What to expect from the session Technical recap VMware Cloud on AWS {Sample} Integration use case Services introduction & solution designs Solution su

Size: px

Start display at page:

Download "What to expect from the session Technical recap VMware Cloud on AWS {Sample} Integration use case Services introduction & solution designs Solution su"

Sheila Norris
5 years ago
Views:

1 LHC3376BES AWS Native Services Integration with VMware Cloud on AWS Technical Deep Dive Ian Massingham, Worldwide Lead, AWS Technical Evangelism Paul Bockelman, AWS Principal Solutions Architect (WWPS) #VMworld #LHC3376BES

2 What to expect from the session Technical recap VMware Cloud on AWS {Sample} Integration use case Services introduction & solution designs Solution summary

3 VMware Cloud on AWS Technical Recap

VMware Cloud on AWS: Overview Management (vcenter Server) Customer data center vrealize Suite, PowerCLI VMware Cloud on AWS vcenter Server Single pane of glass and API across

4 VMware Cloud on AWS: Overview Management (vcenter Server) Customer data center vrealize Suite, PowerCLI VMware Cloud on AWS vcenter Server Single pane of glass and API across on-premises and cloud AWS Global Infrastructure AWS Global Infrastructure AWS CloudFormation, AWS CLI, AWS SDK Access to all AWS services EC2 Redshift S3 AWS Direct Connect RDS IAM

VMware Cloud on AWS: AWS view VMware operated, supported, and maintained vcenter Server VMware Cloud on AWS NSX Manager ESXi ESXi ESXi ESXi ESXi ESXi Single-tenant (dedicated) bare-metal EC2 hardware

5 VMware Cloud on AWS: AWS view VMware operated, supported, and maintained vcenter Server VMware Cloud on AWS NSX Manager ESXi ESXi ESXi ESXi ESXi ESXi Single-tenant (dedicated) bare-metal EC2 hardware Overview Fully configured VMware software stack running on state-of-the-art infrastructure provisioned on-demand in minutes Latest software VCSA, ESXi, NSX, VSAN, H5 client Dynamic capacity DRS/HA compute cluster (Intel x86) VSAN storage cluster (SSD) NSX network virtualization (10 Gbps+) Flexible topology Standalone cloud cluster Hybrid connectivity to on-premises Cloud-to-cloud connectivity

6 VMware Cloud on AWS: AWS integration VMware Cloud on AWS VMworld 2017 Content: Not for AWS Global Infrastructure Access to all native AWS services publication EC2 AWS IoT S3 AWS Direct Connect RDS IAM

7 VMware Cloud on AWS: Base Topology Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 DB2 RWP IGW Management Resource Pool ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI IGW VPC S3 Endpoint S3 AWS CloudTrail EC2 AZ A AZ B AZ C CloudWatch VMware Cloud VPC AWS Customer VPC AWS Region Services

8 {Sample} Integration Use Case

9 Integration Use Case: Overview VMware Cloud on AWS customer, ACME Distribution, is hosting two (2) web-based and internet-facing applications in their VMware Cloud on AWS SDDC account and are launching a third web application in their AWS account. ACME is seeking to meet the following requirements from an integration with native AWS Services: Horizontally scale SDDC Application 2 and consolidate public application access across accounts (require SSL) Globally distributed (from a single origins) application(s) with effective mitigation of DDoS and L3/L4/L7 attacks Increased security visibility and (near) real-time access control DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 DB2 RWP IGW Management Resource Pool ESXi ESXi ESXi EC2 VMware Cloud VPC

10 Services introduction & solution designs

11 Req #1 Scale and Consolidate Public Access The following native AWS Services will be used to horizontally scale Application 2... AWS Storage (File Interface) - A virtual appliance that uses industry-standard storage protocols to connect to AWS cloud storage services - Files are stored as objects in your S3 buckets, accessed through a Network File System (NFS) mount point - Once in S3, objects can be managed as native S3 objects, and bucket policies such as versioning, lifecycle management, and cross-region replication apply directly to objects stored in your bucket Elastic Compute Cloud ( EC2) - Deployed as a cluster of reverse web proxy instances for traffic forwarding to VMware Cloud on AWS virtual machines (for Applications 1 & 2) - Reverse web proxy cluster is deloyed as an Auto Scaling Group and registered as an Application Load Balancer Target Group

