Introduction to the AWS Cloud - AWSome Day 2019 - Vancouver

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
26.03.19
AWSOME DAY
V A N C O U V E R

AWSOME DAY
Presenter
Hakha Momeni
Senior Technical Trainer
Amazon Web Services

Agenda
8:00 AM – 9:00 AM
Registration & Ask an AWS Expert
9:00 AM – 9:15 AM
Welcome
9:15 AM – 9:35 AM
Introduction to the AWS Cloud
9:35 AM - 10:35 AM
Core Services
10:35 AM – 11:00 AM
Break
11:00 AM – 11:30 AM
Core Services (con’d)
11:30 AM – 12:30 AM
More AWS Services (Beyond Servers and Storage)
12:30 PM – 1:30 PM
Lunch & Ask an AWS Expert
1:30 PM – 2:40 PM
More AWS Services (con’d)
2:40 PM – 3:00 PM
Break
3:00 PM – 3:30 PM
Security
3:30 PM – 4:00 PM
Pricing, Support and Training
4:00 PM – 4:30 PM
Ask an AWS Expert

Questions?
Visit the Ask an Expert area or
the Training and Cert booth.
Available at Lunch and Breaks:
• 10:35 AM – 11:00 AM
• 12:30PM - 1:30PM
• 2:55PM - 3:15PM
• 4:00PM - 4:30PM

Course Goals
Goals
Value proposition
Global infrastructure
Key services
Security and compliance
Architecture
Pricing
Support
Audience
Sales
Legal
Marketing
Business analysts
Project managers
AWS Academy students
Other IT-related professionals

Course Modules
1. Introduction to AWS Cloud
2. Core Services
3. More Services
4. Architecture
5. Security
6. Pricing and Support

AWSOME DAY

What is the Cloud (First Glance)?
On-Premises IT
Servers
Storage
Databases
Applications
Internet
Servers Storage
Databases Applications
Cloud services provider
Internet
Corp
Network

How Does it Work?
• AWS owns and maintains the network-connected hardware
• You provision and use what you need

Cloud Computing Models
Platform as a Service (PaaS)
Infrastructure as a Service (IaaS)
Software as a Service (SaaS):

Cloud Deployment Models
CloudPrivate Hybrid

Trade Capital Expense for Variable Expense
Data center investment
based upon forecast
Capital
Pay only for the amount
you consume

Benefit from Massive Economies of Scale
Because of aggregate usage from all customers, AWS can achieve
higher economies of scale, and pass savings on to customers
Economies of Scale
Savings

Stop Guessing Capacity
Overestimated
server capacity
Underestimated
server capacity
Scaling on
demand

Increase Speed and Agility
Weeks between wanting
resources and having resources
Minutes between wanting
resources and having resources

Stop Spending Money on
Running and Maintaining Data Centers
Running data centers
Business and customers
Investment

Go Global in Minutes
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

AWS Security
Keep your data safe
Meet compliance requirements
Save money
Scale quickly

What is the AWS Cloud?
Compute Storage Database Migration
Networking & Content Delivery Developer Tools Management Tools Media Services
Security, Identity & Compliance Analytics Machine Learning Mobile Services
AR & VR Application Integration Customer Engagement Business Productivity
Desktop & App Streaming Internet of Things Game Development AWS Cost Management

Module Goals
Choose your location
Configure your security
Launch your infrastructure
Store your data

Choose Your Location
# AWS Regions
Availability Zones
Planned Regions
#
AWS GOVCLOUD (US-WEST)
OHIO
OREGON
N. CALIFORNIA
N. VIRGINIA
BEIJING
SEOUL
TOKYO
SINGAPORE
SYDNEY
CANADA
LONDON
MUMBAI
IRELAND
SÃO PAULO
3
2
3
4 3
3
3
2
4
2
2
3
BAHRAIN (Coming soon)
HONG KONG (Coming soon)
SWEDEN
AWS GOVCLOUD (US-
EAST)
NINGXIA 3
6
PARIS
FRANKFURT
3
3
3
3
1 Osaka-Local
3 MILAN (Coming soon)
CAPE TOWN (Coming soon)
3

Availability Zones
ap-southeast-1
(Singapore)
ap-southeast-1a ap-southeast-1b
ap-southeast-1c
datacenter(s)
datacenter(s)
datacenter(s)
3

