Microsoft applications make up 60% of on-premises IT environments. Join us as we discuss the journey of migrating the Unicorn Shop's on-premises Microsoft infrastructure to AWS. We discuss how we migrated core business productivity systems, Microsoft SQL Server, and a number of .NET applications that required seamless migration with minimal downtime. We also walk through the process for building your landing zone on AWS, including fully automated compliance controls, before embarking on your migration.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Migrate Microsoft Applications to AWS
Like an Expert
Giriraj Daga
Solutions Architect
Amazon Web Services
W I N 3 0 1
Rahul Kulkarni
Partner Solutions Architect
Amazon Web Services

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer running Windows on AWS

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Typical questions ...
Why AWS for
Microsoft
applications?
What are the
migration
accelerators?
How can I move
fast and stay
secure?

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key takeaways from this session
Patterns, Practices & Tools
for migrating Microsoft Applications
to Amazon Web Services (AWS)
Continuous compliance
with automated controls and
process to build your Landing
zone
Building repeatable architecture
with automation and infrastructure as
a code approach
AWS Microsoft

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Most Experience
10
Years running Windows
workloads
Global Reach & High Availability
57
Availability Zones spanning 19
geographic regions
Security & Compliance
HIPAA, FISMA, ITAR, EU Model Clauses
50+
Compliance Certifications
SOC-1,2,3 FIPS, ISO
Why customers choose AWS for their Microsoft applications

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Innovation for Windows on AWS
KeyWindowslaunchessince2008
90+
40+
700+
instance types, 22 instance families
different AMIs for Windows workloads
Windows ISV listings
in AWS marketplace
Windows Deep Learning AMI
Hyper-V support in AWS SMS
Application-consistent Snapshots through VSS
WS 2008 & SQL Server 2008
Visual Studio Toolkit
Microsoft SCOM plug-in release
AWS Directory Service
EC2 Dedicated Hosts (BYOL)
Microsoft SharePoint 2016 (Marketplace)
Windows Server 2008 R2
SQL Server 2008 R2
Windows Server 2003
SQL Server 2005
.NET SDK
Microsoft SCVMM Plug-in
Windows Server 2012
SQL Server 2012
AWS Tools for Windows PowerShell
Amazon RDS adds SQL Server
EC2 Run Command
EC2 Systems Manager
Windows Server & SQL Server 2016
Dedicated EC2 Instances (BYOL)
.NET on AWS Lambda & AWS
CodeBuild
SAP instance on AWS 2012
Trusted Advisor
checks for Windows
SQL Server 2017 on EC2/RDS
AWS X-Ray .NET SDK
CustomerAdoption
Windows for Amazon Lightsail
.NET Core & PowerShell on
AL2/Ubuntu
2008 Today
.NET Core 2.0 Support
with Lambda & X-Ray
Windows Containers
.NET Core 2.1 Support

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer success running Windows on AWS
”We’ve seen much stronger
performance for our database-backup
workloads and we’re also saving 75%
on our monthly backup costs.”
Richard Sharp,
Director of Databases
“We haven’t met a workload we
can’t run in AWS, and run better
including Windows Server. With
zero downtime”
Bill Rothe,
VP Enterprise Systems
“We chose AWS for our data center
workloads, including Windows, based on
our assessment of the security, availability
and performance of the platform.”
Rajeev Bhajwardi,
Sr. Director Enterprise Technology

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why AWS for
Microsoft
applications?
What are the
Migration
accelerators?
How can I move
fast and stay
secure?

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. Who is Unicorn Shop?
“To enable anyone with the dream of being
a unicorn to look like one”
I’m a Microsoft Shop!
Business productivity applications
.NET and SQL custom applications
Email hosted in O365
Online
ecommerce
offering
Brick and
mortar stores

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Migration methodology
Build & Migrate Run
Existing IT estate
evaluation
Discovery & Planning
(6 R)
Landing Zone
Creation & Migration
Steady state
Operations

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Unicorn Shop’s IT landscape (a Microsoft shop!)
Web 01 Web 02 Web 03
App 01 App 02 App03
SQL 01 SQL 02
Batch
Jobs
Web 01 Web 02 Web 03
App 01 App 02
SQL 01 SQL 02
Internal
Systems
App Servers
Partner
Systems
E-commerce website COTS Products(ERP, CMS) Custom .NET Applications
AD 01 AD 02 SER 01 SER 02
Active Directory
SER 03
Monitoring & Management
Profile # 1
Regulatory Applications
(PCI) with Batch Jobs
Profile # 2 COTS
Applications
Profile # 3 Custom
Applications

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Unicorn Shop’s application migration strategy
Retire
Retain
Repurchase
Replatform
Refactor
Rehost

