2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC)...

28
Enterprise Infrastructure in the Amazon Web Services (AWS) Cloud David Zych, Erik Coleman, Phil Winans

Transcript of 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC)...

Page 1: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

EnterpriseInfrastructureintheAmazonWebServices

(AWS)CloudDavidZych,ErikColeman,PhilWinans

Page 2: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

gotAWS?

• http://aws.illinois.edu• Let’sgo!

But…• ITserviceshavedependencies• ActiveDirectory• private resourcesoncampusnetwork• private resourcesinotherAWSaccounts

• packetsneedroads(routes)

Page 3: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Wherewe’regoing…

ØVPCNetworkingConcepts

• FantasticEnterpriseVPCsandHowtoBuildThem

• UsingActiveDirectoryintheCloud

• ThereAndBackAgain:aPacket’sJourneyfromUIUCtoAWS

Page 4: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

VPCBasics

• VirtualPrivateCloud(VPC):alogicallyisolatedvirtualnetworkintheAWScloudwhichisdedicatedtoyourAWSaccount

• anAWSaccountmayhavemultipleVPCs

• eachVPCmaycontainmultipleSubnets

Page 5: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Location,Location,Location

• aVPCbelongstoasingleRegion(us-east-2:Ohio)• aSubnetbelongstoasingleAvailabilityZone(us-east-2a)

Page 6: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Public-facingSubnets

• bi-directionalcommunicationwithanyhostonthepublicInternet• ifpermittedbySecurityGroups

• privateIPv4addressesinternally

• 1:1NetworkAddressTranslation(NAT)mapseachprivateIPtoanElasticIPortransientpublicIP

Page 7: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

NetworkAddressTranslation(Example)

DNS: example.com IN A 52.15.99.99

Page 8: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Campus-facingSubnets

• bi-directionaltocampus,withoutNAT• usingTechnologyServicesVPNconnection

• outbound-onlytoInternet(optional)

Page 9: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Wherewe’regoing…

• VPCNetworkingConcepts

ØFantasticEnterpriseVPCsandHowtoBuildThem

• UsingActiveDirectoryintheCloud

• ThereAndBackAgain:aPacket’sJourneyfromUIUCtoAWS

Page 10: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

EnterpriseVPC(vsIndependentVPC)

• Enterprisenetworkingfeatures• Campus-facingsubnets• VPCPeeringtootherEnterpriseVPCs

• includingCoreServicesVPCs

• Restrictions• PrivateIPv4spacecentrallyallocatedbyTechnologyServices• us-east-2(Ohio)only

Page 11: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

RecursiveDNSResolution

• AmazonProvidedDNS:default,preferred

• CannotresolveUniversity-restrictedDNSzones• ad.uillinois.edu• reverse-mappingzonesforRFC1918privateIPv4space

• oncampus• inAWSEnterpriseVPCs(ifmanagedinIPAM)

Page 12: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

RecursiveDNSResolution(Options)

Page 13: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

RecursiveDNSResolution(Options)

Page 14: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

BuildingYourEnterpriseVPC

1. Planyourrequirements• Whichfeatures?• Whatsubnets?(types,sizes,AvailabilityZones)• HowmuchprivateIPv4space?

2. RequestallocationfromTechnologyServices3. DeployusingInfrastructure-as-Code(IaC)• Download,customize,run!• Terraform

SeeKnowledgebasefordetails.

Page 15: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

EyeTest

Page 16: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Wherewe’regoing…

• VPCNetworkingConcepts

• FantasticEnterpriseVPCsandHowtoBuildThem

ØUsingActiveDirectoryintheCloud

• ThereAndBackAgain:aPacket’sJourneyfromUIUCtoAWS

Page 17: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

ActiveDirectoryHybridArchitecture

HAB

PPSB

DCL

Node9

“Urbana”ADSite “Chicago”ADSite

RRB30s

“Radius”ADSite

RRBDCL

“AWS”ADSite

EC2 EC2

Zone Zone

US-East-2(Ohio)RegionCoreServicesVPC

360s900s

Page 18: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

ADExtendedtoAWS

VPCPeerConnection

EnterpriseServicesVPC

Public-facingsubnet10.x.y.0/27

EC2

Campus-facingsubnet10.x.y.64/27

Campus-facingsubnet10.x.y.128/27

AvailabilityZone

LDAP(389)LDAPS(636)Keberos (88)

EC2

EC2

AvailabilityZone

CoreServicesVPC

Campus-facingsubnet10.224.n.64/27

AvailabilityZone

Campus-facingsubnet10.224.n.96/27

AWSDC1

AWSDC2

ELB

ldap-ad-aws.ldap.illinois.edu:389krb-ad-aws.kerberos.illinois.edu:88

Page 19: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

SupportforDomain-Join

• Previouslyunsupported• Announcingfullsupporttoday!June8th,2017• ADSiteBoundariesforAWSIPspace• PreferredforAWScampus-facingsubnets• Reducedfunctionalityforprivate-facingandpublic-facingsubnets

Page 20: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

SupportforDomain-JoinforEnterpriseVPCs

Privatesubnet

Campus-facingsubnet

Public-facingsubnet

PasswordSynchronization 15 mindelay ü 15 mindelay

AD SiteFailover û ü ûGlobalCatalogLookup û ü ûDynamic DNS ü ü ü*

*DDNSregistersprivateIPonly.Bestpracticeistoalwaysusecampus-publishedDNS(IPAM)forapplicationuse.Never publicizetheAD-registeredIPorDNShostname.

Page 21: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

What’snext?

• EvaluateneedforLDAPoverSSL(port636)• ExploringAmazonIAMIntegration• EvaluateAWS-hostedADoptions• AWSDirectoryServicesforMicrosoftAD• SimpleAD• ADConnector

• Whatelsedoyouneed?