Edge Locations
Edge Locations
Multiple Edge Locations
Regional Edge Caches

AWS Management Console
Easy-to-use graphical interface
Command Line Interface (AWS CLI)
Access to services via discrete command
Software Development Kits (SDKs)
Access services in your code
Three Ways to Interact with AWS

AWS Management Console

AWS CLI
~aws
• Open source tool for
interacting with AWS services
• Environments
• Linux
• MacOS
• Windows

AWS SDKs
JavaScript
Python
PHP
.NET
Ruby
Go
Node.js
C++
Java

(IP Range for VPC)
Amazon Virtual Private Cloud (Amazon VPC)
Public Subnet Private Subnet
Region
Availability Zone A
Instances Instances
Public
Internet
Corporate
Datacenter

Security Groups
Instance
Instance
Instance
Security
Group A
Instance
Security Group A
Security Group-B
Security Group-C
Security
Group B
Inbound
Source Protocol Port Range
0.0.0.0/0 TCP 80
0.0.0.0/0 TCP 443
Inbound
10.0.1.0/24 TCP 22
Inbound
ID of Security Group B All All
Security
Group C

Security Group Details
Only “allow” rules; no “deny” rules
Default values:
No inbound traffic allowed
All outbound traffic allowed
Stateful:
Allows responses from allowed inbound traffic

Security Groups Example
SG-Web-Tier
Inbound
0.0.0.0/0 TCP 80
0.0.0.0/0 TCP 443
10.0.16.0/20 TCP 22
WWW Servers App Servers
SG-App-Tier SG-DB-TierSG-Web-Tier
DB Servers
Corp
(10.0.16.0/20)
Public
internet
SG-App-Tier
Inbound
ID of SG-Web-Tier TCP 6455
10.0.16.0/20 TCP 22
SG-DB-Tier
Inbound
ID of SG-App-Tier TCP 3306
10.0.16.0/20 TCP 22
MyPublicSubnet
(10.0.0.0/24)
MyPrivateSubnet
(10.0.1.0/24)

Topic Summary
• Amazon VPC is a logically isolated section of the AWS Region
in which you can launch AWS resources in a virtual network
defined by you.
• Security groups act as a virtual firewall at the instance level to
control inbound and outbound traffic.

What is Amazon EC2?
ü Application server
ü Web server
ü Database server
ü Game server
ü Mail server
ü Media server
ü Catalog server
ü File server
ü Computing server
ü Proxy server

Benefits of Amazon EC2
• Elasticity
• Control
• Flexibility
• Integrated
• Reliable
• Secure
• Inexpensive
• Easy

What’s Your Use Case?
General
Purpose
Compute
Optimized
Memory
Optimized
Accelerated
Computing
Storage
Optimized
Instance
Types
T3, T2, M5,
M5A, M4
C5, C4
R5, R4, X1e,
X1,L, z1d,
High Memory
Instances
P3, P2, G3, F1 H1, I3, D2
Use Case Broad
High
performance
In-memory
databases
Machine
learning
Distributed file
systems

Choosing the Right
Amazon EC2 Instances
• EC2 Instance types are optimized for different use cases, workloads &
come in multiple sizes. This allows you to optimally scale resources to
your workload requirements.
• AWS utilizes Intel® Xeon® processors for EC2 Instances providing
customers with high performance and value.
• Consider the following when choosing your instances: core count,
memory size, storage size & type, network performance, I/O
requirements & CPU technologies.
• Hurry Up & Go Idle - A larger compute instance can save you time and
money, therefore paying more per hour for a shorter amount of time can
be less expensive.

EC2 Instances Powered by Intel Technologies
EC2 Instance
Type
Compute Optimized General Purpose Memory Optimized Storage Optimized
C5 C4 M5 M4 T2 X1 X1e R4 H1 I3 D2
Intel Processor
Xeon
Platinum
8175M
Xeon E5
2666 v3
Xeon
Platinum
8175M
Xeon E5
2686 v4
2676 v3
Xeon
Family
Xeon E7
8880 v3
Xeon E7
8880 v3
Xeon E5
2686 v4
Xeon E5
2686 v4
Xeon E5
2686 v4
Xeon E5
2676 v3
Intel Processor
Technology
Skylake Haswell Skylake
Broadwell
Haswell
Yes Haswell Haswell Broadwell Broadwell Broadwell Haswell
Intel AVX Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Intel AVX2 Yes Yes Yes Yes - Yes Yes Yes Yes Yes Yes
Intel AVX-512 Yes - Yes - - - - - - - -
Intel Turbo Boost Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Storage EBS-only EBS-only EBS-only EBS-only EBS-only
SSD
EBS-Opt
SSD
EBS-Opt
- HDD SSD HDD

