How to get the most out of your CMS deployment on AWS
•Als PPTX, PDF herunterladen•
4 gefällt mir•1,639 views
Explore the business case and technology for deploying a CMS in the cloud, using Magnolia CMS on AWS as our case study. Discover how Amazon Web Services infrastructure can save costs and improve the visitor experience. Learn how to optimize the AWS environment for your business and how to make this CMS work seamlessly with AWS through integration. We will also cover technical areas such as deployment automation, auto-healing and auto-scaling of Magnolia on AWS for high-availability, high-traffic infrastructure. While focused on Magnolia, many lessons can be applied to other enterprise-level CMS deployments.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Mehr von Magnolia
Mehr von Magnolia (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
How to get the most out of your CMS deployment on AWS
- 1. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Webinar: How to get the most out of your CMS deployment on Amazon Web ServicesMarch 2018
- 2. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Presenters Bill Beardslee Magnolia General Manager, Americas Abhay Kumar Priocept CMS Consultant Ruchika Abbi Amazon Web Services Cloud Consultant Dan Norris-Jones Priocept Technical Consultant PRESENTER PRESENTER
- 3. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia on Amazon Web Services Topics covered: Part I Business Benefits of running on AWS (Ruchika) Part II Technical guidelines for running Magnolia on AWS (Abhay)
- 4. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Priocept Priocept is the leading Magnolia consultancy in the UK Priocept’s clients include global Fortune 500 companies in the US and Europe Priocept are an AWS Consultancy Partner For more information see: http://priocept.com
- 5. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Introduction to AWS
- 7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.7 Responding to the shift in technology requires a new model FOCUS on differentiating your company. at start-up like speed. INNOVATE under your terms. MIGRATE risk. REDUCE
- 8. Reduce time-consuming, expensive tasks Rethink your approach to technology investments, reducing complexity and cost Stop guessing at capacity planning Remove complicated infrastructure management that adds little business value Optimize the life of your existing IT investments GE Oil & Gas is migrating 500 applications, and more than 750TB of data, to the cloud by the end of 2016 as part of a major digital transformation, helping it attain a 52% reduction in TCO and greater speed to market. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.8
- 9. Flexible hybrid architecture options Fully Featured Compute Resource & Deployment Management Common Controls for Security & Access Integrated Networking Data Integration & Life Cycle Management Your Datacenter Amazon Web Services © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.9
- 10. AWS Global Infrastructure 18 Regions – 53 Availability Zones – 102 Edge Locations
- 11. Freedom to build, unfettered Most robust, fully featured technology infrastructure platform © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.11 TECHNICAL & BUSINESS SUPPORT MARKETPLACE HYBRID ARCHITECTURE MOBILE SERVICES DEV/OPS IoT AI ENTERPRISE APPS MIGRATIONANALYTICS INFRASTRUCTURE CORE SERVICES SECURITY & COMPLIANCE APP SERVICES MANAGEMENT TOOLS
- 12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.12 Integrated Networking Rules Engine Device Shadows Device SDKs Device Gateway Registry Local Compute Machine Learning Conversational Interface Virtual Desktops App Streaming Schema Conversion Image Recognition Sharing & Collaboration Exabyte-Scale Data Migration Text to Speech Corporate Email Application Migration Database Migration Regions Availability Zones Points of Presence Data Warehousing Business Intelligence Elasticsearch Hadoop/Spark Data Pipelines Streaming Data Collection ETL Streaming Data Analysis Interactive SQL Queries Queuing & Notifications Workflow Email Transcoding Deep Learning Frameworks Server Migration Communications Business Apps Business Intelligence DevOps Tools Security Networking StorageDatabases API Gateway Single Integrated Console Identity Sync Mobile Analytics Mobile App Testing Targeted Push Notifications One-click App Deployment DevOps Resource Management Application Lifecycle Management Containers Triggers Resource Templates Build and Test Analyze and Debug Compute VMs, Auto- scaling, Load Balancing, Containers, Virtual Private Servers, Batch Computing, Cloud Functions, Elastic GPUs, Edge Computing Storage Object, Blocks, File, Archivals, Import/Export, Exabyte-scale data transfer CDN Databases Relational, NoSQL, Caching, Migration, PostgreSQL compatible Networking VPC, DX, DNS Identity Management Key Management & Storage Monitoring & Logs Configuration Compliance Web Application Firewall Assessment & Reporting Resource & Usage Auditing Access Control Account Grouping DDOS Protection Support Professional Services Optimization Guidance Partner Ecosystem Training & Certification Solutions Management Account Management Security & Billing Reports Personalized Dashboard TECHNICAL & BUSINESS SUPPORT MARKETPLACE Monitoring Manage Resources Data Integration Integrated Identity & Access Integrated Resource & Deployment Management Integrated Devices & Edge Systems Resource Templates Configuration Tracking Server Management Service Catalogue Search HYBRID ARCHITECTUREANALYTICS MOBILE SERVICESDEV/OPS IoT AI ENTERPRISE APPS MIGRATION APP SERVICES INFRASTRUCTURE CORE SERVICES SECURITY & COMPLIANCE MANAGEMENT TOOLS The AWS Platform
- 13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.13 Portfolio Discovery & Planning Application Design Migration & Validation Operate Migration Preparation & Business Case Continually optimize There is a migration process.
