Tom Jones
Solution Architect, Amazon Web Services
Developing and Deploying Secure, Scalable Applications on Amazon Web Services
Technology Partners Consulting Partners AWS MarketplaceEcosystem
Elastic Beanstalk OpsWorks CloudFormation
Deployment
& Management
Administration
& Security IAM CloudWatch CloudTrailAPIs and SDKsManagement Console Command Line Interface
Direct Connect Route 53VPCNetworking
Analytics
Data PipelineRedshiftEMR Kinesis SWFSQS CloudSearchSESAppStream
Application Services
CloudFrontS3 EBS Glacier DynamoDB ElastiCache
Storage & Content DeliveryCompute Databases
RDSElastic Load BalancerEC2 Auto Scaling
Virtual Server
Load BalancerAutomaticElasticity
ObjectStorage
BlockStorage
ArchiveStorage
CDN RDB NoSQL Caching
Isolated Cloud
Resources
Dedicated Network
DNS
Hadoop Framework
PB scale DW
Real-timeDate
stream
Data-Driven Workflow
Elastic Transcoder
Queueing WorkflowApp
StreamingTranscoding Emailing Search
AdministrationAccess Control
MonitoringLog
Tracking
Application Container Resource Management Resource Template
Development Commend
Support Professional Services Training Certification
AWS provides broad & deep services
Amazon S3
Highly durable object storage for all types of data
Internet-scale storage
Grow without limits
Built-in redundancy
Designed for
99.999999999%
durability
Flexibility & Reliability• Pay as you go
• No upfront investment
No commitment
• No risky capacity planning
• No need to provision
for redundancy
or overhead
Compute Services
Elastic Compute Cloud (EC2)
c3.8xlarge
g2.medium
m3.large
Basic unit of compute capacity, virtual machines
Range of CPU, memory & local disk options
Choice of instance types, from micro to cluster compute
Strengthen your security posture
Get native functionality and tools
Over 30 global compliancecertifications and accreditations
Leverage security enhancements gleaned from 1M+ customer experiences
Benefit from AWS industry leading security teams 24/7, 365 days a year
Security infrastructure built to satisfy military, global banks, and other
high-sensitivity organizations
Focus on your core mission
Lower the time spent
on infrastructure
Dedicate more
resources to
innovation
Concentrate on
new business
initiatives
“Our goal is to move at the speed of business. Our customers’ needs change
constantly, and we need to be able to adapt to that.”
Keith Homewood – Cloud Product Owner, Nordstrom
MonitorProvisionDeployTestBuildCode
Elastic Beanstalk
OpsWorks
Cloud
Watch
Cloud
Formation
Code
Deploy
Code
Commit
Code
Pipeline
AWS DevOps Services
AWS CodeCommit
git pull/push CodeCommit
Git objects inAmazon S3
Git index inAmazon DynamoDB
Encryption keyin AWS KMS
SSH or HTTPS
Secure, scalable, and managed Git source control
$ git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/aws-cli
Cloning into 'aws-cli'...
Receiving objects: 100% (16032/16032), 5.55 MiB | 1.25 MiB/s, done.
Resolving deltas: 100% (9900/9900), done.
Checking connectivity... done.
$
AWS CodePipelineContinuous delivery and release automation
Build1) Build
2) Unit test
1) Deploy
2) UI test
Source Beta Production1) Deploy
2) Perf test
Gamma1) Deploy canary
2) Deploy region 1
3) Deploy region 2
1) Pull
AWS CodeDeployApplication Deployment to any target
AWS CodeDeploy is a service that automates code deployments to any instance
appspec.yml version: 0.0os: linuxfiles:- source: /
destination:/var/www/htmlpermissions:- object: /var/www/html
pattern: “*.html”owner: rootgroup: rootmode: 755
hooks:
Choose deployment speed & group
v2 v2 v2 v2 v2 v2
one at a time
half at a time
all at once
v2 v2 v2 v1 v1 v1
v2 v1 v1 v1 v1 v1 Agent Agent
Dev Deployment group
ORProd Deployment group
Agent
AgentAgent
Agent Agent
Agent
Deploy!
aws deploy create-deployment \
--application-name MyApp \
--deployment-group-name TargetGroup \
--s3-location bucket=MyBucket,key=MyApp.zip
AWS Cloudformation
“AWS CloudFormation provides an easy way to create and manage a collection of related AWS resources, provisioning and updating them in an orderly and predictable fashion.”
