AWS reinvent 2019 recap - Riyadh - Network and Security - Anver Vanker
1 like661 views
The document outlines an agenda for a two-day AWS conference taking place on March 9-10, 2020 in Riyadh. Day one will feature presentations on networking and security by Anver Vanker and storage, compute and serverless updates by Paul Maddox. Day two presentations will cover big data and analytics by Asif Abbasi and AI and ML by Ahmed Raafat.
![AWS Technical Day Riyadh Nov 2019 [Migration]](https://cdn.slidesharecdn.com/ss_thumbnails/aws-tech-day-riydh-migration-191102193614-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
Similar to AWS reinvent 2019 recap - Riyadh - Network and Security - Anver Vanker (7)
More from AWS Riyadh User Group (17)
Ad
Recently uploaded (20)
Ad
AWS reinvent 2019 recap - Riyadh - Network and Security - Anver Vanker
- 1. Ri y a d h Anver Vanker Paul Maddox Ahmed Raafat Asif Abbasi
- 2. Agenda Monday, 9 March • Networking and Security – Anver Vanker (SA Manager) • Storage/Compute/Container/Serverless updates – Paul Maddox (Principal Architect) ------------------------------------------------------------ Tuesday, 10 March • Big Data and Analytics – Asif Abbasi (Specialist SA) • AI & ML – Ahmed Raafat (Senior SA)
- 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 4. US-EAST-1 Availability Zone US-EAST-1A Availability Zone US-EAST-1B Instance Instance Instance Instance
- 5. VPC US-EAST-1 Availability Zone US-EAST-1A Availability Zone US-EAST-1B Instance Instance Instance Instance
- 6. VPC US-EAST-1 Availability Zone US-EAST-1A Availability Zone US-EAST-1B Instance Instance Instance Instance
- 7. Public subnet Public subnet Private subnet Private subnet VPC Availability Zone US-EAST-1A Availability Zone US-EAST-1B EC2 instances Instance Instance Instance Instance
- 8. VPC Availability Zone US-EAST-1A Availability Zone US-EAST-1B Instance Instance Instance Instance Public subnet Public subnet Private subnet Private subnet Gateways, endpoints & peering
- 9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 10. Connecting between VPCs VPC VPC VPC AWS Cloud
- 11. VPC peering – same region VPC VPC VPC AWS Cloud
- 12. VPC peering – same region VPC VPC VPC Peering AWS Cloud
- 13. VPC peering – same region VPC VPC Peering AWS Cloud
- 14. VPC peering – same region Peering VPC VPC VPC Peering Peering AWS Cloud
- 15. VPC peering – same region Peering VPC VPC VPC Peering Peering AWS Cloud
- 16. VPC peering – same region Peering VPC VPC VPC Peering Peering AWS Cloud
- 17. VPC peering – same region VPC VPC VPC Peering Peering AWS Cloud
- 18. VPC peering – same region VPC VPC VPC Peering Peering AWS Cloud
- 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 20. Interconnecting VPCs at scale – VPC peering Peering VPC VPC VPC Peering Peering AWS Cloud
- 21. Interconnecting VPCs at scale – VPC peering Peering VPC VPC VPCPeering Peering VPC VPC Peering VPC Peering Peering Peering Peering AWS Cloud
- 22. Multiple VPCs access models – AWS Transit Gateway VPC VPC VPC VPC VPC VPC AWS Transit Gateway AWS Cloud
- 23. VPC Attachment VPC Attachment VPC Attachment VPC AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway VPC Attachment VPN Attachment VPC Route Table 172.16.0.0/16 via TGW TGW Route Table 172.16.0.0/16 via VPN Corporate Data Center 172.16.0.0/16
- 24. Existing Service DRAFTNetworking Scale connectivity across thousands of Amazon VPCs, AWS accounts, and on-premises networks Amazon VPCAmazon VPC Amazon VPCAmazon VPC Customer gateway VPN connection AWS Direct Connect Gateway AWS Transit Gateway
- 25. New Feature AWS Transit Gateway Inter-Region Peering General Availability – December 3 DRAFTNetworking AWS TRANSIT GATEWAY Inter-Region Peering Build global networks by connecting transit gateways across multiple AWS Regions
- 26. AWS Transit Gateway Cross-Region Peering Full mesh network across multiple regions with static peering Private and performant connectivity across the AWS Global Network All traffic across Transit Gateway Cross- Region peering is encrypted Horizontally scalable
- 27. Because we are on the internet, it’s accessible from everywhere. Now we open up our workload to the world
- 28. Because we are on the internet, it’s accessible from everywhere. Not all of our customers will have the same experience due to internet weather…
- 29. Local ISP Network A B C D E F Accessing your application is not this straightforward It can take many networks to reach the application Paths to and from the application may differ Each hop impacts performance and can introduce risk Internet weather
- 30. Local ISP AWS Network Leverages the Global AWS network Resulting in improved performance This lets us reduce jitter and latency Traffic enters the AWS global network at edge locations
- 31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Global Network Redundant 100 GbE network Private network capacity between all AWS Regions, except China The AWS Cloud spans: 199 Points of Presence 69 Availability Zones 22 Geographic Regions around the world* *With announced plans for 13 more Availability Zones and four more AWS Regions in Cape Town, Jakarta, Milan, and Spain.