- 14. Move fast. Stay secure.OR
- 15. Move fast. Stay secure.AND
- 16. Strengthen your security posture ” In the last four years as we transitioned to the cloud, I have come to realize that as a relatively small organization, we can be far more secure in the cloud and achieve a higher level of assurance at a much lower cost, in terms of effort and dollars invested. We determined that security in AWS is superior to our on-premises data center across several dimensions, including patching, encryption, auditing and logging, entitlements, and compliance. John Brady FINRA CISO © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.16 Security infrastructure built to satisfy military, global banks, and other high-sensitivity organizations Leverage security enhancements from 1M+ customer experiences Benefit from AWS industry leading security teams 24/7, 365 days a year Over 50 global compliance certifications and accreditations
- 17. Virtual Private Cloud Isolated cloud resources Web Application Firewall Filter Malicious Web Traffic Shield DDoS protection Certificate Manager Provision, manage, and deploy SSL/TSL certificates Networking Key Management Service Manage creation and control of encryption keys CloudHSM Hardware-based key storage Server-Side Encryption Flexible data encryption options Encryption IAM Manage user access and encryption keys SAML Federation SAML 2.0 support to allow on-prem identity integration Directory Service Host and manage Microsoft Active Directory Organizations Manage settings for multiple accounts Identity & Management Service Catalog Create and use standardized products Config Track resource inventory and changes CloudTrail Track user activity and API usage CloudWatch Monitor resources and applications Inspector Analyze application security Compliance Access a deep set of cloud security tools Macie Discover, Classify & Protect data
- 18. AWS & compliance standards © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.18 Certifications & Attestations Laws, Regulations and Privacy Alignments & Frameworks Cloud Computing Compliance Controls Catalogue (C5) DE 🇩🇪 CISPE EU 🇪🇺 CIS (Center for Internet Security) 🌐 Cyber Essentials Plus UK 🇬🇧 EU Model Clauses EU 🇪🇺 CJIS (US FBI) US 🇺🇸 DoD SRG US 🇺🇸 FERPA US 🇺🇸 CSA (Cloud Security Alliance) 🌐 FedRAMP US 🇺🇸 GLBA US 🇺🇸 Esquema Nacional de Seguridad ES 🇪🇸 FIPS US 🇺🇸 HIPAA US 🇺🇸 EU-US Privacy Shield EU 🇪🇺 IRAP AU 🇦🇺 HITECH 🌐 FISC JP 🇯🇵 ISO 9001 🌐 IRS 1075 US 🇺🇸 FISMA US 🇺🇸 ISO 27001 🌐 ITAR US 🇺🇸 G-Cloud UK 🇬🇧 ISO 27017 🌐 My Number Act JP 🇯🇵 GxP (US FDA CFR 21 Part 11) US 🇺🇸 ISO 27018 🌐 Data Protection Act – 1988 UK 🇬🇧 ICREA 🌐 MLPS Level 3 CN 🇨🇳 VPAT / Section 508 US 🇺🇸 IT Grundschutz DE 🇩🇪 MTCS SG 🇸🇬 Data Protection Directive EU 🇪🇺 MITA 3.0 (US Medicaid) US 🇺🇸 PCI DSS Level 1 💳 Privacy Act [Australia] AU 🇦🇺 MPAA US 🇺🇸 SEC Rule 17-a-4(f) US 🇺🇸 Privacy Act [New Zealand] NZ 🇳🇿 NIST US 🇺🇸 SOC 1, SOC 2, SOC 3 🌐 PDPA - 2010 [Malaysia] MY 🇲🇾 Uptime Institute Tiers 🌐 PDPA - 2012 [Singapore] SG 🇸🇬 Cloud Security Principles UK 🇬🇧 PIPEDA [Canada] CA 🇨🇦 🌐 = industry or global standard Agencia Española de Protección de Datos ES 🇪🇸
- 19. Shared responsibility model © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.19 Compute Responsible for security OF the cloud Customer Responsible for security IN the cloud • Customer Data • Platform, Applications, Identity & Access Management • Operating System, Network & Firewall Configuration • Client-side Data Encryption & Data Integrity Authentication • Server-side Encryption (File System and/or Data) • Network Traffic Protection (Encryption, Integrity, and/or Identity) • Compute • Storage • Database • Networking • AWS Global Infrastructure • Regions • Availability Zones • Edge Locations
- 20. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia on AWS
- 21. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia on AWS Magnolia is a cloud-friendly platform that works well with AWS The diagram on the right shows a typical Magnolia implementation on AWS, deployed in a single region Diagram shows a single region deployment, with a VPC containing private and public subnets
- 22. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Auto-Scaling Groups To configure auto-scaling EC2 instances in AWS create an Auto-Scaling Group Auto-Scaling Groups fulfil three requirements: Auto-scaling Auto-healing (with or without auto-scaling) Zero downtime (“rolling”) updates
