1. CLOUD COMPUTING WITH AWS AN INTRODUCTION
Larry Pizette

2. Cloud Computing Benefits
No Up-Front Capital Expense
Low Cost
Pay Only for What You Use
Self-Service Infrastructure
Easily Scale Up and Down
Improve Agility & Time to Market
Deploy

3. no long-term contracts
Physical Space
Cabling
Power
Cooling
Networking
Racks
Servers
Storage
Certification
Labor
ON-PREMISE
Variable Cloud Computing Costs $0
to Get Started
no long-term contracts
CLOUD COMPUTING VS
Up-Front On-Premise Costs

4. ELASTIC CAPACITY
No Notes

5. Pay Only for What You Use
Unable to serve
customers
Large
Capital
Expenditure
Opportunity
Cost
Infrastructure Cost
Predicted
Demand
Traditional
Hardware
Actual
Demand
Cloud
Computing
Time

6. WASTE On and Off (e.g., research) Fast Growth (e.g., online classes)
Variable peaks (e.g., research)
Predictable peaks (e.g., Sept)
CUSTOMER DISSATISFACTION

7. WITH AWS On and Off (e.g., research)
Fast Growth (e.g., online classes)
WITH AWS
Variable peaks (e.g., research)
Predictable peaks (e.g., Sept)

8. GLOBAL INFRASTRUCTURE
No Notes

9. AWS Global Infrastructure
9 AWS Regions
30+ AWS Edge Locations

10. Asia Pacific (Singapore) South America (Sao Paulo)
AWS Regions & Availability Zones
US REGIONS
GLOBAL REGIONS
Availability Zone A
Availability Zone B
Availability Zone C
Availability Zone D
US East (VA)
Availability Zone A
Availability Zone B
US West (CA)
Availability Zone A
Availability Zone B
Availability Zone C
Asia Pacific (Tokyo)
Availability Zone A
Availability Zone B
Asia Pacific (Singapore)
Availability Zone A
Availability Zone B
Availability Zone C
US West (OR)
Availability Zone A
Availability Zone B
GovCloud (OR)
Availability Zone A
Availability Zone B
Availability Zone C
EU (Ireland)
Availability Zone A
Availability Zone B
South America (Sao Paulo)
Availability Zone A
Availability Zone B
Asia Pacific (Sydney)
Customer Decides Where Applications and Data Reside
Note: Conceptual drawing only. The number of Availability Zones may vary.

11. Independent Software Vendors
Large Partner Ecosystem
System Integrators
Independent Software Vendors

12. Certified Applications
AWS is Open and Flexible
Operating Systems
Languages & Libraries
Certified Applications

13. AWS SERVICES

14. Deployment & Automation
AWS Platform
Your Applications
Foundation Services
Compute
Amazon EC2
Auto Scale
Storage
Amazon S3
Amazon EBS
Amazon StorageGateway
Database
Amazon RDS
Amazon SimpleDB
Amazon ElastiCache
Amazon DynamoDB
Networking
Amazon VPC Elastic Load Balancing
Amazon Route 53
AWS Direct Connect
Management & Administration
Application Platform Services
Content Distribution
Amazon CloudFront
Application Svcs
Simple Workflow Service
CloudSearch
Amazon SNS, SQS, SES
Parallel Processing
Elastic MapReduce
Libraries & SDKs
Java, PHP, Python,
Ruby, .NET
Identity & Access
AWS IAM
Identity Federation
Consolidated Billing
Web Interface
Management Console
Monitoring
Amazon CloudWatch
Deployment & Automation
AWS Elastic Beanstalk
AWS CloudFormation
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations

15. Compute Amazon Elastic Compute Cloud (Amazon EC2)
EC2 Instances = Virtual Servers
Resizable compute capacity in 16 instance types
Reduces the time required to obtain and boot new server instances to minutes or seconds
Scale capacity as your computing requirements change
Pay only for capacity that you actually use
Choose Linux or Windows
Deploy across Regions and Availability Zones for reliability
Support for virtual network interfaces that can be attached to EC2 instances in your VPC

16. 128 64 32 16 8 4 2 1 Memory (GB) EC2 Compute Units (HP) High Memory32 16 8 4 2 1
High Memory
Cluster Compute
& High I/O
Standard
Memory (GB)
High CPU
Micro
EC2 Compute Units (HP)

17. Compute Amazon Machine Image Building blocks of EC2 instances
Can be public or private
Create hardened or gold “Images” of your EC2 infrastructure