Infrastructure as code & resource provisioning
Template CloudFormation Stack
JSON formatted file
Parameter definition
Resource creation
Configuration actions
Configured AWS
services
Comprehensive service support
Service event aware
Customizable
Framework
Stack creation
Stack updates
Error detection and rollback
CloudFormation – Components & Technology
Information required to deploy application
01
02
03
04
Region
Stack (container) type
Single InstanceLoad Balanced with
auto-scalingOR
Database (RDS) Optional
Your codeSupported Platforms
Security Shared Responsibility Model
AWS is responsible
for the security OFthe cloud
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability Zones
Edge Locations
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability Zones
Edge Locations
Client-side Data Encryption
Server-side Data Encryption
Network Traffic Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer contentC
ust
om
ers
AWS Shared Responsibility Model
Customers are responsible for their security and compliance IN the Cloud
AWS is responsible for the security OFthe Cloud
Conf igCloudTrail
Compliance
Serv ice
Catalog
IdentityEncryptionNetworking
IA M A c tive Direc tory
Integration
Key Management
Serv ice
CloudHSM SERV ER-SIDE
ENCRY PTION
V ir tual Pr ivate
Cloud
Web A pplication
FIREWA LL
SA ML
Federation
VPC Public Subnet 10.10.1.0/24 VPC Public Subnet 10.10.2.0/24
VPC CIDR 10.10.0.0/16
VPC Private Subnet 10.10.3.0/24 VPC Private Subnet 10.10.4.0/24
VPC Private Subnet 10.10.5.0/24 VPC Private Subnet 10.10.6.0/24
AZ A AZ B
Public ELB
Internal ELB
RDSMaster
AutoscalingWeb Tier
AutoscalingApplication Tier
InternetGateway
RDSStandby
Snapshots
Multi-AZ RDSData Tier
ExistingDatacenter
VirtualPrivate
Gateway
CustomerGateway
VPN Connection
Direct Connect
NetworkPartnerLocation
Administrators &Corporate Users
Amazon Virtual Private Cloud
Availability Zone A
Private subnet
Public subnet
Private subnet
Availability Zone B
Public subnet
Private subnet
ELB
Web
Back end
VPC CIDR 10.1.0.0/16
ELB
Web
Back end
VPC
sg_ELB_FrontEnd (ELB Security Group)
sg_Web_Frontend (Web Security Group)
Security Groups
sg_Backend (Backend Security Group)
Cryptographic Services
Amazon CloudHSM
Deep integration with AWS Services CloudTrail AWS SDK for application encryption
Dedicated HSM Integrate with on-premises HSMs Hybrid Architectures
AWS KMS
AWS regions are geographically isolated by design
Customer chooses where to place data
Data is not replicated to other AWS regions and doesn’t move unless you choose to move it
Data Locality
What this means
You benefit from an environment built for the most security sensitive organizationsAWS manages 1,800+ security controls so you don’t have toYou always have full ownership and control of your dataYou get to define the right security controls for your workload sensitivity
Interacting with AWS: SDKs
Ruby
iOS
Python (boto)
Android Node.js
AWS Toolkit
for Visual Studio
.NET
AWS Toolkit
for Eclipse
PHP
AWS Tools
for Windows PowerShell
AWS Simple Icons: SDKs
AWS CLI
JavaScriptJava
Xamarin
Interacting with AWS: AWS CLI
aws ec2 describe-instances
aws ec2 start-instances –instance-ids <value>
aws ec2 stop-instances –instance-ids <value>
aws s3 cp object.file s3://mybucket/object.file
aws s3 sync s3://mybucket ./localfolder/
We are here to help
• Online tutorials
• Training classes
• Certifications
• AWS Summits• Santa Clara: July 12-13
• NYC Summit: August 10-11
• AWS re:Invent: November 28 – December 2, 2016
AWS Pop-up Loft
http://aws.amazon.com/start-ups/loft/sf-loft/
925 Market Street, San Francisco, CA
Open Monday - Friday, 10:00am - 6:00pm.
Example Applications
Elastic Beanstalk:
http://amzn.to/1pyLzDH
Code Pipeline + Code Deploy: http://amzn.to/1SzT3h0