12 Req #1 Scale and Consolidate Public Access The following native AWS Services will be used to horizontally scale Application 2... Relational Database Service ( RDS) - Using the Aurora MySQL engine, RDS is a managed relational database service built on a fully distributed and self-healing storage system - Provides enterprise-level capabilities including database monitoring, database cloning, cross-region copying and replication - Aurora's storage is fault-tolerant and self-healing (each 10GB chunk of your database volume is replicated six ways, across three Availability Zones) - On entire instance failure, Aurora will automatically failover to one of up to 15 read replicas

13 Req #1 Scale and Consolidate Public Access The following native AWS Services will be used to consolidate public access for all applications AWS Certificate Manager (ACM) - Provision, manage, and deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services such as Elastic Load Balancers, CloudFront distributions, and APIs on API - Supports the import of SSL/TLS certificates issued by third-party Certificate Authorities (CAs) and deploy them with your supported AWS resources - AWS Certificate Manager can easily handle certificate renewals Elastic Load Balancing (ELB) Application Load Balancer mode - Routing decisions are at the application layer (HTTP/HTTPS) - Supports host-based routing that can route requests to one or more ports on each EC2 instance - Native integration with other AWS services such as Auto Scaling groups, AWS WAF Web ALCs, and CloudWatch - Native IPv6 support (users can connect to the ALB using IPv4 or v6)

14 Req #1 Scale and Consolidate Public Access The following native AWS Services will be used to consolidate public access for all applications Route 53 - A highly available and scalable global Domain Name System (DNS) service - Designed to propagate DNS updates to the world-wide network of authoritative DNS servers within 60 seconds (under normal conditions) - Fully compliant with IPv6 VMworld 2017 Content: Not for publication

15 Req #1 Scale and Consolidate Public Access (base) Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 DB2 RWP IGW Management Resource Pool ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI IGW VPC S3 Endpoint S3 AWS CloudTrail EC2 AZ A AZ B AZ C CloudWatch VMware Cloud VPC AWS Customer VPC AWS Region Services

16 Req #1 Scale and Consolidate Public Access Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 RWP IGW Management Resource Pool Reverse Web Proxy & Application Load- Balancer APP2 APP2 NFS S3-backed Cluster File System ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI EFS IGW ELB RWP (SDDC) App3 ASG ACM RDS Aurora (shared) Route53 VPC S3 Endpoint SSL Encrypted Traffic S3 AWS CloudTrail EC2 AZ A AZ B AZ C CloudWatch VMware Cloud VPC AWS Customer VPC AWS Region Services

17 Req #1 - Demo

Req #2 Globally distributed with DDoS Mitigation The following native AWS Service will be used to protect the environment CloudFront - A global content delivery network (CDN) service that securely

18 Req #2 Globally distributed with DDoS Mitigation The following native AWS Service will be used to protect the environment CloudFront - A global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs with low latency and high transfer speeds - 79 edge locations and 11 regional edge cache locations across 22 countries and 48 cities (as of 03-Aug-2017) - Can deliver secure APIs or applications via SSL/TLS, with advanced SSL features - Native IPv6 support - Deeply integrated with AWS services including: o o o o o o o S3 EC2 Elastic Load Balancing (ELB) Integration with AWS Lambda API AWS WAF AWS Shield

19 Req #2 Globally distributed with DDoS Mitigation The following native AWS Service will be used to protect the environment AWS WAF - A web application firewall that helps detect and block malicious web requests targeted at your web applications like SQL injection and cross-site scripting - Able to be integrated with ALB and/or a CloudFront distribution - Provides real-time metrics and captures raw requests that include details about IP addresses, geo locations, URIs, User-Agent and Referrers VMworld 2017 Content: Not for publication

20 Req #2 Globally distributed with DDoS Mitigation The following native AWS Service will be used to protect the environment AWS Shield/Shield Advanced - A managed Distributed Denial of Service (DDoS) protection service that safeguards web applications running on AWS - Provides always-on detection and automatic inline mitigations that minimize application downtime and latency - For web applications running on Elastic Load Balancing (ELB), CloudFront, and Route 53 resources, you can subscribe to AWS Shield Advanced - AWS Shield Advanced also gives you access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your protect resources VMworld 2017 Content: Not for publication