C5: Compute Optimized Instances
Based on 3.0 GHz Intel Xeon Scalable
Processors (Skylake)
Up to 72 vCPUs and 144 GiB of memory
(2:1 Memory:vCPU ratio)
25 Gbps NW bandwidth
Support for Intel AVX-512
25% price/performance improvement over
C4
C4 C5
“We saw significant performance improvement on
Amazon EC2 C5, with up to a 140% performance
improvement in industry standard CPU benchmarks
over C4.”
“We are eager to migrate onto the AVX-512 enabled
c5.18xlarge instance size… . We expect to decrease the
processing time of some of our key workloads by more
than 30%.”

M5: Next-Gen General Purpose instance
• Powered by 2.5 GHz Intel Xeon
Scalable Processors (Skylake)
• New larger instance size—
m5.24xlarge with
96 vCPUs and 384 GiB of memory
(4:1 Memory:vCPU ratio)
• Improved network and EBS
performance on smaller instance
sizes
• Support for Intel AVX-512 offering
up to twice the performance for
vector and floating point workloads
14% price/performance improvement
With M5
M4 M5

How Much Do You Need?

What’s Your Platform?

What’s Your Storage Requirement?
• Persistent block storage for instances
• Protected through replication
• Different drive types
• Scale up or down in minutes
• Pay for only what you provision
• Snapshot functionality
• Encryption available
Amazon
EC2
instance
Amazon
EC2
instance
Availability
Zone
Solid State Drives (SSD)
Provisioned IOPS SSD (io1) Volumes
General Purpose SSD (gp2) Volumes
Hard Disk Drives (HDD)
Throughput Optimized HDD (st1) Volumes
Cold HDD (sc1) Volumes
Bill
Storage provisioned…
Monday’s snapshot
Tuesday’s snapshot
Wednesday’s snapshot
Thursday’s snapshot
Friday’s snapshot
Amazon EBS Volumes

Containers vs. Virtual Machines
Containe
r
Containe
r
Containe
r
Server
Host operating system
Hypervisor
Guest OS Guest OS Guest OS
Bins/Libs
App 1
Bins/Libs
App 2
Bins/Libs
App 3
Server
Operating system
Docker engine
Bins/Libs
App 1
Bins/Libs
App 2
Bins/Libs
App 3
Virtual Machines
Containers

Other compute services
Amazon Elastic Container Service
Run and Manage Docker Containers
Amazon Elastic Container Service for Kubernetes
Run Managed Kubernetes on AWS
AWS Fargate
Run Containers without Managing Servers or
Clusters
VMware Cloud on AWS
Build a Hybrid Cloud without Custom Hardware

What We’re Starting With
Region
Availability Zone A
Public Subnet 2 (10.0.2.0/24)
10.0.0.0/16
Availability Zone B
Private Subnet 2 (10.0.4.0/24)
Internet
Gateway

Launch a Web Server
Internet
Gateway
Availability Zone A
10.0.0.0/16
Web Server 1
Availability Zone B
security group
Configure a new
security group
(WebSecurityGroup)

Launch a Web Server
Internet
Gateway
Availability Zone A
10.0.0.0/16
Availability Zone B
security group
Web Server 1
Launch a new web
server Instance

Launch a Web Server
Availability Zone A
Web Server 1
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway

What’s Your Storage Use Case?
Amazon EBS Persistent block storage for Amazon EC2
Regionally distributed, web-enabled object storage
Long-term record storage for archive and regulatory compliance
Sharable, network-attached file storage
AWS extension of your on-premises storage
Efficient data migration options
Amazon S3
Amazon Glacier
Amazon EFS
AWS Storage Gateway
Cloud Data Migration Services

What is Amazon S3?
• Data is stored as objects within buckets
• Unlimited storage
• Single object limited to 5TB
• 99.999999999% durable
• Granular access to bucket and objects

Amazon S3 Common Use Scenarios
Backup and storage
Application hosting
Media hosting
Software delivery
Amazon S3 Buckets
Corporate
Datacenter
Amazon
EC2
Instances