18. Compute Auto Scaling Client Defined Business Rules
Scale your Amazon EC2 capacity automatically once you define the conditions (may be 100’s of servers)
Can scale up just a little…doesn’t need to be massive number of servers (may be simply 2 servers)
Well suited for applications that experience variability in usage
Set minimum and maximum scaling policies

19. Storage Simple Storage Service (S3) Web-scale Internet Storage
A “Bucket” is equivalent to a “folder”
Able to store unlimited number of Objects in a Bucket
Objects from 1B-5 TB; no bucket size limit
Highly available storage for the Internet (object store)
HTTP/S endpoint to store and retrieve any amount of data, at any time, from anywhere on the web
Highly scalable, reliable, fast, and inexpensive
Over 1 trillion objects stored
Peak requests 650,000+ per second

20. 650,000 + peak transactions per second
Objects in S3
1 Trillion
650,000 + peak transactions per second

21. Storage Elastic Block Store (EBS) EBS Volumes = Virtual Disks
Use for persistent storage
Can use to create RAID configuration for a server
Off-instance block storage that persists independently
Storage volumes for use with Amazon EC2 instances – create, attach, backup, restore and delete
Can be attached to a running Amazon EC2 instance and exposed as a block device for raw or formatted (filesystem) access
Volumes behave like unformatted block devices for Linux or Windows instances

22. Storage
AWS Glacier G
A low-cost storage service for data archiving and backup
$0.01 per GB / Month
Optimized for data that is infrequently accessed
Retrieval times measured in hours not days or weeks
Annual durability of % for an archive
AES 256 data at rest encryption
Data stored as archives within a vault. Vaults are located within a specific AWS region

23. Database DynamoDB Fully managed NoSQL database.
Eliminates the administrative burden of data modeling, index maintenance, and performance tuning.
Durability and high-availability - stores data on Solid State Drives (SSDs) and replicates it synchronously across multiple AWS Availability Zones in an AWS Region.
Scalability - With AWS Console, you can grow your DynamoDB table from 10 to 100,000 writes per sec.
See video:

24. Database RDS Amazon Relational Database Service (RDS)
Fully-managed, tuned MySQL, Oracle 11g, or MS SQL databases
Cost-efficient and resizable capacity
Manages time-consuming database admin tasks
Code, applications, and tools you already use today work seamlessly
Automatically patches the database software and backs up your database
Flexible Licensing: BYOL or License Include

25. Networking
ELB
Route 53
VPC
No Notes

26. Networking Amazon Elastic Load Balancing
Supports the routing and load balancing of HTTP, HTTPS and generic TCP traffic to EC2 instances
Supports health checks to ensure detect and remove failing instances
Dynamically grows and shrinks required resources based on traffic
Seamlessly integrates with Auto-scaling to add and remove instances based on scaling activities
Single CNAME provides stable entry point for DNS configuration

27. Networking Amazon Route 53 Route end users to Internet applications
Answers DNS queries with low latency by using a global network of DNS servers
Latency based routing to closest AWS endpoint (e.g. EC2 instances, Elastic IPs or ELBs)
Deep integration with other AWS services (ELB, EC2 NAT/EIP, etc.)

28. Networking Amazon Virtual Private Cloud (VPC)
Secure and seamless bridge between a company’s existing private network and the AWS cloud
Connect existing infrastructure to a set of isolated AWS compute resources via a Virtual Private Network (VPN) connection
Bring your own address space and extend existing management capabilities

29. Networking

30. Deployment & Automation
Application Platform Services
Your Applications
Foundation Services
Compute
Amazon EC2
Auto Scale
Storage
Amazon S3
Amazon EBS
Amazon StorageGateway
Database
Amazon RDS
Amazon SimpleDB
Amazon ElastiCache
Amazon DynamoDB
Networking
Amazon VPC Elastic Load Balancing
Amazon Route 53
AWS Direct Connect
Management & Administration
Application Platform Services
Content Distribution
Amazon CloudFront
Application Svcs
Simple Workflow Service
CloudSearch
Amazon SNS, SQS, SES
Parallel Processing
Elastic MapReduce
Libraries & SDKs
Java, PHP, Python,
Ruby, .NET
Identity & Access
AWS IAM
Identity Federation
Consolidated Billing
Web Interface
Management Console
Monitoring
Amazon CloudWatch
Deployment & Automation
AWS Elastic Beanstalk
AWS CloudFormation
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
No Notes