21 Req #2 Globally distributed with DDoS Mitigation Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 RWP IGW Management Resource Pool Reverse Web Proxy & Application Load- Balancer APP2 APP2 NFS S3-backed Cluster File System ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI EFS IGW ELB RWP (SDDC) App3 ASG ACM RDS Aurora (shared) Route53 VPC S3 Endpoint SSL Encrypted Traffic CloudFront WAF & ACMenabled Edge Location(s) S3 AWS CloudTrail AWS Shield EC2 AZ A AZ B AZ C CloudWatch VMware Cloud VPC AWS Customer VPC AWS Region Services

22 Req #2 - Demo

23 Req #3 Increased Security Visibility The following native AWS Service will be used to create network insight Virtual Private Cloud ( VPC) Flow Logs - Enables the capture of information about the IP traffic going to and from network interfaces within a VPC (minus the payload) - A flow log can be created for a VPC, a subnet, or a network interface - Flow log data is stored using CloudWatch Logs VMworld 2017 Content: Not for publication eni-abc123de ACCEPT OK

24 Req #3 Increased Security Visibility The following native AWS Service will be used to monitor resources CloudWatch - Collect and track metrics, collect and monitor log files (including custom logs), set alarms, and automatically react to changes in your AWS resources - Metrics such as CPU utilization, latency, and request counts are provided automatically - Using CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics) VMworld 2017 Content: Not for publication

25 Req #3 Increased Security Visibility The following native AWS Service will be used to durably store logs Simple Storage Service ( S3) - An object storage built to store and retrieve any amount of data from anywhere - Designed to deliver % durability - Data is stored as objects within resources called "buckets - Unlimited objects can be contained within a bucket with individual object size of up to a limit of 5 terabytes - Buckets are accessible via IPv6 addresses via dual-stack endpoints VMworld 2017 Content: Not for publication

Req #3 Increased Security Visibility The following native AWS Service will be used to ingest data streams Kinesis Firehose - Ingest real-time data in near real-time such as

Load-Balancer, and CloudFront application logs from CloudWatch into the Elastic Search service - Process and analyze data as it arrives and respond in real-time for downstream

26 Req #3 Increased Security Visibility The following native AWS Service will be used to ingest data streams Kinesis Firehose - Ingest real-time data in near real-time such as application logs, website clickstreams, IoT telemetry data, and more into databases, data lakes and data warehouses - Will be used to stream VPC Flow Logs, Application Load-Balancer, and CloudFront application logs from CloudWatch into the Elastic Search service - Process and analyze data as it arrives and respond in real-time for downstream processing (supports hundreds of thousands of data sources simultaneously) Streaming Data Source(s) Kinesis Firehose S3 VMworld 2017 Content: Not for Redshift ES publication QuckSight Athena

27 Req #3 Increased Security Visibility The following native AWS Service will be used to index log data Elasticsearch Service ( ES) - An open-source search and analytics engine for big data use cases such as log and click stream analysis - Ingest structured and unstructured data from a variety of sources - Elasticsearch Service manages the capacity, scaling, patching, and administration of Elasticsearch clusters - Direct access to the Elasticsearch API - Includes built-in support for Kibana (an open-source analytics and visualization platform) and AWS services including: Kinesis Firehose, AWS Lambda, and CloudWatch VMworld 2017 Content: Not for publication

28 Req #3 Increased Security Visibility The following native AWS Service will be used to analyze and visualize Athena - Interactive query service that makes it easy to analyze data in S3 using standard SQL (uses Presto with ANSI SQL support) - Uses S3 as its underlying data store (highly durable) - Quickly tap into data in S3 without the need to set up complex processes to extract, transform, and load the data (ETL) QuickSight - A business analytics service that makes it easy to build visualizations, perform adhoc analysis - Uses SPICE The Super-fast, Parallel, In-memory, Calculation Engine - Upload (CSV or XLS) and/or ingest data from AWS data sources such as Redshift, RDS, Aurora, Athena, S3, and EMR (Presto and Apache Spark) - Connect to databases like SQL Server, MySQL, and PostgreSQL (in the cloud or on-premises)

29 Req #3 Increased Security Visibility Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 RWP IGW Management Resource Pool Reverse Web Proxy & Application Load- Balancer APP2 APP2 NFS S3-backed Cluster File System ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI EFS ELB RWP (SDDC) App3 ASG RDS Aurora (shared) Route53 ES VPC S3 Endpoint SSL Encrypted Traffic CloudFront Kinesis Firehose WAF & ACMenabled Edge Location(s) IGW ACM S3 AWS CloudTrail AWS Shield Athena EC2 AZ A AZ B AZ C VPC Flow logs CloudWatch QuckSight VMware Cloud VPC AWS Customer VPC AWS Region Services