Not Just a Storage Bucket
Requester pays
Versioning
Hosting static websites
Object lifecycle management

What is Amazon Glacier?
Amazon S3
Amazon
Glacier
On-premises
server
EC2 instances
• Low-cost data archiving and
long-term backup
• Expedited, Standard and Bulk
retrieval options*
• Can configure lifecycle
archiving of Amazon S3
content to Amazon Glacier

Amazon Glacier Use Cases
Media asset workflows
Healthcare information archiving
Regulatory and compliance archiving
Scientific data storage
Digital preservation
Magnetic tape replacement

Amazon Glacier Vault Lock Policy
• Deploy and enforce compliance controls
on individual Amazon Glacier vaults
• Vault becomes immutable once locked

Module Summary
EC2
Instance
EBS
Volume
EC2
Instance
EBS
Volume
Security Group
Region
Availability Zone A Availability Zone B
S3
Bucket
S3
Bucket
S3
Bucket
Glacier
Archive

Hosting a Static Website
“I want to create a highly available static website”
Technologies used:
Amazon S3

Hosting a Static Website
You will:
Create an S3 Bucket
Deploy your website
Make your site publicly available
MyPublicWebsite123
index.html
style.css
script.js

Going Beyond Servers and Storage
Your Goal AWS Services
Deploy highly available applications that scale with demand
Elastic Load Balancing
Auto Scaling
Have complete visibility of your cloud resources and applications Amazon CloudWatch
Run a highly available and scalable Domain Name System (DNS) web service Amazon Route 53
Run SQL or NoSQL databases without the management overhead AWS Database Services
Run code without managing servers AWS Lambda
Deliver your content across a massively scaled and globally available network Amazon CloudFront
Rapidly build a project on AWS Amazon Lightsail
Deploy your application in the simplest way possible AWS Elastic Beanstalk
Programmatically deploy repeatable infrastructure AWS CloudFormation

Why Scaling Matters
Overestimated
server load
Underestimated
server load
• Scale out for spikes
• Scale in during off-peak
• Replace unhealthy instances
• Pay only for what you use

The Tools of Auto Scaling
Auto Scaling group
Elastic
Load
Balancing
(ELB)
Instance Instance Instance Instance Instance

ELB as a Service
Auto Scaling group
ELB

ELB Features
High availability
Health checks
SSL/TLS termination
Operational monitoring
Automatically distribute traffic across multiple targets

Application Load Balancer Use Cases
Application Load
Balancer
Application 1
Application 2
Application 3
EC2 Instance

Amazon EC2 Auto Scaling
Auto Scaling group
Elastic
Load
Balancer

Dynamic Scaling with EC2 Auto Scaling
Select a load metric for
your application
Conditional and/or
scheduled
Can be used with
CloudWatch Auto Scaling group
instance
instance
instanceinstance
instance instance
instance instance
instance instance
High DemandLow Demand
Follow the demand curve for your applications
Max 10
Min 2
Desired 6
Max 10
Min 2
Desired 10
Max 10
Min 2
Desired 2

Fleet Management with EC2 Auto Scaling
Monitor the health of
running instances
Replace impaired instances
automatically
Balance capacity across
Availability Zones
Auto Scaling group
Instance
Instance
InstanceInstance
Instance Instance
Instance
Instance
Instance
Instance
Replace impaired Amazon EC2 instances without intervention
O
O
P
P
Max 10
Min 2
Desired 10

What Does CloudWatch Do?
Monitors:
üAWS resources
üApplications running on AWS
Collects and track metrics:
üStandard metrics
üCustom metrics
CloudWatch alarms:
üSend notifications
üAutomatically make changes
based on rules you define

How CloudWatch Works
AWS resources
that support
CloudWatch
CloudWatch
Available
Statistics
Statistics ConsumerAWS Management Console
CloudWatch Metrics
CPUUtilization
StatusCheckFailed
Custom
application-
specific metrics
PageViewCount
CloudWatch
Alarm
SNS Email
Notification
Auto
Scaling

CloudWatch Benefits
Access all your metrics from a single platform
Visibility across your applications,
infrastructure, and services
Reduce mean time to resolution (MTTR)
and improve total cost of ownership (TCO)
Drive insights to optimize applications
and operational resources

