AWS Innovate 2016

1. Best of Both Worlds:
Leveraging Hybrid IT with AWS
• Dhruv Singhal, Head of Solutions Architect, AISPL

2. Our Journey Today
Amazon
VPC
VPN
Backup,
archive & DR
Storage
expansion
Common workloads in
hybrid infrastructure
What is hybrid
infrastructure?
Connectivity
Integrated
AWS Direct
Connect
Authentication
Enterprise
integration
Federation
Operations
monitoring
Start
Dev & Test

3. What do we mean by a “hybrid infrastructure”?
On-premises
resources
Data center
Cloud services
Cloud infrastructure
Workload migration
and integration
Enterprise
management tools
Access/authentication
control integration
Connectivity

4. Connectivity

5. Connectivity: VPC
Extend your data center with Amazon VPC
• Provision logically isolated section of AWS Cloud using
your own network address space
• Complete control over your virtual networking environment
including creation of subnets, IP addressing, routing tables
and network gateways
• Create private or public subnets in multiple Availability Zones
• You choose where to deploy EC2 instances
• You manage network security at subnet level using NACLs
• You manage EC2 Instance Security Groups,
providing stateful network firewall per instance
10.0.0.0/16
10.0.1.0/16

6. AWS region
Web
layer
Internet
Your data center
Application
layer
Database
layer
Auto Scaling
Connectivity: Internet

7. Connectivity: VPN
Virtual
Gateway
Corporate
data center
Users
Data center router
Servers
Internet
IPSec VPN
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group

8. Connectivity: Direct Connect
Virtual
Gateway
Corporate
data center
Users
Data center router
Servers
VPC Subnet
Availability Zone
Security Group
VPC Subnet
Availability Zone
Security Group
Customer
router
AWS Direct Connect
Location
AWS Direct Connect
routers

9. AWS region
Public-facing
web app
Public app
w/back-end
integration
Your Data
Center
Private app
w/back-end
integration
Core/shared
services
AWS Direct Connect
Location
Connect to Multiple VPCs

10. Enterprise Integration

11. o 3 Directory Types to choose from
• AD connector
• Simple AD - built on Samba 4
Active Directory compatible
server
• Directory Service for ADAWS Directory Service
Connect
Corporate
data center
Users
AD.Domain
Servers
AWS Directory Service
Domain
controller
VPC subnet
Availability Zone
Security
group
Virtual
Gateway
VPC subnet
Availability Zone
Security
group

12. AWS
region
• Domain controllers launched
in internal VPC
• Internal VPC instances join
domain upon launch
• Domain controller replicates
with corporate AD servers
• VPC DNS forwarding to
corporate DNS
Public Facing
Web App
Internal
Corporate
App
VPN
Connection
corp.example.com
AD Controller
Domain
Controller
+ DNS
example.com
DNS
AD
Replication
Domain Join +
DNS Queries
DNS
Forward
Requests
New Instance:
friendly-vpc-
123.corp.example.com
Corporate Data center
Bring your own Active Directory

13. Identity federation
Customer (Identity Provider) AWS Cloud (Relying Party)
AWS Resources
User
Application
Active
Directory
Federation Proxy
4
Get Federation
Token Request
3
2
Amazon S3
Bucket
with Objects
Amazon
DynamoDB
Amazon
EC2
Request
Session 1
Receive
Session6
5
Get Federation Token
Response
• Access Key
• Secret Key
• Session Token
APP
Federation
Proxy
• Uses a set of IAM user credentials to
make a GetFederationTokenRequest()
• IAM user permissions need to be the
union of all federated user permissions
• Proxy needs to securely store these
privileged credentials
Call AWS APIs7

14. • Security monitoring integration
points with CloudTrail and SIEM
Aggregator
• Platform and app health to SIEM
Aggregator via agent on EC2
guest
• Cloudwatch Logs provide scalable
low cost log aggregation
• Access to patching and updates
for AMI by on-premises update
server
VPC subnet
Availability Zone
Security group
VPC subnet
Availability Zone
Security group
Virtual
Gateway
Corporate
data center
Users
Data center router
Update
Servers
Connectivity
CloudTrail
CloudWatch
Logs
SIEM
Aggregator
Operations and security integration
VPC Flow
Logs
AWS
Config

15. Operations on AWS
Integrating AWS into your operations
• AWS CloudWatch provides insight into your AWS
services, integrate your own metrics, create and act on
alarms
• Amazon SNS allows integration with your alerting
systems
• Your current tools still work – install on EC2 instance
• Your tools already have AWS API integration
• Established processes don’t get thrown away

16. Common Workloads
in Hybrid Infrastructure

17. Common Workloads in Hybrid Infrastructure

18. In Summary
• Connectivity is a key to a successful hybrid integration between cloud and
corporate data center.
• Authentication and Authorization are the corner stones of Enterprise
Integration.
• Test it – create a VPC, establish VPN, leverage free tier.
• Hybrid infrastructure enables a variety of hybrid workload implementations.

19. Online Labs & Training
Gain confidence and hands-on
experience with AWS.
Watch free Instructional Videos and
explore Self-Paced Labs
Instructor Led Classes
Learn how to design, deploy and
operate highly available, cost-effective
and secure applications on AWS in
courses led by qualified AWS instructors
Validate your technical expertise
with AWS and use practice exams
to help you prepare for AWS
Certification
AWS Certification
More info at http://aws.amazon.com/training

20. Thank You for Attending AWS Innovate
We hope you found it interesting!
Do provide us with your feedback for the session and complete the feedback form.
Let us know your thoughts of today’s event and how we can improve the event
experience for you in the future.