30 Req #3 - Demo

31 But wait

32 {BONUS}: Automation and Touchless Management The following native AWS Service can be used to automate AWS Lambda - Serverless Compute service that can execute code in response to triggers such as changes in data, shifts in system state, or actions by users - Automatically parses access logs to identify suspicious behavior and add the corresponding source IP addresses to an AWS WAF block list - Automatically checks third-party IP reputation lists hourly for malicious IP addresses to add to an AWS WAF block list AWS CodeDeploy - A service that automates code deployments to any instance, including EC2 instances and instances running on-premises - Rapidly release and automate software deployments, eliminating the need for error-prone manual operations - Centralize control to launch and track the status of application deployments through the AWS Management Console or the AWS CLI

33 {BONUS}: Automation and Touchless Management Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 RWP IGW Management Resource Pool Reverse Web Proxy & Application Load- Balancer APP2 APP2 NFS S3-backed Cluster File System ESXi ESXi ESXi Compute DMZ-Out (Public) VMware Cloud ENI EFS ELB RWP (SDDC) App3 ASG RDS Aurora (shared) Route53 ES VPC S3 Endpoint SSL Encrypted Traffic CloudFront WAF & ACMenabled Edge Location(s) AWS Lambda AWS CloudTrail IGW ACM S3 Kinesis Firehose AWS Shield Athena EC2 AZ A AZ B AZ C VPC Flow logs CloudWatch QuckSight VMware Cloud VPC AWS Customer VPC AWS Region Services

34 {BONUS}: Automation and Touchless Management Customer Data Center DMZ-Out (Public) DMZ-In (Private) App (Private) APP1 DB1 ESXi Compute APP2 RWP IGW Management Resource Pool Reverse Web Proxy & Application Load- Balancer APP2 APP2 NFS S3-backed Cluster File System ESXi ESXi ESXi Remember the Reverse Web Proxys? Manage them using AWS CodeDeploy Compute DMZ-Out (Public) VMware Cloud ENI EFS IGW ELB App3 ASG ACM RDS Aurora (shared) Route53 ES VPC S3 Endpoint SSL Encrypted Traffic CloudFront WAF & ACMenabled Edge Location(s) AWS Lambda AWS CloudTrail RWP (SDDC) S3 Kinesis Firehose AWS Shield Athena EC2 AZ A AZ B AZ C VPC Flow logs CloudWatch QuckSight VMware Cloud VPC AWS Customer VPC AWS Region Services

35 {BONUS}: Automation and Touchless Management Edit Configuration File(s) Commit change(s) Push updates file(s) to a code repository AWS CodeDeploy detects the update AWS CodeDeploy does a rolling deployment of updates

36 Solution Summary

37 Solution Summary Requirement #1 AWS Storge EC2 RDS AWS Certificate Manager Elastic Load Balancing Route 53 VMworld 2017 Requirement #2 CloudFront AWS WAF AWS Shield/Shield Advanced Requirement #3 VPC Flow Logs CloudWatch Simple Storage Service (S3) Kinesis Firehose Elasticsearch Service (ES) Content: Not for publication Athena QuickSight AWS Lambda AWS CodeDeploy

38 AWS Booth Demos Demo 1: Securing Workloads in VMware Cloud on AWS Understand the added value of using native AWS security features with workloads running in VMware Cloud on AWS Demo 2: VM Workload Analytics Learn how to use native AWS services integration to manage and analyze VM workloads running in a VMware Cloud on AWS SDDC cluster Demo 3: Dev/Test Workloads with VMware Cloud on AWS Demonstrate the use of an Oracle RAC (two-node cluster) test environment running in VMware Cloud on AWS Demo 4: Microsoft Applications on VMware Cloud on AWS Demonstrate a Microsoft SharePoint deployment using native AWS web front-end services and backed by Microsoft SQL Server (Always-On Availability Groups) in VMware Cloud on AWS

Splunk & AWS. Gain real-time insights from your data at scale. Ray Zhu Product Manager, AWS Elias Haddad Product Manager, Splunk

Splunk & AWS. Gain real-time insights from your data at scale. Ray Zhu Product Manager, AWS Elias Haddad Product Manager, Splunk Splunk & AWS Gain real-time insights from your data at scale Ray Zhu Product Manager, AWS Elias Haddad Product Manager, Splunk Forward-Looking Statements During the course of this presentation, we may