What is Route 53?
• Register domain names
• Route to your resources
• Perform health checks
https://sales.example.com
Amazon Route 53

Route 53 Routing Policies
• Simple
• Weighted
• Latency
• Failover
P
Amazon
Route 53
O
• Geolocation
• Geoproximity
• Multivalue

What We’re Starting With
Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
Web Server 1

Scale and Load Balance the Architecture
Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
security group
security group
Application Load
Balancer
Web Instance Web Instance
Web Server 1
Create an AMI
image from an
existing instance

Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
security group
security group
Application Load
Balancer
Web Server 1
Deploy an Application
Load Balancer

Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
security group
security group
Application Load
Balancer
Web Server 1Configure a Launch
Configuration and Auto
Scaling Group

Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
security group
security group
Application Load
Balancer
Web Server 1
Test and
monitor
your Auto
Scaling
Group
Application Load
Balancer

Availability Zone A
10.0.0.0/16
security group
Availability Zone B
Internet
Gateway
security group
security group
Application Load
Balancer
Web Server 1Application Load
Balancer

Doing-It-Yourself vs. AWS Database Services
• Operating system access
• Need features of specific
application
• Easy to set up, manage, maintain
• Push-button high availability
• Focus on performance
• Eliminate undifferentiated heavy
lifting

Choose the Best Tool for the Job
Service Type Description
Amazon
RDS
Relational
database
A managed relational database in the cloud that you can launch in minutes with
just a few clicks
Amazon
Aurora
Relational
database
A fully managed MySQL and PostgreSQL-compatible relational database with the
performance and availability of enterprise databases at 1/10th the cost
Amazon
DynamoDB
NoSQL database
A Serverless, NoSQL database that delivers consistent single-digit millisecond
latency at any scale
Amazon
Redshift
Data warehouse
A fast, fully managed, petabyte-scale data warehouse at 1/10th the cost of
traditional solutions
Amazon
ElastiCache
In-memory
data store
To deploy, operate, and scale an in-memory data store based on Memcached or
Redis in the cloud
Amazon
Neptune
Graph database
A fast, reliable, fully managed graph database to store and manage highly
connected data sets
AWS Database
Migration Service
Database
migration
Help migrating your databases to AWS easily and inexpensively with minimal
downtime

What is Amazon Relational Database Service?
Easy to set up, operate, and scale
Amazon RDS Engines

Amazon RDS Benefits
Easy to administer
Highly scalable
Available and durable
Fast
Secure
Inexpensive

What is Amazon Aurora?
• Enterprise-class relational database
• MySQL or PostgreSQL-compatible
• Up to 5X faster than standard MySQL databases
• Up to 3X faster than standard PostgreSQL databases
• Continuous backup to Amazon S3
• Up to 15 low-latency read replicas

What is Amazon DynamoDB?
Fast and flexible NoSQL database service for any scale
Fully managed
Low-latency queries
Fine-grained access control
Regional and global options

Amazon DynamoDB Use Cases
Serverless web applications
Microservices data store
Mobile backends
Ad tech
Gaming
Internet of Things (IoT)

What is Amazon Neptune?
Fully managed graph database service for running
applications with highly connected datasets
Use Cases
Social networking
Recommendation engines
Fraud detection
Knowledge graphs
Life sciences
Network/IT operations

What is Amazon Redshift?
A fast, scalable data warehouse
Use Cases
Accelerate all your analytics workloads
Unified data warehouse and data lake
Modernize your on-premises data
warehouse

What is AWS Database Migration Service?
Migrate databases to AWS quickly and securely

What is Lambda?
Run code without provisioning or managing servers
Upload your code to
Lambda
Set up your code to trigger from
other AWS services, HTTP
endpoints, or in-app activity
Lambda runs your code only when
triggered
Pay just for the compute time
you use
AWS
SERVICES
MOBILE APPS
HTTP
ENDPOINTS

Benefits of Lambda
Bring your own code
Completely automated administration
Built-in fault tolerance
Automatic scaling
Orchestrate multiple functions
Integrated security model
Pay per use
Flexible resource model

Lambda Example:
Create Thumbnails
Source
bucket
Target
bucket
1
3
JSON
4
Access
policy
Lambda
function
User
5
Lambda
Execution
role
2

What is CloudFront?
A fast, secure, and global content delivery network (CDN)