- 23. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Fixed Infrastructure Fixed infrastructure means: Paying for spare, mostly unused capacity No flexibility to scale up or down Scaling physical servers is a cumbersome IT process
- 24. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Auto-Scaling Infrastructure Auto-scaling is dynamically scaling infrastructure to cope with demand There is slight over capacity, but this is minimized
- 25. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Common CMS Architecture Central database Items “published” by updating a row in the database Content editing can slow down the functioning of the public website Single point of failure
- 26. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia Architecture Separate databases Transactional Publication Content pushed to separate databases on the public instances No database contention between Author and Public Becomes a problem on cloud-based, auto-scaling infrastructure
- 27. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia Activation and Auto-Scaling In this example, an auto-scaling event created Public Web Server 3 Public Web Server 3’s content is not yet synchronized Content must be published before traffic is sent to Public Web Server 3
- 28. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia on AWS To configure a fully automated scaling process for Magnolia the following AWS services are required: EC2 RDS Lambda S3 Elastic Compute Service Relation al Databas e Service Serverless Computing Platform Simple Storage Service
- 29. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Subscriber Synchronisation This solution ensures Public servers are brought into the load only when they have the latest content This achieved by orchestrating events between Magnolia and AWS.
- 30. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Web Server Creation EC2 instances are launched by the Auto-Scaling Group based on a specified AMI Ansible is used to install and configure servers Magnolia application is deployed as a WAR file (stored in an S3 bucket) Auto Scaling Group rolling updates are used to perform sequential deployments
- 31. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia Publication Key Exchange A public key is required to authorise publication from the author to public instances The key is saved in S3 on creation of the Author server and retrieved by the Public servers as part of their initialisation process.
- 32. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Other Considerations
- 33. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Containerization Docker ECS
- 34. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia on AWS Beanstalk AWS Elastic Beanstalk automates infrastructure creation It is useful for smaller Magnolia implementations or for demonstration purposes, but is not recommended for large- scale Magnolia deployments
- 35. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Magnolia - Services Incubator For enterprise clients, the “Services Incubator” includes modules to solve some of the challenges of running Magnolia on AWS: Publication freeze Subscription management tools Extended synchronisation tools Improved health check Auto-license module
- 36. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Summary Magnolia is an inherently cloud-friendly platform that works well on Amazon Web Services Special configuration is required to achieve a fully elastic solution For more information please get in touch
- 37. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Contact Ruchika Abbi Solutions Architect Amazon Web Services (AWS) ruchikaa@amazon.com +1 (703)-470-6213 Abhay Kumar CMS Consultant Priocept abhay.kumar@priocept.com +44 (0)20 7422 0060
- 38. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Q&A
- 39. i n f o @ p r i o c e p t . c o m | p r i o c e p t . c o m | + 4 4 ( 0 ) 2 0 7 4 2 2 0 0 6 0 C o p y r i g h t © P r i o c e p t L t d . 2 0 1 7 Thanks for listening
Hinweis der Redaktion
- [PROVIDE YOUR OWN INTRODUCTION]
- Responding to this changes requires a new model of engagement. Many companies are looking at the cloud as a way to double down on investments that support the core mission of the company and differentiate it from competitors. As a result, they are looking at new ways to innovate that allow for more experimentation and more customer engagement. And they are doing it in a way that meaningfully reduces their security and compliance risks.