- 32. High availability and improved performance of site-to-site VPN New Feature AWS Accelerated Site-to-Site VPN General Availability – December 3 DRAFTNetworking
- 33. AWS Transit Gateway Network Manager Introducing General Availability – December 3 DRAFTNetworking
- 34. New Feature Transit Gateway Multicast General Availability – December 3 DRAFTNetworking Build and deploy multicast applications in the cloud
- 35. Multicast on AWS Transit Gateway VPC Transit Gateway VPC route domain VPC 10.1.0.0/16 10.2.0.0/16 VPC A VPC B 10.1.0.0/16 vpc-att-a 10.2.0.0/16 vpc-att-b Use cases: Multicast domain Group Multicast domain GroupGroup
- 36. New Feature Amazon VPC Ingress Routing General Availability – December 3 DRAFTNetworking Route inbound and outbound traffic through a third party or AWS service
- 37. DRAFTManagement Tools Announced – November 21 Identify unusual (write) activity in your AWS accounts ü Save time sifting through logs ü Get ahead of issues before they impact your business AWS CloudTrail Insights Introducing • Unexpected spikes in resource provisioning • Bursts of IAM management actions • Gaps in periodic maintenance activity
- 38. Amazon Detective Introducing Analyze, investigate, and identify the root cause of security findings and suspicious activities. Integrated with AWS Security Hub. Automatically distills & organizes data into a graph model Easy to use visualizations for faster & effective investigation Continuously updated as new telemetry becomes available Preview – December 3 DRAFTSecurity
- 39. AWS IAM Access Analyzer Introducing Continuously ensure that policies provide the intended public and cross-account access to resources, such as Amazon S3 buckets, AWS KMS keys, & AWS Identity and Access Management roles. General Availability – December 2 DRAFTSecurity Uses automated reasoning, a form of mathematical logic, to determine all possible access paths allowed by a resource policy Analyzes new or updated resource policies to help you understand potential security implications Analyzes resource policies for public or cross-account access
- 40. 1 Create or use existing identities, including Azure AD, and manage access centrally to multiple AWS accounts and business applications, for easy browser, command line, or mobile single sign-on access by employees. New Feature AWS Single Sign-On - Azure AD Support Announced – November 25 DRAFTSecurity
- 41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 42. AWS Outposts Now Available Fully managed service that extends AWS infrastructure, AWS services, APIs, and tools to virtually any connected customer site. Truly consistent hybrid experience for applications across on-premises and cloud environments. Ideal for low latency or local data processing application needs. Same AWS-designed infrastructure as in AWS regional data centers (built on AWS Nitro System) delivered to customer facilities Fully managed, monitored, and operated by AWS as in AWS Regions Single pane of management in the cloud providing the same APIs and tools as in AWS Regions Compute General Availability – December 3
- 43. © 2020, Amazon Web Services, Inc. or its Affiliates. Customers want the same experience across on-premises and the cloud Same operational consistency Same tools for automation, deployments, and security controls Same services and APIs Same pace of innovation as in the cloud Same reliable, secure, and high performance infrastructure
- 44. © 2020, Amazon Web Services, Inc. or its Affiliates. Applications that are sensitive to latency and variability in latency Need for near real time responses to end user applications Need to control on-site equipment Need to communicate with other on-premises systems Applications that process data locally Need to ensure integrity of ingested signal (e.g., at live events before broadcasting) Need to reliably process messages from industrial equipment to monitor production Need for managing local data stores Applications that need to remain on premises
- 45. © 2020, Amazon Web Services, Inc. or its Affiliates. • Industry standard 42U rack • Fully assembled, ready to be rolled into final position • Installed by AWS, simply plugged into power and network • Centralized redundant power conversion unit and DC distribution system for higher reliability, energy efficiency, easier serviceability • Redundant active components including top of rack switches and hot spare hosts AWS Outposts rack