How CloudFront Delivers Content to Users
EC2
Instance
S3
Bucket
edge
location
cache
www.example.com/content

Key Features of CloudFront
Global edge network
Faster performance
Security
Programmable and DevOps-friendly
Cost-effective

CloudFront Use Cases
Static asset caching
Live and on-demand video streaming
Security
Customizable content delivery
Dynamic content and API acceleration
Software distribution

Topics
Amazon Lightsail
AWS Elastic Beanstalk
AWS CloudFormation

What is Amazon Lightsail?
Everything you need to jumpstart your project on AWS:
compute, storage, and networking — for a low, predictable price
Test environments
Windows Server
Wordpress
Application hosting
Ecommerce
Email server

Amazon Lightsail: Infrastructure Made Simple
Lightsail Virtual Private Server (VPS)
Powerful API
High availability storage
Speedy, secure networking
Snapshots
Access to AWS services
Simplified load balancing
Managed databases

What is Elastic Beanstalk?
Upload your application code
The service handles:
üResource provisioning
üLoad balancing
üAuto scaling
üMonitoring
Support applications that scale to
serve millions of users

Elastic Beanstalk Features
• Wide selection of application platforms
• Variety of application deployment options
• Monitoring
• Application health
• Monitoring, logging, and tracing
• Management and updates
• Scaling
• Customization
• Compliance

What is AWS Cloud Formation?
Model and provision all your cloud infrastructure resources

AWS CloudFormation Example
Corp VPC (10.1.0.0/16)
Public Subnet 1
(10.1.11.0/24)
Example
SecurityGroup
Web-
Server
Internet
gateway
Template-file
(YAML/JSON)
----- -- -- --- -- ----
- -- -- --- --
----- -- -- --- --
----- -- -- --- --
CloudFormation Designer
Template-file
(YAML/JSON)
----- -- -- --- -- ----
- -- -- --- --
----- -- -- --- --
----- -- -- --- --

Module Summary
Elastic Load Balancing
Auto Scaling
Deploy highly available applications that scale with demand
Amazon CloudWatch Have complete visibility of your cloud resources and applications
Amazon Route 53 Run a highly available and scalable Domain Name System (DNS) web service
AWS Database Services Run SQL or NoSQL databases without the management overhead
AWS Lambda Run code without managing servers
Amazon CloudFront Deliver your content across a massively scaled and globally available network
Amazon Lightsail Rapidly build a project on AWS
AWS Elastic Beanstalk Deploy your application in the simplest way possible
AWS CloudFormation Programmatically deploy repeatable infrastructure

Reliability: AWS High Availability (HA)
Services with configurable HA
• Amazon EC2
• Amazon EBS
• Amazon RDS
Services with native HA
• Amazon S3
• ELB
• Amazon DynamoDB
• Amazon EFS
• Amazon Redshift
• Route 53
• …and many more

Example: High Availability through ELB
Web
Server
App
Server
DB
Server
Web
Server
App
Server
DB
Server
Availability Zone A
Availability Zone B
Replicated Data

Example: Web Application Hosting
Web
Server
App
Server
Web
Server
App
Server
Availability
Zone A
Synchronous
Replication
Amazon
Route 53
Application
Load BalancerAmazon
CloudFront
Amazon S3
Resources
and
Static
Content
DB
Server
DB
Server
Availability
Zone B
Auto
Scaling
Groups
Web
Server
App
Server
Web
Server
App
Server

Scenario

Created resources

Security Is Our Top Priority
Designed for
Security
Constantly
Monitored
Highly
Automated
Highly
Available
Highly
Accredited

Security, Identity, and Compliance Products
AWS Artifact
AWS Certificate Manager
Amazon Cloud Directory
AWS CloudHSM
Amazon Cognito
AWS Directory Service
AWS Firewall Manager
Amazon GuardDuty
IAM
Amazon Inspector
AWS Key Management Service
Amazon Macie
AWS Organizations
AWS Shield
AWS Secrets Manager
AWS Single Sign-On
AWS WAF
AWS Artifact
AWS Certificate Manager
Amazon Cloud Directory
AWS CloudHSM
Amazon Cognito
AWS Directory Service
AWS Firewall Manager
Amazon GuardDuty
IAM
Amazon Inspector
AWS Key Management Service
Amazon Macie
AWS Organizations
AWS Shield
AWS Secrets Manager
AWS Single Sign-On
AWS WAF