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Migration journey with patterns
Covered in the
next
section
AWS Landing Zone
Applications
Covered in the
next
section

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC Design Patterns
Network architecture
Connectivity Options
AWS Direct Connect
Site to Site VPN
DC
AWS
Shared services VPC Transit VPC

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Active Directory migration options
Options
VPC
EC2 for Windows
Server DC
AD
VPC Endpoint
AWS Microsoft
AD
Migration Pattern
On-premises
Microsoft Active
Directory
On-premises user
credentials
Corporate
data center
SaaS Applications
Azure AD
Azure AD Connect
Server
ADFS
Synchronize users
to Office 365
SAML
Authentication
AWS Direct
Connect
Azure AD Connect
Server
ADFS
or
PES
For securely migrating
passwords
ADMT to replicate
users, groups and
objects
AWS SSO

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data migration patterns – SQL Server
AWS Database Migration
Service (AWS DMS)
(Minimal Downtime)
Backup/Restore
Import/Export
Backup/Restore
Import/Export
Initial data load
Amazon S3 Sync and Transfer
Acceleration
AWS DMS
AWS Snow family
On-going Replication
MS SQL
Server
Target Options AWS Migration Tools OptimizationMigration Options
MS SQL instance
MS SQL
Server
Optimized vCPUs
R4.4XL 16 8 50%
MS SQL
instance
Storage Optimization

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data Migration – SQL Server
Target Options Optimization
Regulatory
Application
(PCI)
MS SQL Server on
EC2
Migration Pattern
Initial Data load
SQL Server with
Initial Seed
AWS Snowball S3
Incremental changes
MS SQL Server
on EC2
MS SQL Server
Distributed Always On Availability
Group replication over Direct Connect
Custom .NET
Application
MS SQL Server AWS DMS
Incremental changes
RDS
RDS

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Building repeatable architecture
Automate – Automate – Automate!

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudFormation ‒ Components and Technology
Template AWS CloudFormation Stack
JSON/YAML formatted file
Parameter definition
Resource creation
Configuration actions
Configured AWS resources
Comprehensive service support
Service event aware
Customizable
Framework
Stack creation
Stack updates
Error detection and rollback

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems Manager capabilities
Run Command Maintenance Window Inventory
State Manager Parameter Store Patch Manager
Automation
Deploy, configure,
and administer
Track and
update
Shared
capabilities
Distributor

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation
▪ Patch, update agents, or bake applications into your AMIs
▪ Build workflows to accomplish complex tasks
▪ Use predefined workflows or build your own
▪ Invoke AWS Lambda functions
Simplifies common maintenance and deployment tasks, such as updating
Amazon Machine Images (AMIs)

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation is key, how do I automate updates?
Start temporary instance
AWS latest
Windows AMI
Update EC2 Config or
EC2 Launch
Update PV drivers and run
Windows updates
Invoke user provided
scripts
Run a sysprep /
Generalise
Stop temporary
instance
Custom AMI ready for
deployment

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation: Use cases
Maintain and update your AMIs
▪ Integrates with Amazon CloudWatch
for proactive notifications
▪ Use in conjunction with
Maintenance Windows
Include applications in your AMIs
▪ Bake applications into an image
▪ Incorporate Automation as part of
your change management process

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Server Migration Service (AWS SMS) overview
• Agentless VM migration service which makes it easier and faster for
you to migrate on-premises workloads to AWS from VMware
vSphere and Microsoft Hyper-V environments.
• Capture incremental change made to on-premises VMs and
automatically transfer to AWS
• Supports Resuming Failed Replication Jobs, with Hourly Replication
Intervals
• Migrate a group of VMs simultaneously and orchestrate multiple
migrations
• AWS Management Console and API/CLI access
• Each replicated server volume is saved as a new Amazon Machine
Image (AMI), which can be launched as an EC2 instance.
Source:
on-premises server
AWS Server Migration
Service (AWS SMS)
Target: Amazon
Machine Image

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Unicorn Shop data
center
AWS Server Migration Service (AWS SMS)
AMI
AWS SMS
AWS Cloud
Server Migration
Connector VM
Server
Migration
Connector
Image
Hypervisor
(for example, VMWare/Hyper-V)
Running
VM
Running
VM
Launch AMI on EC2
(Configure Network, Load
Balancing and Auto Scaling)
Launch AMI on EC2
(Automate deployment)
AWS
CloudFormation
Replication
SSM

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Closer look at AWS Server Migration Service
Start a replication jobs. Once the replication is
done, spin up an EC2 instance out of it.
Your on premises servers appear on AWS SMS console

