Translated from 日本語 • View original On October 23, 2015, I took the stage at the "AWS Thorough Utilization Seminar for Companies, where Users Have the Initiative" hosted by ITMEDIA.
We will deliver it as content on this blog so that we can tell those who did not come to the seminar on the day.
Seminar Overview
For those who are hesitant to use AWS
ISAO infra R&D Project Leader Rikiya Katakai
Today, for those who are hesitant to use AWS, I would like to briefly introduce some precautions and issues that are likely to occur when using AWS. I would like to explain based on specific examples, but it will be insufficient for those who have already used it. Please note that in advance. We will also introduce security measures on AWS, which have recently become more in demand.
Do you want to use services other than EC2?
I have a question for those who plan to use AWS (Amazon Web Searvices). Do you want to use a service other than EC2?
Of course, I think that it will not be a service unless EBS, ELB, S3, etc. are used, but when considering building on AWS, one important point is how far to use the managed services provided by AWS. Please consider whether you want to build your own middleware environment on EC2 or use managed services that include middleware such as RDS and ElastiCash. However, by using a managed service, you can greatly reduce the time and effort of construction, and the time and effort of operation are also simplified, so it is usually recommended to use it because it reduces man-hours and leads to cost reduction.
However, one thing to be careful of is the vendor lock-in (*) state. If you have to consider moving to a different system every few years, it will be very difficult to consider relocation if you are using a managed service. However, I think that there is no merit in relocating from an AWS environment to another environment, or most of the cases are thin, so I don't think there is any problem in using managed services without hesitation in the current situation. In addition, using managed services is a shortcut to ensure stable service operation in the AWS environment.
Vendor lock-in is fixed to a specific environment or technology, and compatibility with others is compromised.
However, in addition to the system environment, the technical skills of the construction and operation members are also inherited and exclusive to AWS, so there are situations where infrastructure members are unable to design and implement the network in the on-premises environment these days.
Companies with infrastructure engineers need to think about the allocation of operational resources and future skill paths.
Is AWS Monthly Cost Really Cheap?
The monthly costs incurred by using AWS do not seem cheap when the scale increases to a certain extent.
In particular, if you calculate the number of CPU cores and hardware performance when built on-premises and calculate it on AWS, it will often be higher than the housing cost over a span of one or multiple years. However, this is a simple comparison of monthly costs, so it should be compared by adding the actual cost of operation.
AWS is a major advantage not only for building operations, but also for eliminating the costs of design, management, and on-site work. For example, you don't need to go to a data center. By taking them into account, you can get the correct AWS cost estimate. In addition, it is easier to see the benefits if you can estimate the cost based on the variability that assumes the actual load rather than 100% of the instance operation.
What is a Reserved Instance?
In addition, AWS also has a plan called Reserved Instances (RIs) that are cheaper with an annual contract. This RI is a discounted service for a one- or three-year contract, as well as the promise of launching instances, as the name "reserved" suggests. If you have a contract, you can secure the number of instances, and you will not have to worry about the rare "resource depletion and the number of instances you need will not increase".
If the instance fails to start, you will have to wait a few minutes to tens of minutes before starting it, but the RI will have the resources for the contract. If you are operating manually, this is not a big problem, but as you grow and incorporate automation, smooth instance launch becomes an important issue.
What about AWS maintenance?
There are two main types of EC2 maintenance.
- Maintenance for updates • Retirement maintenance
The first is a security update that AWS implements. This is a maintenance performed by AWS at a specific time. Therefore, depending on the environment and target, it is necessary to stop the service and switch to maintenance at that time. However, it seems that the range that can be handled by live migration is increasing, so I think it will be once a year in the future.
The second is the stop/start of the instance due to hardware failure or retirement. This is more likely to be targeted as the number of instances handled increases, so my feeling is that if about 1,000 units are started, it will occur somewhere every week. However, you only need to stop/start at any time until the specified date, so the impact on the normal service will not be so high. *However, it is usually held from 4:00 on weekdays, so it will be a little difficult depending on the frequency of the worker.
In addition, the information will be sent in English email, so be careful not to miss it. Events can also be checked in the managed console, so we monitor events via API and issue alerts.
Do you know what a ceiling relaxation application is?
Surprisingly, it is not well known, but AWS has a very large number of launches and settings limits. This includes the number of EC2 instances launched, the total volume of EBS, the number of ELBs, and the number of SecurityGroups. For example, EC2 instances have a default launch limit of 20, depending on the type.
Therefore, if you want to launch more than 21 instances, you must apply for a limit relaxation in advance from the Management Console. This upper limit relaxation will take some time, so it is safer to apply by the day before the construction work.
I think it is easy to change the upper limit to 50 or 100, but I don't think it will be recognized unless it is accompanied by a record of use, so I do not recommend applying for an excessive upper limit. Please apply for the appropriate maximum number so that re-application does not take extra time.
After implementing various upper limit relaxations, it is possible to check the current upper limit values via API.
Is Cloud Watch Enough for Monitoring?
The AWS monitoring service (CloudWatch) allows you to monitor the resource aspects of your instance, but you cannot monitor processes or services. In order to implement solid operation, it is essential to build your own monitoring system. However, you can deploy a monitoring agent in EC2, but not in RDS or ElastiCash. In this case, it is necessary to link the values obtained from CloudWatch to view them in your own monitoring system.
In our case, we are building a monitoring system using Zabbix and CloudWatch. In addition, in large-scale environments, we are implementing an operation to automate monitoring and registration with Zabbix.
Is AWS Security Unsettling?
We often hear people worry about whether security is okay when using an AWS environment.
Since it will be a public sharing environment, I understand that you are worried about the image, but your company's data will not be shared with other accounts. We have also cleared third-party certifications such as PCIDSS, so I think it is easier to improve security than building everything in-house in an on-premises environment.
However, the configuration of security groups, OS, and middleware must be carried out at the responsibility of the user. However, this is the same in any environment, so I think that using AWS can ensure higher security.
As products such as WAFs are becoming more virtualized, it is now possible to add them from the AWS marketplace. You can also pay by the hour, so you can easily introduce it.
We have a partner contract with Barracuda, so if you are interested, please contact us.
Introduction of "Kuramane"
Our ISAO cloud managed service Kuramane is also involved in relocating from on-premises to the cloud or building a new cloud according to the needs of our customers.
We provide comprehensive support from construction, design, and operation to 24 hours a day, 365 days a year. Click here for an example of the introduction
As a strength, we have a reputation for smooth recovery response in the event of a failure because we have been building it from the beginning, and we also provide it at the lowest price in the industry.
Please feel free to contact us from the banner below.