Topics
The Shared Responsibility Module
Identity and Access Management (IAM)
Security Compliance

AWS Shared Responsibility
Foundation Services
Compute Storage Database Network
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Client-side Data Encryption & Data
Integrity Authentication
Server-side Encryption
(File System and/or Data)
Network Traffic Protection
(Encryption/Integrity/Identity)
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer DataAWSCustomer

Security of the Cloud
Hosts, network, software, facilities
Protection of the AWS global infrastructure is top priority
Availability of third-party audit reports
Foundation Services
Compute Storage Database Network
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
AWS

Security in the Cloud
Client-side Data Encryption & Data
Integrity Authentication
Server-side Encryption
(File System and/or Data)
Network Traffic Protection
(Encryption/Integrity/Identity)
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer Data
Customer
Considerations
• What to store
• Which AWS services
• In what location
• In what content format and structure
• Who has access

Discussion: Who’s Responsible for What?
Unmanaged Services
• Amazon EC2
• Amazon EBS
Managed Services
• Amazon RDS
• Amazon S3
• Amazon DynamoDB
Operations
• Guest OS patching
• Database patching
• Firewall configuration
• Disaster recovery
• User data

What is IAM?
Securely control access to AWS resources
Manage users and their access
Manage roles and their permissions
Manage federated users and their permissions
Corp users
Roles
AWS users

IAM Authentication
IAM
user
IAM
group
IAM
AWS
CLI
AWS
Management
Console
$ aws
AWS
SDKs

IAM Authorization
IAM
group
IAM
policies
Full
access
Read
only
Amazon S3
Bucket 1
Amazon S3
Bucket 2

AWS Account Root User
Account root user has complete access to all AWS services
Recommendations
Delete root user access keys
Create an IAM user
Grant administrator access
Use IAM credentials to interact with AWS
IAM

IAM Roles
• IAM users, applications, and
services may assume IAM roles
• Uses an IAM policy for
permissionsIAM Role

Using Roles for Temporary Security Credentials
EC2
instance
APP
Amazon S3
bucket
IAM role Amazon S3
policy
Assume

IAM – Best Practices
• Delete AWS root account access
keys
• Activate multi-factor authentication
(MFA)
• Only give IAM users permissions
they need
• Use roles for applications
• Rotate credentials regularly
• Remove unnecessary users
and credentials
• Monitor activity in your AWS
account
• …And more

Assurance Programs

How AWS Helps Customers Achieve Compliance
Sharing Information
Industry certifications
Security and control practices
Compliance reports directly
under NDA
Assurance Program
• Certifications/attestations
• Laws, regulations, and privacy
• Alignments/frameworks

Customer Responsibility
Review – Design – Identify – Verify

How Do You Pay for AWS?

Pay As You Go
On-premises/colocation AWS
UNDERUTILIZATION
Only pay for what you use

Save When You Reserve: Reserved Instances
• Save up to 75% over equivalent on-demand capacity
• No upfront payments (NURI), partial up-front (PURI), all up-front (AURI)
NURI PURI AURI
EC2
Instance

Use More, Pay Less
Automatic volume-based discounts

Pricing Concepts
Compute Storage Data Transfer
• Charged per hour/second*
• Varies by instance type
*Linux only
• Charged typically per GB • Outbound is aggregated
and charged
• Inbound has no charge
(with some exceptions)
• Charged typically per GB

Services Pricing
Compute Storage Database Migration
Networking & Content Delivery Developer Tools Management Tools Media Services
Security, Identity & Compliance Analytics Machine Learning Mobile Services
AR & VR Application Integration Customer Engagement Business Productivity
Desktop & App Streaming Internet of Things Game Development AWS Cost Management

Closer Look
Amazon EC2
Amazon EBS
Amazon S3

Amazon EC2: Four Ways to Pay
Type Description Use Case
On-Demand • Pay by per hour/second* • Short-term, unpredictable workloads
Reserved
Instances
• Discount for 1- to 3-year
commitments
• Applications with steady state usage
Spot Instances
• Use spare AWS capacity for
up to 90% discount
• Applications with flexible start and end
times
Dedicated Hosts • Physical server dedicated to you
• Applications with specific compliance
requirements