- 46. © 2020, Amazon Web Services, Inc. or its Affiliates. Supported countries at GA Canada USA Japan Singapore Australia Republic of Korea All EU Countries Switzerland & Norway Bahrain Hong Kong
- 47. © 2020, Amazon Web Services, Inc. or its Affiliates. Supported regions us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 eu-west-1 eu-west-2 ap-northeast-1 ap-southeast-1 ap-southeast-2 ap-northeast-2 eu-west-3 me-south-1 eu-north-1 eu-central-1 ap-east-1
- 48. © 2020, Amazon Web Services, Inc. or its Affiliates. VMware APIs and services to leverage existing skills, automation, and governance policies For customers running VMware SDDC on-premises AWS APIs, services, and features as in the AWS cloud EC2 and EBS with support for services including RDS, ECS, EKS, EMR, ALB, others Native AWS VMware Cloud on AWS Available in two variants
- 49. Services supported on Outposts (additionally to EC2 & EBS)
- 50. © 2020, Amazon Web Services, Inc. or its Affiliates. Build on the same EC2 Instances & EBS Volumes For general purpose applications For compute intensive (media transcoding, gaming servers, machine learning inference) For memory intensive applications (databases, in-memory caches, real time data analytics) For machine learning inference and graphics workstations For I/O intensive applications (NoSQL databases, in-memory or transactional databases, distributed file systems) Local Instance Storage and EBS gp2 volumes for temporary and persistent storage M5 C5 R5 I3G4
- 51. © 2020, Amazon Web Services, Inc. or its Affiliates. Pre-validated catalog of Outposts configurations
- 52. © 2020, Amazon Web Services, Inc. or its Affiliates. Pre-requisites Standard data center space (24” X 48” x 80” aisle clearance and rack position) and power (minimum 5 kVA) Network connection to an AWS region • AWS Direct Connect with public VIF or • Internet Connection via ISP Enterprise Support (24x7 Customer Support and entitlements)
- 53. © 2020, Amazon Web Services, Inc. or its Affiliates. Pricing of Outposts configurations • Priced for EC2 and EBS capacity in the SKU • 3-year term with partial upfront, all upfront, and no upfront options • Price includes delivery, installation, servicing, and removal at the end of term • EC2 capacity and EBS storage upgrades available • EDP discounts eligible
- 54. © 2020, Amazon Web Services, Inc. or its Affiliates. Seamlessly extend your regional VPC AWS Region Availability Zone Subnet VPC Availability Zone Subnet
- 55. © 2020, Amazon Web Services, Inc. or its Affiliates. Instances in the Outpost can securely talk to other instances in the VPC via private IP addresses Seamlessly extend your regional VPC AWS Region Availability Zone Subnet VPC Availability Zone Subnet AWS Outposts Subnet
- 56. © 2020, Amazon Web Services, Inc. or its Affiliates. Seamlessly extend your regional VPC AWS Region Availability Zone Subnet VPC Availability Zone Subnet AWS Outposts Subnet Amazon S3 Use Interface Endpoints (powered by Private Link) to access all regional AWS services such as DynamoDB and S3 in your private VPC environment
- 57. © 2020, Amazon Web Services, Inc. or its Affiliates. VIF1 VIF2 • Connect to local network equipment via ports provided in the Outpost’s top of rack (TOR) switches • Configure Virtual Interfaces (VIFs) mapping to your VLANs using Link Aggregation Control Protocol (LACP) • Configure the new local gateway (LGW) on the Outpost to route traffic to and from your local network using these VIFs Router or Switch TOR LACP Router or Switch TOR LACP AWS Outpost Customer Network Connect to your local network LGW
- 58. Local Zones Introducing Extend the AWS Cloud to more locations and closer to your end-users to support ultra low latency application use cases. Use familiar AWS services and tools and pay only for the resources you use. DRAFTCompute General Availability – December 3 The first Local Zone to be released will be located in Los Angeles.
- 59. AWS Wavelength Introducing Embeds AWS compute and storage inside telco providers’ 5G networks. Enables mobile app developers to deliver applications with single-digit millisecond latencies. Pay only for the resources you use. DRAFTCompute Announcement – December 3
- 60. AWS Wavelength Introducing Embeds AWS compute and storage inside telco providers’ 5G networks. Enables mobile app developers to deliver applications with single-digit millisecond latencies. Pay only for the resources you use. DRAFTCompute Announcement – December 3
- 61. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. https://aws.amazon.com/new/reinvent
- 62. Go Build! Here to help you build