The document outlines an AWS Summit agenda that focuses on auto scaling techniques. The agenda includes discussing auto scaling groups, launch configurations, manual and policy-based scaling, custom CloudWatch metrics, session affinity, and stateless application architectures. It also discusses techniques for securely deploying resources like using CloudFormation templates and IAM roles for access control.

1. AWS Summit 2012 | Melbourne
Welcome
Daniel Hand
Principal Solutions Architect, ANZ

2. Agenda
Auto scaling

3. Agenda
Auto scaling
Deploying resources

4. Agenda
Auto scaling
Deploying resources
Accessing resources

5. Agenda
Auto scaling
Deploying resources
Accessing resources
Tracking and identification of resources

6. Agenda
Auto scaling
Deploying resources
Accessing resources
Tracking and identification of resources
Scaling databases

7. Helping you go from …

8. Static tiers

9. Inelastic tiers

10. Inefficient ops

11. Less secure use of
AWS credentials

12. To …

13. Elastic tiers

14. Scalable tiers

15. Efficient use of
resources

16. Efficient Operations

17. More secure use of
AWS credentials

18. Allowing you to …
Do more in less time

19. Allowing you to …
Do more in less time
Deliver greater results with fewer resources

20. Allowing you to …
Do more in less time
Deliver greater results with fewer resources
Increase manageability

21. Allowing you to …
Do more in less time
Deliver greater results with fewer resources
Increase manageability
Improve security

22. Happy days …

23. Auto Scaling
Automatically scale up/down
EC2 resources

24. Define a launch configuration
group
Specify the properties of new instances
added to an auto scaling group

25. Give the launch configuration a name
$PROMPT>as-create-launch-config
WidgetsIncConfig --image-id ami-e6f48ab4
--instance-type t1.micro

26. Specify the AMI to use
$PROMPT>as-create-launch-config WidgetsIncConfig
--image-id ami-e6f48ab4
--instance-type t1.micro

27. Specify the EC2 instance type to use
$PROMPT>as-create-launch-config WidgetsIncConfig
--image-id ami-e6f48ab4
--instance-type t1.micro

28. Optional Parameters
Block-device-mapping
Detailed cloud watch monitoring
SSH key
Security group membership
Ramdisk/kernel
User-data

29. Define an auto scaling group
Specify limits and placement of resources
within an auto-scaling group

30. Give the auto scaling group a name
$PROMPT>as-create-auto-scaling-group
WidgetsIncScalingGroup --launch-configuration
WidgetsIncConfig --availability-zones ap-
southeast-1a ap-southeast-1b --min-size 2 --max-
size 3

31. Specify the launch config to use
$PROMPT>as-create-auto-scaling-group
WidgetsIncScalingGroup --launch-configuration
WidgetsIncConfig --availability-zones ap-
southeast-1a ap-southeast-1b --min-size 2 --max-
size 3

32. Specify the availability zones
$PROMPT>as-create-auto-scaling-group
WidgetsIncScalingGroup --launch-configuration
WidgetsIncConfig --availability-zones ap-
southeast-1a ap-southeast-1b --min-size 2 --
max-size 3

33. Specify group limits
$PROMPT>as-create-auto-scaling-group
WidgetsIncScalingGroup --launch-configuration
WidgetsIncConfig --availability-zones ap-
southeast-1a ap-southeast-1b --min-size 2
--max-size 3

34. Optional Parameters
Cool down period

35. Optional Parameters
Cool down period
Grace period

36. Optional Parameters
Cool down period
Grace period
Health check type

37. Optional Parameters
Cool down period
Grace period
Health check type
Load balancer

38. Optional Parameters
Cool down period
Grace period
Health check type
Load balancer
Placement group

39. Optional Parameters
Cool down period
Grace period
Health check type
Load balancer
Placement group
VPC

40. Auto scaling
Type #1: Manual scaling

41. Scale to 3
servers
now

42. Manual scaling
Basic use of auto scaling
Specify desired capacity
Launch config and auto scaling group parameters apply
$PROMPT> as-set-desired-capacity
WidgetsIncScalingGroup --desired-capacity 3

