Upload
amazon-web-services
View
155
Download
1
Embed Size (px)
Citation preview
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lee Atkinson, Solutions Architect
December 1, 2016
Taking DevOps to the AWS EdgeCTD302
What to Expect from the Session
• Integrate Amazon CloudFront and other AWS edge
services into your agile development process.
• Follow best practices to improve security, performance,
and reduce costs.
• Automate edge deployment and testing.
• Monitor and analyze usage of AWS edge services.
Agenda
1. What is the AWS Edge?
2. The application edge
3. Patterns for the DevOps Edge
What is the AWS Edge?
AWS edge locations
68 Edge locations
AWS edge services
• Amazon CloudFront
• Content Delivery Network
• Amazon Route 53
• DNS registration and hosting, health checks
• AWS WAF
• Web Application Firewall
The application edge
Your Application =
EC2/ELB/S3 Route 53/CloudFront/AWS WAF
HTML5/Mobile/Desktop
Origin+ Edge+ Client
ClientClient
Amazon Backbone
Edge location Edge location Edge location
CloudFront helps improve user experience
Origin
CloudFront helps reduce costs
Free data transfer cost AWS
origin to CloudFront
Less load on origin
Lower data transfer cost CloudFront to Internet
compared to AWS Region to Internet
Client
Edge location Edge location Edge location
Origin
Amazon Route 53 health checks
Amazon Route 53
health checks
Endpoint
Endpoint
www.test Amazon
CloudWatch
Amazon
SNS
Patterns for the DevOps Edge
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
HTTP Cache-Control
Origin
Client
Cache-Control: max-age:1800Cache-Control: max-age:1800,s-maxage:900Cache-Control: max-age:1800,privateCache-Control: no-cacheCache-Control: no-store
HTTP/1.1 200 OKLast-Modified: Fri, 02 Dec 2016 01:00:00 GMT
ETag: "TGVlQXRraW5zb25Xb3onRXJl"
GET /barchart.jpg HTTP/1.1
If-None-Match: "TGVlQXRraW5zb25Xb3onRXJl"
HTTP/1.1 304 Not ModifiedHTTP/1.1 200 OKLast-Modified: Fri, 02 Dec 2016 02:00:00 GMT
ETag: "TGVlQXRraW5zb24nRXJlVG9v"
Amazon
CloudFront
Cache-Control
s-maxage?
Cache-Control
max-age?
Expires?
> MinTTL?< MaxTTL?
Use DefaultTTL Use MaxTTL Use MinTTL Use Origin-Defined TTL
The origin has defined
the TTL for the object
CloudFront TTL
Use the client in increase cacheability
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
Forwarding
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
GET /search?query=widget&foo=bar HTTP/1.1
Host: www.test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate
Cookie: session=cjZYuh3fVXzf6rXGAwV2; theme=modern; currency=gbp
Tips when forwarding
• Only forward when it affects the response
• Reduce variability in forwarded values
• Use CloudFront logs or beacon for tracking
• Authorize using signed URLs/cookies, CloudFront
restrictions, and AWS WAF
• Use Vary response header
Forward User-Agent?
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
HTTP/1.1 307 Temporary RedirectLocation: /user-agent?return-url=/Vary: Cookie
origin
client
GET /user-agent?return-url=/ HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; …
HTTP/1.1 307 Temporary RedirectLocation: /Set-Cookie: OS=MacOSXVary: User-Agent
GET / HTTP/1.1Cookie: OS=MacOSX
CloudFront-Is-Mobile-Viewer
CloudFront-Is-Tablet-Viewer
CloudFront-Is-Desktop-Viewer
CloudFront-Is-SmartTV-Viewer
Cache-Behavior for “/user-agent”:
Forward Header ‘User-Agent’
Default Cache Behavior:
Forward Cookie ‘OS’
Responsive web design
/* Use CSS3 media-selectors */ @media only screen and (max-width: 768px) {
…}
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
HTTP does not provide invalidation
• CDN invalidation is not recognized by downstream
caches:
• Origin ✓
• CloudFront ✓
• ISP / corporate / hotel caches ✗
• Browser caches ✗
HTTP does provide validation
• Use conditional HTTP requests• If-Modified / If-None-Match / If-Match
• Origin should efficiently generate 304s
• Use low s-maxage and higher max-age
• Use URL versioning to ‘cache-bust’
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
AWS edge services automation
• Route 53, CloudFront, and AWS WAF have APIs
• AWS SDK available for 11 languages and platforms
• Deploy DNS, CDN, and WAF using AWS
CloudFormation
• Change configuration as your application develops
• Use AWS IAM to control access to your resources
Amazon
Route 53
AWS WAF
Amazon
CloudFront
Elastic Load Balancing EC2
EU-WEST-1
Amazon S3
Corporate data center
Elastic Load Balancing EC2
US-WEST-1
Amazon
Route 53
DNS, CDN, and WAF ‘as code’
AWS Lambda
AWS
Certificate Manager
Client
AWS WAF automation
• Automate AWS WAF using your application or Lambda
• ‘AWS Answers’ AWS WAF
Security Automations
https://aws.amazon.com/answers/security/aws-waf-security-automations/
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
AWS CloudTrail
• Route 53
• CloudFront
• AWS WAF
Amazon CloudWatch metrics & alarms
• Route 53
• CloudFront
• AWS WAF
CloudFront reporting
CloudFront access logs
Amazon
CloudFrontS3 bucket
AWS
LambdaS3 bucket
Amazon
QuickSight
#Version: 1.0 #Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agen2014-05-23 01:13:11 FRA2 182 192.0.2.10 GET d111111abcdef8.cloudfront.net /view/my/file.html 200 www.displaymyfiles.com Mozilla/4.0%20(c2014-05-23 01:13:12 LAX1 2390282 192.0.2.202 GET d111111abcdef8.cloudfront.net /soundtrack/happy.mp3 304 www.unknownsingers.com Mozilla/
AWS Data
PipelineAmazon
Redshift
W3C Log
Processor
Amazon
CloudWatch
Logs
Patterns for the DevOps Edge
1. Cache as much as possible
2. Forward as little as possible
3. Validate efficiently
4. Automate the edge
5. Monitor the edge
Key takeaways
1. Consider the AWS Edge as a part of your application
2. Optimise and use caching efficiently
3. Automate configuration of the AWS Edge
4. Monitor the AWS Edge using CloudTrail, CloudWatch,
and services logs
Thank you!
Remember to complete
your evaluations!
Related Sessions
1. CTD301 - Amazon CloudFront Flash Talks: Best
Practices on Configuring, Securing, and Monitoring your
Distribution
Friday 09:30, Venetian, Level 2, Venetian D
2. SAC316-R - Security Automation: Spend Less Time
Securing Your Applications
Friday 10:30, Venetian, Level 3, Lido 3003