Upload
others
View
9
Download
0
Embed Size (px)
Citation preview
© 2020, Amazon Web Services, Inc. or its Affiliates. © 2020, Amazon Web Services, Inc. or its Affiliates.
David Richardson
VP of Serverless, AWS
Operations &
event-driven architectures
© 2020, Amazon Web Services, Inc. or its Affiliates.
Elements of a modern application
Modular
services
As managed
as possible
Automated
& standardized
Everyone’s
responsibility
Purpose
built
Architectural
patterns
1
Operational
model
2
Software
delivery
3
Management &
governance
4
Data
management
5
© 2020, Amazon Web Services, Inc. or its Affiliates.
Small pieces loosely joined
Modern application architectures are small pieces, loosely joined
© 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Lambda enhancements
Provisioned
Concurrency
Compute
Savings Plan
VPC
Networking
© 2020, Amazon Web Services, Inc. or its Affiliates.
APIs are the front door
of microservices
© 2020, Amazon Web Services, Inc. or its Affiliates.
Realtor.com uses APIs between services
Lambda function
AWS
Amazon CloudWatch
monitoring
Amazon
CloudFront
Mobile apps
API
Gateway cache
Websites
Image Processing
Internet
Image Repository
“
..”
—Kuntal Shah
SVP Engineering, Realtor.com
© 2020, Amazon Web Services, Inc. or its Affiliates.
Cost and Performance
© 2020, Amazon Web Services, Inc. or its Affiliates.
Event-driven architectures
Client
Mobile
IoT
Amazon
Kinesis
Amazon
DynamoDB
EventsAWS Step Functions
Amazon
SQS
Amazon
SNSMessaging
AWS Step Functions
AWS Step Functions
AWS Lambda AWS Lambda
© 2020, Amazon Web Services, Inc. or its Affiliates.
Amazon EventBridge – SaaS Event Sources
EventBridge Event Bus
AWS Lambda
Amazon Kinesis Data Firehose
Amazon SNS
Additional Targets
SaaS Event Sources
AWS Service Event Sources
Custom Event Bus
SaaS Event Bus
Default Event Bus
Topics
Event Targets
© 2020, Amazon Web Services, Inc. or its Affiliates.
Connecting AWS event sourcesMessaging
Queues
Amazon Simple
Queue Service
Pub/Sub
Amazon Simple
Notification Service
Events
Amazon
EventBridge
© 2020, Amazon Web Services, Inc. or its Affiliates.
Data streams
Amazon
DynamoDB
Data StoreMicroservices
Performance at scale
Fast and flexible
IngestData streams
Data processing
Real-time
Amazon Kinesis
Data Streams
© 2020, Amazon Web Services, Inc. or its Affiliates.
Coordinate function execution
Track status of
data and execution
Remove
redundant code
© 2020, Amazon Web Services, Inc. or its Affiliates. © 2020, Amazon Web Services, Inc. or its Affiliates.
Serverless security
© 2020, Amazon Web Services, Inc. or its Affiliates.
Common causes of security breaches
Unapplied patches
and updates
Malicious code &
runtime security
Network
segmentation
Overly permissive
access
© 2020, Amazon Web Services, Inc. or its Affiliates.
Comparison of operational responsibility
AWS LambdaServerless functions
AWS FargateServerless containers
Amazon ECS/
Amazon EKSContainer management as a service
Amazon EC2Infrastructure as a service
More opinionated
Less opinionated
AWS manages Customer manages
• Data source integrations• Physical hardware, software, networking,
and facilities
• Provisioning
• Application code
• Container orchestration, provisioning• Cluster scaling
• Physical hardware, host OS/kernel, networking, and facilities
• Application code• Data source integrations
• Security config and updates, network config, management tasks
• Container orchestration control plane• Physical hardware software, networking,
and facilities
• Application code• Data source integrations
• Work clusters• Security config and updates, network config,
firewall, management tasks
• Physical hardware software, networking, and facilities
• Application code• Data source integrations
• Scaling• Security config and updates,
network config, management tasks• Provisioning, managing scaling
and patching of servers
© 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Lambda-ready partners
© 2020, Amazon Web Services, Inc. or its Affiliates.
AWS serverless service delivery partners
© 2020, Amazon Web Services, Inc. or its Affiliates.
Function isolation
VirtualizationStrong isolation boundary for functions
© 2020, Amazon Web Services, Inc. or its Affiliates.
Function isolation
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
Fargate
task
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
MicroVM
LambdaExecution
Lambda Function
Application Code
Layers
Network
Interface
Data
Volume Credentials
Lambda Data Plane
Kernel
MicroVM
© 2020, Amazon Web Services, Inc. or its Affiliates.
Shared responsibility model
AWS
Security OF
the Cloud
AWS is responsible for
protecting the infrastructure
that runs all of the services
offered in the AWS Cloud
Security IN
the Cloud
Customer responsibility will be
determined by the AWS Cloud
services that a customer selects
Customer
© 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Serverless Shared Responsibility Model
AW
S
AW
S Identity
and A
ccess M
anagem
ent
Platform
management
Network traffic
Firewall configCode encryption
Operating system and network configuration
Compute
Edge locations
NetworkingDatabaseStorage
Regions
Availability zones
Custo
mer Customer data, application identity and access management
Data encryption
Data integrity
Authentication
Application
Management
Internet access
Monitoring
Logging
AWS Global
Infrastructure
Responsible
for security
“in” the cloud
Responsible
for security
“of” the cloud
© 2020, Amazon Web Services, Inc. or its Affiliates.
Finer-grained control gives you better security
In plain language, the potential security risk of
a serverless application is lower, but still present!
© 2020, Amazon Web Services, Inc. or its Affiliates.
Identity & access management
© 2020, Amazon Web Services, Inc. or its Affiliates. © 2020, Amazon Web Services, Inc. or its Affiliates.
Modern operations
© 2020, Amazon Web Services, Inc. or its Affiliates.
What’s different about modern operations?
Central control
Periodic software release
Physical hardware
Manual tasks
Traditional Modern
Decoupled teams
Continuous delivery
Virtual or ephemeral
Automation via code
© 2020, Amazon Web Services, Inc. or its Affiliates.
What are the approaches to operations?
Central control
Low risk but very
slow to release
Dependencies
& time lags
Guardrails
Fast time & low risk
to the business
Win win
Free for all
Fast dev time, but high risk
to legal & app reliability
Chaos
© 2020, Amazon Web Services, Inc. or its Affiliates.
What are
guardrails?
Guardrails are mechanisms, such as
processes or practices, that reduce
both the occurrence and blast radius
of undesirable application behavior
© 2020, Amazon Web Services, Inc. or its Affiliates.
What are some real-world guardrails?
MonitoringProvisioningDeployment
Cost
management
Security
& compliance
© 2020, Amazon Web Services, Inc. or its Affiliates.
Centrally deployed guardrails enable
the standardization of routine processes,
like certificate management, without
creating bottlenecks
A A
© 2020, Amazon Web Services, Inc. or its Affiliates.
Where your teams can go from here
A AA A
A A
© 2020, Amazon Web Services, Inc. or its Affiliates.
Thank you!