1. Deploying an Application on the Cloud Chapter 4

2. Topics Your experience with Google App Engine and mine with Pop!World Web application Architecture Machine Image design

3. Amazon S3 API (REST/SOAP) http://docs.amazonwebservices.com/Amazon S3/latest/ http://docs.amazonwebservices.com/Amazon S3/latest/

4. Fig. 4-1Web Application Architecture Use an MVC pattern Display, UI, Content: View Objects, (Database): Model Activities, Operations: Controller

5. Machine Image Design Important indirect benefits of the cloud are: – It forces discipline in deployment planning – It forces discipline in disaster recovery First step in moving to the cloud is to prepare a repeat redeployment process Machine image helps in this process. – Is a very important concept (: comes from virtualization. – Ideal for cloud environment.

6. AMI Amazon machine image is a raw copy of the operating system and the core software, any installed applications. AMI is used for launching an instance. More importantly you can store a snapshot of your instance in an AMI for use by others or by for later use.

7. AMI Security In order to programmatically activate an instance you need: AMI key and your security credentials. Access id key, security access key are needed. Never store data in amazon AMI. Data is yours irrespective of the method (patented etc.), right?

8. So what belongs in the AMI? 1.Create a component model that identifies what components and versions are required to run the service that the new machine image will support. (Ex: MYSQL… EBS) 2.Separate out stateful data in the component model. You will need to keep it out of your machine image. 3.Identify the operating system on which you will deploy. 4.Search for an existing, trusted baseline public machine image for that operating system. 5.Harden your system using a tool such as Bastille. 6.Install all of the components in your component model. 7.Verify the functioning of a virtual instance of your machine. 8.Build and save the machine image.

9. Hardening the system Hardening an operating system is the act of minimizing attack vectors into a server. – Removing unnecessary services. – Removing unnecessary accounts. – Running all services as a role account (not root) when possible. – Running all services in a restricted jail when possible. – Verifying proper permissions for necessary system services. The best way to harden your Linux system is to use a proven hardening tool such as Bastille.

10. Privacy Design Consider a credit card using e-commerce application. – The application server and credit card server sit in two different security zones with only web services traffic from the application server being allowed into the credit card processor zone. – Credit card numbers are encrypted using a customer-specific encryption key. – The credit card processor has no access to the encryption key, except for a short period of time (in memory) while it is processing a transaction on that card. – The application server never has the ability to read the credit card number from the credit card server. – No person has administrative access to both servers Availability zones are quite useful in this respect.

11. Database Management The trickiest part of the cloud management is the management of persistent data. Use block storage, snapshot it, check point periodically. In case of a failure recover to the latest checkpointed state. Use EBS for database. Clustering or replication: replication is cheaper and simpler.