI. Managed NAT service from AWS.

28 Elastic Load Balancing Example

29 Users over internet Internet AZ1 Internet Gateway AZ2 Corporate Premises Nat Gateway Public Subnet Public ELB Nat Gateway Public Subnet Customer Gateway VPN Virtual Private Gateway Web -Autoscaling Corporate Users Internal ELB Direct Connect App-Autoscaling Private Subnet Private Subnet Private Subnet Private Subnet

30 Let s discuss EC2 Autoscaling

31 Amazon Elas/c Compute Cloud (EC2) - Elas/c virtual servers in the cloud EC2 Instances Guest 1 Guest 2 Guest n Hypervisor Host server Physical Servers in AWS Global Regions

32 EC2 instances: Families and Genera/ons General-purpose: Compute-op/mized: Memory-op/mized: Dense-storage: I/O-op/mized: GPU: Micro: M1, M3, M4, T2 C1, CC2, C3, C4 M2, CR1, R3 HS1, D2 HI1, I2 CG1, G2 T1, T2

33 EC2 instances: Types and Sizes Instance generation c4.large Instance family Instance size

34 Storage Op/ons Locally afached or instance storage Amazon EBS General Purpose (SSD) volumes Amazon EBS Provisioned IOPS (SSD) volumes Amazon EBS Magne/c volumes Amazon S3 and Amazon Glacier for object storage

35 AMI Details An AMI includes the following: A template for the root volume for the instance (for example, an opera/ng system, an applica/on server, and applica/ons). Launch permissions that control which AWS accounts can use the AMI to launch instances. A block device mapping that specifies the volumes to afach to the instance when it's launched.

36 Amazon EC2 Instances AMI OS, Applications, & Configuration Instances Running or Stopped VM Instances EBS EBS EBS Instances VPC EBS EBS EBS AZ AZ EBS Snapshots S3 Region S3 Buckets

37 Server load Hour of day

38 Server load Capacity of 1 server Hour of day

39 Tradi/onal capacity required Server load Capacity of 1 server Hour of day

40 Tradi/onal capacity required Server load Capacity of 1 server 1 server for 8 hours Hour of day

41 Tradi/onal capacity required Server load Capacity of 1 server 1 server for 8 hours 1 server for 8 hours Hour of day

42 Tradi/onal capacity required 1 server for 8 hours Server load Capacity of 1 server 1 server for 8 hours 1 server for 8 hours Hour of day

43 Tradi/onal capacity required 1 server for 8 hours Server load Capacity of 1 server 1 server for 8 hours 1 server for 8 hours 1 server for 8 hours Hour of day

44 Tradi/onal capacity required Server load 1/3 rd saving Capacity of 1 server Hour of day

45 6 5 Instance count Day of month

46 6 Instance count Monthly predictable peak processing Day of month

47 6 Tradi/onal capacity required 5 Instance count Day of month

48 6 Tradi/onal capacity required 5 Instance count Elas/c capacity Day of month

49 6 Tradi/onal capacity required 5 Instance count % savings 1 0 Elas/c capacity Day of month

50 Trio of Services Elastic Load Balancing CPU Utilization Auto Scaling CloudWatch Execute Scaling Policy AWSome Days 3.8

51 What is Amazon EBS? EC2 instance EBS volume Availability Zone AWS region

52 What is Amazon EBS? EC2 instance EBS boot volume EBS data volume EBS data volume Availability Zone AWS region

53 What is Amazon EBS? EBS volume Replica Availability Zone Availability Zone AWS region

54 What is Amazon EBS? EBS volume Replica Availability Zone Availability Zone Amazon S3 EBS snapshot AWS region

55 What is Amazon EBS? EBS volume Replica EBS volume Replica Availability Zone Availability Zone Amazon S3 EBS snapshot AWS region

56 What is Amazon EBS? EBS volume Replica EBS volume Replica Availability Zone Availability Zone Amazon S3 EBS snapshot EBS snapshot AWS region AWS region

57 What if an EBS volume fails? EC2 instance EBS volume Replica EBS volume Availability Zone AWS region

58 What if an EBS volume fails? EC2 instance Replica EBS volume Availability Zone AWS region

59 What about EC2 instance failure? EC2 instance Replica EBS volume Availability Zone AWS region

60 What about EC2 instance failure? New EC2 instance Replica EBS volume Availability Zone AWS region

61 EBS Volume Types

62 A few defini/ons IOPS: Input/output opera/ons per second (#) Throughput: Read/write rate to storage (MB/s) Latency: Delay between request and comple/on (ms) Capacity: Volume of data that can be stored (GB) Block size: Size of each I/O (KB)

63 EBS Volume Types Solid state drive Hard disk drive

64 EBS Volume Types SSD HDD gp2! io1! st1! sc1! General Purpose SSD Provisioned IOPS SSD Throughput Op/mized HDD Cold HDD

