Berlin
Best Practices for Running Enterprise Applications Philipp Behre
Agenda •
Cloud Adoption goes in stages and various flavors
•
Running business applications on AWS
•
Foster agility and gain transparency without losing control
Cloud Adoption goes in stages
Dev & Test
True Production
Mission Critical
All-in
The journey we’re seeing with AWS customers
Dev & Test
True Production
Mission Critical
All-in
Development and test environments
Build production apps
Build mission-critical apps
Corporate standard
Migrate production apps
Migrate mission-critical apps
Run production apps
Run mission-critical apps
What sets AWS apart? Experience
Building and managing cloud since 2006
Service Breadth & Depth
40+ services to support any cloud workload
Pace of Innovation
History of rapid, customer-driven releases
Global Footprint
11 regions, 28 availability zones, 52 edge locations
Pricing Philosophy
45+ proactive price reductions to date
Ecosystem
8,000+ SIs and ISVs; 2,000+ Marketplace products
*as of July 31, 2014
To name a few …
Running Dev & Test on AWS - an example
PRD
ECC BW SRM
DEV
QAS
ECC
ECC
BW
BW
SRM
SRM
VPN or AWS Direct Connect
Virtual Private Cloud
Corporate Data Center
Amazon Web Services
Microsoft Applications on AWS Some Microsoft Applications running on AWS
The AWS advantage
Easy Deployment
Cost Efficiency & Reduction
Reliability
Fast Performance
Customer Success
…
Microsoft Windows architecture on AWS • Install critical workloads in at least two Availability Zones to provide high availability • Place application servers in private subnets to prevent direct access from the Internet • Deploy bastion hosts, reverse proxies, and other Internet-facing servers in public subnets
Architectural considerations •
Virtual Private Cloud (Amazon VPC)
•
The principle of least privilege
•
Security groups & NetworkACLs
•
Remote administration
Windows architecture on AWS
Availability Zone Private Subnet
Public Subnet NAT
RDGW
WEB
APP
DB
DC
IIS Server
App Server
SQL Server
Domain Controller
10.0.2.0/24
10.0.0.0/24
Remote
Users / Admins
Private Subnet
Public Subnet NAT
RDGW
10.0.0.0/24
WEB
APP
DB
DC
IIS Server
App Server
SQL Server
Domain Controller
10.0.2.0/24
Availability Zone
Active Directory hybrid deployments • Connectivity via VPN or Direct Connect • Security groups must allow traffic to and from DCs on-premises • Properly define AD sites and subnets • Configure site-link costs • Enable domain members for "Try Next Closest Site“ group policy setting
AD forest spanning AWS and corporate data center
DC1
Seattle
DC3 VPN Private Subnet Availability Zone
DC2
Tacoma Corporate Network
AD forest spanning AWS and corporate data center
X DC1
Seattle
DC3 VPN Private Subnet Availability Zone
DC2
Tacoma
DC1 goes down, where do clients in Seattle go for Directory Services?
Corporate Network
AD forest spanning AWS and corporate data center
DC1 0
t 10
Cos
Seattle / AD Site 1
Private Subnet
DC3
Cost 50
VPN AD Site 3
Cost
100
Availability Zone
DC2
Tacoma / AD Site 2
Properly implemented site topology and “Try Next Closest Site” policy enabled. Clients use least cost path to DC.