- Unless you’re in the hosting business, it’s unlikely that maintaining physical infrastructure was a core reason for incorporation. It’s what you do with the infrastructure that sets the company apart. The cloud allows you to get rid of the undifferentiated heavy lifting that comes along with data center management. First, it breaks the cycle of large, risky capital purchases that often tend to make people risk adverse, and trades it for greater flexibility via operating expense. It also eliminates the risk and cost of capacity planning by allowing for the business to acquire exactly the capacity needed at any given time and pay only for time it was in use. Third, it simplifies the complex management tasks inherent in keeping a data center filled with heterogeneous technology running smoothly. And last, global operations are a relatively simple matter of replication. The headaches involved in establishing and running data centers in local markets are eliminated. ------ GE OIL & GAS: GE Oil & Gas is migrating 500 applications to the cloud by the end of 2016 as part of a major digital transformation, helping it attain a 52 percent reduction in TCO. GE Oil & Gas is a business unit of global conglomerate General Electric, with energy-related operations around the world. The company's cloud migration project entailed reexamining—and in many cases, eliminating—legacy processes, resulting not only in lower IT costs but also in greater speed to market and more agility to compete even better in an industry experiencing immense market challenges. GE Oil & Gas is using the AWS Import/Export Snowball appliance to transfer more than 750 terabytes of data from pipeline inspection machinery to AWS, as well as AWS services such as Amazon Aurora, Amazon CloudWatch, AWS Elastic Beanstalk, and AWS Trusted Advisor. [https://aws.amazon.com/solutions/case-studies/ge-oil-gas/]
- No other cloud platform has anywhere near the level of technical capabilities or experience that AWS has in helping enterprises setup a hybrid architecture. Dow Jones example - chat application, engineers looked over, VPC subnets, new IP addresses, automation to move and done in 45 minutes. Big ah ha moment that gave us the confidence to scale our environment…. A lot of executives ask me how long they’ll be running a hybrid environment. I believe that any organization that has been running it’s own IT environment for any substantial period of time will have a hybrid architecture as part of their journey, and we’d probably count the time in years, but it’s hard for me to imagine a future 10 years from now where an organization of any size will be running their own data centers. I think that AWS’ pace of innovation and how much easier we’re making it to migrate, which I’ll touch on shortly, is only accelerating this transformation.
- AWS serves hundreds of thousands of customers in more than 190 countries. Amazon CloudFront and Amazon Route 53 services are offered at AWS Edge Locations he AWS Cloud operates 52 Availability Zones within 18 geographic Regions around the world, with announced plans for 12 more Availability Zones and four more Regions in Bahrain, Hong Kong SAR, Sweden, and a second AWS GovCloud Region in the US coming online between now and early 2019. The global network of AWS Edge locations now consists of 113 Points of Presence (102 edge locations and 11 regional edge caches), in 56 cities across 24 countries including locations in the United States, Canada, Europe, Asia, Australia and South America.
- While every organization will have their own unique constraints and opportunities guide their journey, the pattern we’ve seen in mass migrations tend to: CLICK.. start with our account teams and partners work with customers to get them some foundational experience and develop a business case for a migration. CLICK.. Next we work with customers to deploy discovery tools that help them understand their IT portfolio, the dependencies between applications, and begin to consider what types of migration strategies they’ll employ to meet their business case objectives CLICK.. In the third and fourth phases, which I sometimes call the “migration factory” the focus moves from the portfolio level to the individual application level, and we work with customers to design, migrate, and validate each application CLICK.. And finally each application lands in a modern operating model CLICK… and as each customer gains experience migrating, they are often expand the scope of their migration with additional waves, and we iterate on the process in a closed feedback loop. With each iteration or wave the business case, discovery and planning capabilities, and migration capabilities constantly improve. This flywheel effect can help put companies in a position to stay much closer to a modern state enterprise architecture over time. I’ll spend the next several minutes diving into each phase of this process to give you a better idea for what we’re seeing in each phase.
- For a long time, most organizations have had to make a choice between moving fast or maintaining a high degree of security. It’s a difficult choice, and inevitably security trumps all.