65 EBS Volume Types: I/O Provisioned Baseline: 3 IOPS per GB up to 10,000 Throughput: 160 MB/s Latency: Single-digit ms gp2! General Purpose SSD Capacity: 1 GB to 16 TB Great for boot volumes, low latency applica6ons and bursty databases

66 EBS Volume Types: I/O Provisioned Baseline: 100 to 20,000 IOPS Throughput: 320 MB/s Latency: Single-digit ms io1! Capacity: 4 GB to 16 TB Provisioned IOPS SSD Ideal for cri6cal applica6ons and databases with sustained IOPS

67 EBS Volume Types: Throughput Provisioned NEW! Baseline: 40 MB/s per TB up to 500 MB/s Burst: 250 MB/s per TB up to 500 MB/s Capacity: 500 GB to 16 TB st1! Throughput Op/mized HDD Ideal for large block, high throughput sequen6al workloads

68 EBS Volume Types: Throughput Provisioned NEW! Baseline: 12 MB/s per TB up to 192 MB/s Burst: 80 MB/s per TB up to 250 MB/s Capacity: 500 GB to 16 TB sc1 Cold HDD Ideal for sequen6al throughput workloads such as logging and backup

69 IO Provisioned Volumes Throughput Provisioned Volumes gp2! io1! st1! sc1! $0.10 per GB $0.125 per GB $0.065 per PIOPS $0.045 per GB $0.025 per GB * All prices are per month and from the us-west-2 region as of April 2016

70 Performance: Bandwidth Mafers c3.2xlarge ~ 125 MB/s EBS Internet c3.8xlarge 10 Gbps ~ 1250 MB/s EC2 instances S3 Databases

op/on on some 10 Gbps instance types (c3.8xlarge, r3.8xlarge, i2.

71 Performance: EBS-Op/mized Instances Dedicated network bandwidth for EBS I/O Enabled by default on c4, d2, and m4 instances Can be enabled at instance launch or on a running instance Not an op/on on some 10 Gbps instance types (c3.8xlarge, r3.8xlarge, i2.8xlarge) For max throughput sta/s/cs per instance types, see: hfp://docs.aws.amazon.com/awsec2/latest/userguide/ebsop/mized.html

72 Performance: EBS-Op/mized Instances S3 ~ 125 MB/s c3.2xlarge EC2 instances Databases Internet EBS

73 Best Prac/ce: RAID When to RAID? Storage requirement > 16 TB Throughput requirement > 500 MB/s IOPS requirement > 16K

74 Best Prac/ce: RAID EC2 instance RAID0 Replica EBS volume EBS volume Replica Availability Zone AWS region

75 Best Prac/ce: RAID Avoid RAID for redundancy RAID1 halves available EBS bandwidth RAID5/6 loses 20 30% of usable I/O to parity

76 Best Prac/ce: Security Afach both encrypted and unencrypted Any current genera/on instance No volume performance impact EBS Supported by all EBS volume types Snapshots also encrypted No extra cost

77 EBS data volumes Best Prac/ce: Security

78 How AWS pricing work Pay as you go: No minimum commitments Pay less when you reserve Pay even less per unit by using more Pay even less as AWS grows: 44 price drops since 2006 Custom Pricing

79 Plus Services offered free of cost Amazon VPC AWS Elas/c Beanstalk AWS Cloudforma/on AWS Iden/ty and Access Management Autoscaling AWS Opsworks

80 Fundamental Pricing Characters/cs Fundamental characters/cs you pay for: Compute Storage Data transfer out Customers are charged for data xfer out. Data xfer into AWS is free. Outbound data transfer is aggregated across Amazon EC2, Amazon S3, Amazon RDS, Amazon SimpleDB, Amazon SQS, Amazon SNS, and Amazon VPC

81 EC2 Purchasing Op/ons On Demand Reserved Spot Dedicated Hosts

82 EC2 Reserved Instances

83 EC2 Dedicated Hosts & Instances

84 EC2 costs: Points to consider Server clock hours Instance configura/on Instance Purchase op/on Number of Instances Load Balancing Detailed monitoring Autoscaling Elas/c IP OS and Soxware

85 S3 costs: Points to consider Storage class Storage Number of requests Data Transfer

86 EBS Costs: Points to consider Volume (GB) provisioned IOPs provisioned Snapshot Data Transfer

87 Complicated? Well you have a great tool hfp://calculator.s3.amazonaws.com/index.html AWS Simple monthly calculator

AWS Solutions Architect Associate (SAA-C01) Sample Exam Questions

AWS Solutions Architect Associate (SAA-C01) Sample Exam Questions 1) A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI. The company uses the access key to access DynamoDB tables from instances created from the AMI.