Corporate Network
SQL Server High Availability • Amazon RDS Multi-AZ Deployments – Fully managed by AWS – No administrative intervention – Uses SQL Server mirroring
• SQL Server Enterprise 2012/2014 – Managed by you – HA achieved using WSFC & AlwaysOn Availability Groups
SQL Server High Availability (HA)
Synchronous-commit
Synchronous-commit
Primary Replica
Secondary Replica Automatic Failover
Primary: 10.0.2.100 WSFC: 10.0.2.101 AG Listener: 10.0.2.102
AG Listener: ag.awslabs.net
Primary: 10.0.3.100 WSFC: 10.0.3.101 AG Listener: 10.0.3.102
Private Subnet
Private Subnet
Availability Zone 1
Availability Zone 2
WSFC Quorum
Synchronous-commit
Synchronous-commit
Primary Replica
Secondary Replica Automatic Failover
Witness Server
Private Subnet
Private Subnet
Availability Zone 1
Availability Zone 2
WSFC Quorum
Secondary Replica
Primary Replica Automatic Failover
Availability Zone 1
Availability Zone 2
Witness Server
Availability Zone 3
SQL Server HA with Readable Replica
Synchronous-commit
Synchronous-commit
Asynchronous-commit
Primary Replica
Secondary Replica 1
Secondary Replica 2 (Readable)
Automatic Failover
AG Listener: ag.awslabs.net
Reporting Application
Private Subnet
Private Subnet
Availability Zone 1
Availability Zone 2
SQL Server Disaster Recovery & Backup
Corporate Network
Manual Failover
Secondary Replica 2 (Readable)
Secondary Replica 1
Primary Replica Automatic Failover
VPN
AG Listener: ag.awslabs.net Private Subnet
Reporting Application Private Subnet
Backups Availability Zone 1
Availability Zone 2
SharePoint 2013 High Availability • Web tier is made highly available through load balancing • Application-tier load balancing is native to SharePoint • Database-tier high availability can be achieved with SQL AlwaysOn
Internet facing SharePoint farm on AWS
Availability Zone Public Subnet Private Subnet NAT
RDGW
DB
WEB
APP
Primary
DC
Web Front-End
App Server
SQL Server
Domain Controller
10.0.2.0/24
10.0.0.0/24
Availability Group Users
Public Subnet NAT
RDGW
10.0.0.0/24
Private Subnet
DB
WEB
APP
Secondary
DC
Web Front-End
App Server
SQL Server
Domain Controller
10.0.2.0/24
Availability Zone
Remote administration Deploying a bastion host in each Availability Zone can provide highly available and secure remote access over the Internet • Clients can use the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted connection • Bastion hosts can run Windows PowerShell Web Access for remote command line administration
Secure remote administration architecture
Accept TCP Port 3389 from Gateway SG
Accept TCP Port 443 from Admin IP TCP 443
TCP 3389 RDGW
TCP 3389
WEB1 WEB2
AWS Administrator Web Security Group
Gateway Security Group Corporate Data Center
Public Subnet
Private Subnet Availability Zone
Requires one connection: • Connect to the RD Gateway, and the gateway proxies the RDP connection to the back-end instance.
Remote Administration High Availability •
Remote Desktop Gateway Server Farm – Still requires load balancing – Farm members must have identical policies – Farm members must be domain joined
•
Amazon Route 53 Health Checks and DNS Failover – Active-active failover – Active-passive failover
Quick Start reference deployments
aws.amazon.com/quickstart •
Lync Server 2013
•
Active Directory domain services
•
SQL Server 2012 & 2014 with WSFC
•
SharePoint 2013 Enterprise
•
PowerShell DSC
•
Exchange Server 2013
Foster agility and gain transparency without losing control
Today, IT and Project Teams often lack common ground
IT Service Team
Project Teams
Control Visibility Compliance
Agility Self-service Time to market
Empower agile teams with standardized self-service
IT Service Team
Project Teams
Create custom services and grant access to developers
Use a personalized portal to find & launch services
An integrated approach to gain transparency Create/Update Validate provision
publish
Service Catalog
Select & provision
template change
change notifies notifies
Captures all API interaction
Resource stack
Monitor Change
Monitors AWS & application
monitors
Alert
initiates
Monitor
Capture Audit Logs
Secures audit data
Durable Storage
An integrated approach to gain transparency Create/Update Validate provision
publish
Select & provision AWS ServiceCatalog
template
change
change notifies notifies
Catalog (resources & changes)
Captures all API interaction
Resource stack Monitors AWS & application
AWS Config
Secures audit data AWS CloudTrail
monitors Amazon S3
initiates alarm
AWS CloudWatch
Key Takeaways •
Customer today run mission critical enterprise application successful on AWS
•
Deploy enterprise applications securely and reliably in the cloud
•
AWS is open and ready to run mission critical applications from Microsoft, Oracle, SAP, IBM, and others
•
centrally control and govern your cloud environment without sacrificing the agility and flexibility of the cloud