Amazon EC2 Pricing Factors
Server run time
Instance type
Pricing model
Number of instances
Load balancing
Detailed monitoring
Multiple Elastic IP addresses
OS and software

Amazon EBS Pricing
Volumes Snapshots Data Transfer
• Charged by GB
provisioned/month
• Varies by volume type
• Charged by space
consumed in Amazon S3
• Charged for volume
copied across regions
• Inbound data transfer is
free
• Outbound data transfer
charges are tiered

Amazon S3 Pricing
Amount of storage used
Region
Storage class (Standard, S-IA, Glacier)
Number and type of requests (GET, PUT, COPY)
Amount of data transferred out of the region

AWS Services with No Additional Charge
Amazon VPC
Elastic Beanstalk
AWS CloudFormation
IAM
Auto Scaling

AWS Free Tier
Enables you to gain free, hands-on experience with
the AWS platform, products, and services

AWS Simple Monthly Calculator
Estimate your monthly bill
Per-service cost breakdown
Aggregate monthly estimate
Provides common customer examples

AWS Total Cost of Ownership (TCO) Calculator

What Is Trusted Advisor?
A service providing guidance to help you reduce cost,
increase performance, and improve security

Trusted Advisor: Core vs. Full
Core Checks and Recommendations
(included)
Seven core checks around security
and performance
Service limits
Full Trusted Advisor Benefits
(With Business or Enterprise support)
• Full set of checks
• Notifications
• Programmatic access via API

Support Plan Overview
177
Support Plan Features
Basic
• Customer service
• Support forums
• Service health checks
• Documentation, whitepapers, and best-practice guides
Developer
• Best-practice guidance
• Client-side diagnostic tools
• Building-block architecture support
Business
• Use-case guidance
• IAM for controlling individuals' access to AWS Support
• Full AWS Trusted Advisor
• An API for interacting with Support Center and Trusted Advisor
• Third-party software support
Enterprise
• Application architecture guidance
• Infrastructure event management
• Technical Account Manager (TAM)
• White-glove case routing
• Management business reviews

Tech Support Access and Response
178
Support
Plan
Tech Support Access Response times
Basic • N/A • N/A
Developer
• Local business hours
• Cloud Support Associates
• Email
• General guidance: < 24 business hours
• System impaired: < 12 business hours
Business
• 24x7
• Cloud Support Engineers
• Email, chat, phone
• General guidance: < 24 hours
• System impaired: < 12 hours
• Production system impaired: < 4 hours
• Production system down: < 1 hour
Enterprise
• 24x7
• Sr. Cloud Support Engineers
• Email, chat & phone
• General guidance: < 24 hours
• System impaired: < 12 hours
• Production system impaired: < 4 hours
• Production system down: < 1 hour
• Business-critical system down: < 15 minutes

Expand Your Cloud Skills with AWS
aws.amazon.com/certificationaws.training aws.amazon.com/training
Digital Training
Free, self-paced
online courses
built by AWS
experts
Classroom Training
Classes taught by
accredited AWS
instructors
AWS Certification
Exams to validate
expertise with an
industry-recognized
credential

AWS ILT Training Courses
181
AWS Technical Essentials or AWS Cloud Practitioner
1 day
Architecting on AWS
3 days
Developing on AWS
3 days
Systems Operations on AWS
3 days
Big Data on AWS
3 days
Advanced Architecting on AWS
3 days
DevOps Engineering on AWS
3 days
Security Engineering on AWS
3 days
Migrating to AWS
2 days
Data Warehousing on AWS
3 days
Deep Learning on AWS
3 days
Building a Serverless Datalake
on AWS
1 day
Running Container-Enabled
Microservices on AWS
1 day

AWS ILT Training Courses

Course Summary
In this course, we covered:
The AWS Value Proposition
The AWS Global infrastructure
Several key services
Security and compliance
Fundamental architectural considerations
Pricing and Support
AWS Training and Certification

Thank you!
AWSOME DAY
Hakha Momeni
hmmomeni@amazon.com

Introduction to the AWS Cloud - AWSome Day 2019 - Vancouver

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Introduction to the AWS Cloud - AWSome Day 2019 - Vancouver

Semelhante a Introduction to the AWS Cloud - AWSome Day 2019 - Vancouver (20)

Mais de Amazon Web Services

Mais de Amazon Web Services (20)

Introduction to the AWS Cloud - AWSome Day 2019 - Vancouver