Page 22: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Wherewe’regoing…

• VPCNetworkingConcepts

• FantasticEnterpriseVPCsandHowtoBuildThem

• UsingActiveDirectoryintheCloud

ØThereAndBackAgain:aPacket’sJourneyfromUIUCtoAWS

Page 23: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

AWSUSRegions

Page 24: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

ToAWSFromCampus

Page 25: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

DifferentWaysNetworksConnecttoAWS

Page 26: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

UofI toInternet2tous-east-2

Page 27: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

UofI toWiscNet tous-east-2

Page 28: 2017SpringITPF-Enterprise Infrastructure in the …...Deploy using Infrastructure-as-Code (IaC) •Download, customize, run! •Terraform See Knowledgebase for details. Eye Test Where

Resources

• http://aws.illinois.edu• Knowledgebase:searchfor“AWS”• [email protected]

• DavidZych<[email protected]>• ErikColeman<[email protected]>• PhilWinans <[email protected]>


"Continuously delivering infrastructure using Terraform and Packer" training material

"Continuously delivering infrastructure using Terraform and Packer" training material

Terratest & Jenkins CI/CD with Terraform, Modern ... · terraform init $ cd tf $ terraform init Initializing provider plugins... Terraform has been successfully initialized! You may

Terratest & Jenkins CI/CD with Terraform, Modern ... · terraform init $ cd tf $ terraform init Initializing provider plugins... Terraform has been successfully initialized! You may

Terraform and cloud.ca

Terraform and cloud.ca

Wie Terraform(ing) die Welt verändert! · 2020-05-08 · Terraform –Infrastructure as Code (IaC) • Einstieg in die Automatisierung • Schnelle Erfolge • HCL sehr einfach,

Wie Terraform(ing) die Welt verändert! · 2020-05-08 · Terraform –Infrastructure as Code (IaC) • Einstieg in die Automatisierung • Schnelle Erfolge • HCL sehr einfach,

ARTURO PIE IAC WITH TERRAFORM - SEI Digital LibraryInfrastructure as Code with Terraform Author: Arturo Pie (Nulogy) Subject: Writing infrastructure as code is a considerable initial

ARTURO PIE IAC WITH TERRAFORM - SEI Digital LibraryInfrastructure as Code with Terraform Author: Arturo Pie (Nulogy) Subject: Writing infrastructure as code is a considerable initial

Terraform innovation - Performance 3.0

Terraform innovation - Performance 3.0

Sustainable Technology & Infrastructure Monthly Market Update · 2017-11-06 · TerraForm Power Completed the previously announced acquisition of a controlling interest in TerraForm

Sustainable Technology & Infrastructure Monthly Market Update · 2017-11-06 · TerraForm Power Completed the previously announced acquisition of a controlling interest in TerraForm

ITSM for a cloud-based container infrastructure using Dockerand Terraform Wa Kwan.pdf · 2016-12-19 · Cloud infrastructure = entire infrastructure Code as Service Simplifies ITSM

ITSM for a cloud-based container infrastructure using Dockerand Terraform Wa Kwan.pdf · 2016-12-19 · Cloud infrastructure = entire infrastructure Code as Service Simplifies ITSM

Building infrastructure as code using Terraform - DevOps Krakow

Building infrastructure as code using Terraform - DevOps Krakow

2017SpringITPF-Excel In Extreme Ways

2017SpringITPF-Excel In Extreme Ways

Infrastructure as code: running microservices on AWS using Docker, Terraform, and ECS

Infrastructure as code: running microservices on AWS using Docker, Terraform, and ECS

Deploying TimesTen Scaleout On Oracle Cloud Infrastructure · 7 | deploying oracle timesten scaleout on oracle cloud infrastructure The terraform-provider-oci installation documentation

Deploying TimesTen Scaleout On Oracle Cloud Infrastructure · 7 | deploying oracle timesten scaleout on oracle cloud infrastructure The terraform-provider-oci installation documentation

Terraform - hwsw.hu · •Introduction to Terraform •Demo •Create instance in Oracle Public Cloud ... Terraform Chef Ansible Puppet SaltStack CloudFormation

Terraform - hwsw.hu · •Introduction to Terraform •Demo •Create instance in Oracle Public Cloud ... Terraform Chef Ansible Puppet SaltStack CloudFormation

Infrastructure as Code with Terraform · State Terraform stores state about your managed infrastructure and configuration. Used by Terraform to map real world resources to your configuration

Infrastructure as Code with Terraform · State Terraform stores state about your managed infrastructure and configuration. Used by Terraform to map real world resources to your configuration

Infrastructure as Code Terraform & Ben Higginbottom · Terraform - The Downside Terraform maintains a state file (terraform.tfstate) that describes what the environment is, therefore

Infrastructure as Code Terraform & Ben Higginbottom · Terraform - The Downside Terraform maintains a state file (terraform.tfstate) that describes what the environment is, therefore

Terraform - Infrastructure as Code

Terraform - Infrastructure as Code

Refactoring terraform

Refactoring terraform

Using HashiCorp’s Terraform to build your infrastructure on AWS - Pop-up Loft Tel Aviv

Using HashiCorp’s Terraform to build your infrastructure on AWS - Pop-up Loft Tel Aviv

Terraform®Wall Panels Product Introductionbmatglobal.com/wp-content/uploads/2013/12/Terraform-Curtain-Wall... · Product Introduction Terraform® wall Panel products are one of ...

Terraform®Wall Panels Product Introductionbmatglobal.com/wp-content/uploads/2013/12/Terraform-Curtain-Wall... · Product Introduction Terraform® wall Panel products are one of ...

Effective terraform

Effective terraform