31. Content Delivery Amazon CloudFront Web service for content delivery
Distribute content to end users with low latency, high data transfer speeds, and no commitments
Delivers your content using a global network of 30+ edge locations
Supports download, streaming, live streaming, and dynamic content
Use Cases: Video and Rich Media, Online Gaming, Interactive Agencies, Software Downloads, Static Websites
Static web content that must be delivered to global user base at Highest bandwidth / Lowest latency / Lowest cost

32. Parallel Processing Amazon Elastic MapReduce (EMR)
Managed Hadoop and infrastructure
Reduces complexity of Hadoop management
Handles node provisioning, customization, and shutdown
Provides tight integration with AWS services
Optimized for Amazon Simple Storage Service (S3)
EC2 integration with automatic re-provisioning on node failure
Cluster monitoring/alarming through CloudWatch
Leverages significant operational experience
Monitor thousands of clusters per day
Use cases span from University students to Fortune 50

33. Libraries & SDKs
Your choice of programming language (Java, PHP, Python, Ruby, .NET) and mobile platform (Android, iOS)
The Developer Centers contains sample code, documentation, tools, and additional resources to help you build applications on Amazon Web Services.

34. Web Console
On-demand, Self Service Management Access

35. EC2 Security Groups (SGs)
Identity & Access Management
EC2 Security Groups (SGs)
SGs specify the allowed inbound network traffic by port, protocol, and originating IP addresses
SGs are applied before traffic gets to guest OS
EC2 instances can be assigned to Security Groups
Physical Interfaces
Customer 1
Hypervisor
Customer 2
Customer n …
Virtual Interfaces
Firewall
Security Groups

36. Identity & Access Management
IAM enables customers to create and manage users in AWS’s identity system
Identity Federation with local directory is an option for enterprises
Very familiar security model
Users, groups, permissions
Allows customers to
Create users
Assign individual passwords, access keys, multi-factor authentication devices
Grant fine-grained permissions
Optionally grant them access to the AWS Console
Organize users in groups

37. SECURITY IS A SHARED
RESPONSIBLITY

38. Built to Enterprise & Gov Standards
Security & Compliance Resources
Security & Compliance Center:
Security Overview & Best Practices
AWS Risk & Compliance Whitepaper
Hardware, Software & Network
Systematic change management
Phased updates deployment
Safe storage decommission
Automated monitoring and self-audit
Advanced network protection systems
Certifications and Accreditations
ISO 27001
SSAE 16 / ISAE 3402 / SOC1 (formerly U.S. standard SAS-70 Type II)
FISMA Moderate & DIACAP Controls; ITAR region
HIPAA applications certified on AWS
Payment Card Industry (PCI) Data Security Standard (DSS) Level 1
Physical
Datacenters in nondescript facilities
Physical access strictly controlled
Must pass two-factor authentication at least twice for floor access
Physical access logged and audited
No notes

39. Customer Amazon AWS Global Infrastructure Compute Storage Database
Foundation Services
Compute
Storage
Database
Networking
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Client-side Data Encryption & Data Integrity Authentication
Server-side Encryption
(File System and/or Data)
Network Traffic Protection
(Encryption/Integrity/Identity)
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer Data
Amazon
Customer
SAS-70 Type II
ISO 27001/ 2 Certification
Payment Card Industry (PCI)
Data Security Standard (DSS)
Customers implement their own set of controls

40. AWS Customer Shared responsibility Facilities Physical Security
Physical Infrastructure
Network Infrastructure
Virtualization Infrastructure
Operating System
Application
Security Groups
Network ACLs
Network Configuration
Account Management

41. Examples of Customer Responsibilities
Apply Your Information Management Program - that integrates Information Assurance
Standardize Machine Images – create gold copy images for production deployment/to launch new instances
Build and test in a sandbox environment – work out the bugs, figure out how to break it, architect to be resilient
Do the same stuff you do in-house – quarterly patch management, IDS/IPS, logging, tripwire, etc.
Conduct a Risk Assessment - to determine level of security controls you require
Role Based Access Controls – restrict access to system components based upon need to know
Use Encryption – for data in transit, for data at rest, filesystem
Key Management – rotate keys used to access your resources (AWS does not hold these…you do)
Setup Monitoring/Alerting – collect metrics and enable alerting for when events occur
Vulnerability Scans – allowed via a permission process (else we’ll kill/block the source of scans)
Prepare for Failure – create backups, store data in more than one location, test backups, have a contingency system ready

42. Useful Resources & Links
Architecture Center:
Security Center:
Whitepapers:
Resources:
Case Studies:
Solution Providers:
Calculator:
TCO Calculator:
AWS Blog:
The Power of 60:

43. THANK YOU