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application migration – COTS
AWS Tools/ Accelerators OptimizationMigration Options
Tool-based migration
Deploy AWS
SMS Agent
Start Replication
TAG AMIs
Create AWS
CloudFormation
Template
Tool-based migration + automation
Select Base AMI
(Yours/
Marketplace)
Use SSM Golden AMI Create
CloudFormation
Template
Deploy on
EC2
Deploy on
EC2
AWS Server Migration
Service
AWS Systems Manager
AWS CloudFormation
AWS Migration Hub
Auto / Predictive Scaling
Fully managed Amazon
FSx for Windows File
Server
Dedicated hosts
Amazon S3

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Windows? Containers? Actually, yes …
• State in containers, you can but what is the goal?
• For Unicorn Shop, short-lived stateless apps
• How to migrate apps to containers? Containers are portable …
• Do you have a CI/CD process already?

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application migration – Custom .NET
App
Server
Target Options
Amazon EC2
Amazon ECS
AWS Lambda
abstraction
AWS Server Migration
Service
AWS Migration Tools
AWS Migration Hub
CodeStar
AWS Code
Deploy
AWS Code
Commit
AWS Code
Build
Amazon Elastic Container
Service
VM import/
export
AWS Code
Pipeline
Elastic Beanstalk
EC2
CD/CI
Infrastructure provisioned and
managed by EB
Elastic Beanstalk
CodeDeploy
Automates code
deployments
Push app
docker
image to
ECR
Update Service
Deploy
using
SAM
Create / extend
deployment pipeline
ECS
Example purchase options
Optimization
Amazon ECS
Fargate
Lightsail Auto scaling
Group
Example Spot
pricing options
Instance
diversity
Amazon EC2 Auto
Scaling
AMI created
Migration Options
AWS SMS
AMI
Start Replication
EC2
Replicate virtual
servers

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application migration – Custom .NET
App
Server
Target Options OptimizationMigration Options considered
Amazon EC2
Amazon ECS
AWS Lambda
• T2 instance types (Spot and On-
Demand instance)
• RI for steady state minimum
capacity
abstraction
Azure
DevOps
Azure
DevOps
• Extended existing Azure DevOps
pipeline by using AWS Tools for
VSTS
• EC2 Auto Scaling Groups With
Multiple Instance Types &
Purchase Options to create the
ECS cluster to optimize cost
• Refactor batch jobs to process
files to run only when required
Amazon Elastic Container
Service
Amazon Elastic Container
Registry
AWS Elastic Beanstalk
AMIAWS SMS AWS CloudFormation
Template
EC2
LambdaAWS SAM

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring using existing tools
Management Portal
for vCenter
Management Pack for
SCOM
Systems Manager for
SCVMM

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring
Amazon CloudWatchAWS
CloudTrail
AWS
Config
AWS Trusted Advisor
Amazon VPC
AWS
Lambda
Amazon ES
EC2
Amazon Kinesis
VPC Flow Logs
Amazon
QuickSight
Windows Performance
Monitor Counters
Windows Event Logs &
Custom Logs

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application migration – Unicorn Shop
Start
Replication
Deploy AWS
SMS Connector
Tag
AMIs
Deploy using AWS
CloudFormation
(CF)
Swap Blue-
Green
Use ECR for
storing images
Create / Extend
code build to AWS
Deploy
using CF
RefactorSelect AWS
Serverless
services
Deploy using
SAM
ReplatformRehost Refactor
Fastest
Cloud economies
Adopt cloud-native
services

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Migration Hub
Better understand your application portfolio
Streamline application portfolio migration planning and tracking
Track migration progress from multiple tools in one place
Reduce time spent determining current status and next steps
Discover Migrate Track

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
CloudWatch
AWS Config
Data
transfer
Server and database
migrations
Application
monitoring/profiling
Discovery
and planning
AWS Application
Discovery Service
AWS Database
Migration Service
(AWS DMS)
AWS Server
Migration Service
(AWS SMS)
AWS Storage
Gateway
Amazon S3 Transfer
Acceleration
AWS Direct
Connect
Amazon Kinesis
Data Firehose
AWS Snowball and
AWS Snowmobile
Tools to help you migrate

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why AWS for
Microsoft
applications?
What are the
Migration
accelerators?
How can I move
fast and stay
secure?