- But, one of the fundamental benefits of the cloud is that you’re able to do both, because the security of the infrastructure is handled by the AWS global security team. This frees your resources up to focus completely on the security of your applications.
- Infrastructure security can be one of the most complex elements of your operation, because the high degree of interconnected systems across a wide range of hardware vendors makes it difficult to have good visibility into what’s going on and what new threats may have been recently identified in the wild. But, with AWS, we operate together under a Shared Responsibility Model that makes us responsible from the hypervisor down, and you for the operating system up, which puts our respective attention on what we know best. The AWS infrastructure is custom-built for the cloud, with all element designed to intercommunicate well and present the smallest attack surface possible. In addition, the physical security controls present in our data centers has been designed to be the most stringent in the world. This pursuit has led to AWS being trusted by governments, military organizations, global banks, healthcare institutions, and other high-sensitivity organizations. Finally, our security team is monitoring the infrastructure all-day, every-day, and is well-connected with all major security watchdog groups and vendors to ensure that potential threats are identified immediately. And, they are doing this at massive scale, which is something that sets the AWS security organization apart. By looking across more than 1 million active accounts each month running virtually every conceivable type of workload, we can see issues that may only occur once in a billion operations multiple times a day. When we remediate the issue, we do so for the entire platform. That kind of visibility and response simply isn’t achievable for the vast majority of organizations. ----- CAPITAL ONE: Capital One is using AWS to reduce its data centers from eight to three by 2018. Capital One is one of the nation’s largest banks and offers credit cards, checking and savings accounts, auto loans, rewards, and online banking services for consumers and businesses. The bank is using or experimenting with nearly every AWS service to develop, test, build, and run its most critical workloads, including its new flagship mobile-banking application. Rob Alexander, Capital One's chief information officer, says, "The financial service industry attracts some of the worst cyber criminals. We work closely with AWS to develop a security model, which we believe enables us to operate more securely in the public cloud than we can in our own data centers." Capital One selected AWS for its security model and for the ability to provision infrastructure on the fly, the elasticity to handle purchasing demands at peak times, its high availability, and its pace of innovation. [http://aws.amazon.com/solutions/case-studies/capital-one/]
- These security tools are incredibly powerful. Of note, we have, Virtual Private Cloud, the ability to logically isolate your resources in a virtual network that you define. The Key Management Service, the ability to encrypt your data in the Cloud and if you choose, to bring your own encryption key. Cloudtrail, is a service that records API calls for your account and delivers log files for you, enabling detailed compliance auditing. And new services like Macie - A machine learning-powered security service to discover, classify, and protect sensitive data. Networking [COVER THIS ONE] Amazon VPC: Amazon Virtual Private Cloud lets you provision a logically isolated section of the AWS Cloud where you can launch resources in a virtual network that you define. [COVER THIS ONE] AWS KMS: AWS Key Management Service is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys. AWS KMS is integrated with several other AWS services to help you protect the data you store with these services and is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs. [COVER THIS ONE] AWS CloudTrail: AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. With CloudTrail, you can get a history of AWS API calls for your account, including API calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services (such as AWS CloudFormation). The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.
- "Display Cabinet" You've just had a bunch of info on this from previous presenters What I'm here to cover is not only how we get to these - you'll have heard about that already - but how you get to map technologies from these standards - and others - so you can work toward security and compliance of your environments on top of what we do
- AWS operates a shared responsibility model. When I was at Capital One we partnered closely with AWS on our security model, working backwards from our security objectives and letting AWS look after Security of the Cloud. Allowing us to really focus on Security ’in’ the cloud and the using the comprehensive tools that AWS provide for you to do this in a straight forward way.
- New ASG feature – https://aws.amazon.com/blogs/aws/aws-auto-scaling-unified-scaling-for-your-cloud-applications/ Thanks – one more thing Abhay. Can you also add types of auto-scaling and/or talk about that at a high level. Basically Manual Scaling, Dynamic Scaling and Scheduled Scaling. With Magnolia, since Dynamic Scaling presents a challenge, having more controlled manual scaling by modifying the desired capacity programmatically/via console or scheduled scaling actions for predictable traffic patterns would be relevant patterns?
- A publication freeze is necessary during this process or published content may get out of sync Be careful if bringing up multiple public instances simultaneously as this can overload the author server
- Quick and dirty solution for people with low AWS skills Consider removing