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Growing AWS adoption

40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Centralized governance
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:*",
"cloudwatch:*"
],
"Resource": "*"
}
]
}
A1 A2 A4
M
A3
Dev Prod Prod
PCI
AWS
Organizations &
SCPs for
Centralized
Account
Management

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Unicorn Shop’s
Admins
Admin role
Admin role
Dev Account
Prod Account
Identity Account
Cross account roles
Protective controls - AWS Identity and Access
Management (IAM)

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Identity Account
StackSet
Protective controls – IAM at scale

43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Challenges for recent security
• Checking security only once before launch is not enough
• Continuous security check is necessary even after launch
Threats
More sophisticated and
persistent attacks
Vulnerabilities
Security vulnerabilities
are found 24x7
Changing
infrastructure
Infrastructure is changing
on a daily basis to meet
business demands

44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detective controls - Amazon GuardDuty
aws events put-rule --name Test --event-pattern "{"source":["aws.guardduty"]}“
aws events put-rule --name Test --event-pattern
"{"source":["aws.guardduty"],"detail-type":["GuardDuty
Finding"],"detail":{"severity":[5.0,8.0]}}“
aws events put-targets --rule Test --targets Id=1,Arn=arn:aws:lambda:us-east-
1:111122223333:function:<your_function>
Amazon GuardDuty

45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• PCI
• OWASP Top 10
• Bot protection
• SQLi/XSS
• IP reputation
• CMS protection
AWS WAF - Working with managed rulesets
AWS WAF

46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Landing Zone for Windows on AWS
• Network Design
• VPCs, Connectivity, Subnets
• NACLs, Security Groups, etc.
• IAM (AWS AuthN & AuthZ)
• Active Directory
• Key Management, SSL Certificates
• Multiple Account Strategy
• Start simple
• AWS Organizations
• Security is the #1 priority
• Edge Security, Encryption, etc.
• Logging, Auditing, Config Mgmt, etc.

47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure and extensible Landing zone allows for
driving innovation without giving up
governance
meets the organization’s
security and auditing
requirements
ready to support highly
available and scalable
workloads
configurable to
support evolving business
requirements

48. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why AWS for
Microsoft
workload?
What are the
Migration
accelerators?
How can I move
fast and stay
secure?

49. Architecture blueprint
Security, Certificate,
and Key Management
Configuration and Systems
Management
Storage
and Archiving
Monitoring,
Auditing, and
Logging
DevOps
Availability Zone 2 (AZ2)
Availability Zone 1 (AZ1)
Security Group
Web Server
Auto Scaling
Auto Scaling
Private Subnet
Security Group
App Server
Auto Scaling
Auto Scaling
Security Group Security Group
Domain
Controller
AWS Managed
Active Directory
SQL
Server
or
RDS SQL Server
(Secondary)
or
Replica
Replica
Replica
Public Subnet
NAT
GW
Security Group
WAP/Proxy
/RDGW
Security Group
Web Server
Auto Scaling
Auto Scaling
Private Subnet
Security Group
App Server
Auto Scaling
Auto Scaling
Security Group
SQL
Server
Security Group
Domain
Controller
AWS Managed
Active Directory
or
RDS SQL Server
(Secondary)
or
Replica
Replica
Replica
Public Subnet
NAT
GW
Security Group
WAP/Proxy
/RDGW
Internet
Gateway
AlwaysOn
AG (Synchronous)
Domain
Controller
Domain
Controller
Denver
Domain
Controller
Domain
Controller
New York
VPN/
Direct C0nnect
IAM Systems Manager S3 AWS CloudTrail AWS
CodeDeploy
AWS
CodePipeline
AWS
CodeBuild
AWS
CodeCommit
Amazon
CloudWatch
Amazon
Glacier
VPN
Endpoint
InspectorAWS
Config
Cloud
HSM
Certificate
Manager
CloudFront
(Content Dist.
Network)
AWS Shield
(DDOS)
WAF (Web
Application
Firewall
Route53 (DNS)
Internet

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What we started with ...
Patterns, practices, & tools Continuous complianceBuilding repeatable architecture

51. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Putting it all together ...
Continuous
compliance
Building repeatable
architecture
Patterns, practices,
& tools

52. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ask a friend - Large ecosystem of experienced partners
AWS PartnersAWS and Partner
Tools
AWS Investment AWS Training
Migration Methodology
AWS Professional
Services
https://aws.amazon.com/migration-acceleration-program/

53. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key takeaways AWS Microsoft

54. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Resources
Amazon Web Services and Microsoft FAQ
https://aws.amazon.com/windows/faq/
Microsoft Servers on the AWS Cloud—Quick Start
https://docs.aws.amazon.com/quickstart/latest/accelerator-msservers/welcome.html
Explore .Net on AWS
https://aws.amazon.com/developer/language/net/
AWS Migration resources
https://aws.amazon.com/cloud-migration/
AWS Landing Zone solution
https://aws.amazon.com/answers/aws-landing-zone/

55. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Giriraj Daga
dagag@amazon.com
Rahul Kulkarni
rahkulk@amazon.com

56. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.