43. Auto scaling
Type #2: Scheduled based scaling

44. Scale to 3
servers at
date:time

45. Schedule based scaling
Change the number of instances based on a schedule
Scaling occurs as a function of time and date
$ PROMPT> as-put-scheduled-update-group-action
scheduledAction1 –g WidgetsIncScalingGroup
--time “2011-12-05T02:00:00Z” –-min 5 –-max
10

46. Auto scaling
Type #3: Policy based scaling

47. 6:00
AM

48. 8:00
AM

49. 8:00
AM

50. 8:00
AM

51. 7:00
PM

52. 7:00
PM

53. 7:00
PM

54. Policy based scaling
Change the number of instances based on
environmental changes e.g. increased CPU utilisation
Environmental data provided by CloudWatch or custom
user defined metrics
Consists of two components {policies & alarms}
Puts the AUTO in auto scaling

55. Give the scaling policy a name
$ PROMPT>as-put-scaling-policy MyScaleUpPolicy
--auto-scaling-group WidgetsIncScalingGroup
--adjustment=1 --type ChangeInCapacity

56. Specify the auto scaling group it applies to
$ PROMPT>as-put-scaling-policy MyScaleUpPolicy --
auto-scaling-group WidgetsIncScalingGroup
--adjustment=1 --type ChangeInCapacity

57. Specify the adjustment to take place
$ PROMPT>as-put-scaling-policy MyScaleUpPolicy --
auto-scaling-group WidgetsIncScalingGroup
--adjustment=1 –type ChangeInCapacity

58. Give the metric alarm a name
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80 --alarm-
actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

59. Specify the comparison operator
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm --
comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80 --alarm-
actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

60. Specify the evaluation period
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80 --alarm-
actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

61. Specify the metric name
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2"
--period 600 --statistic Average --threshold
80 --alarm-actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

62. Specify the period to take an average over
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2"
--period 600 --statistic Average
--threshold 80 --alarm-actions POLICY-
ARN_from_previous_step --dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

63. Specify the % threshold to scale on
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80
--alarm-actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

64. Associate with a policy
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80
--alarm-actions <POLICY-
ARN_from_previous_step> --dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

65. Specify the auto scaling group
$ PROMPT>mon-put-metric-alarm MyHighCPUAlarm
--comparison-operator GreaterThanThreshold
--evaluation-periods 1 --metric-name
CPUUtilization --namespace "AWS/EC2" --period
600 --statistic Average --threshold 80 --alarm-
actions POLICY-ARN_from_previous_step
--dimensions
"AutoScalingGroupName=WidgetsIncScalingGro
up"

66. What if you need to scale on a
metric not available in
CloudWatch?

67. Custom CloudWatch metrics
Use CloudWatch to store and provide
analysis on arbitrary metrics

68. Push custom metric into CloudWatch
$ mon-put-data -namespace "System/Linux" -metric-
name Memory -dimensions "Host=host1" -value 60

69. Specify a name space
$ mon-put-data -namespace "System/Linux"
-metric-name Memory -dimensions "Host=host1"
-value 60

70. Specify a unique name for the metric
$ mon-put-data -namespace "System/Linux"
-metric-name Memory -dimensions "Host=host1" -
value 60

71. Specify the dimensions of the metric
$ mon-put-data -namespace "System/Linux" -metric-
name Memory -dimensions "Host=host1" -value
60

72. Specify the value to push
$ mon-put-data -namespace "System/Linux" -metric-
name Memory -dimensions "Host=host1" -value 60

73. Graph custom metric data

74. Use custom metric in alarm defintion
$ PROMPT>mon-put-metric-alarm
MyHighMemoryAlarm --comparison-operator
GreaterThanThreshold --evaluation-periods 1 --
metric-name Memory --namespace
”System/Linunx" --period 600 --statistic
Average --threshold 80 --alarm-actions <POLICY-
ARN> --dimensions
"AutoScalingGroupName=WidgetsIncScalingGroup"

75. How do I manage session
state when using auto
scaling?

76. Session affinity
Ensuring that users interact
with the same web server
throughout their session

77. Session affinity
ELB or application generated session tokens

78. Session affinity
ELB or application generated session tokens
Session state contained within web server tier

79. What happens when I use
HTTPS?

80. Session affinity over HTTPS
Terminate session at the ELB

81. Session affinity over HTTPS
Terminate session at the ELB
Re-encrypt to back-end web servers if required

82. What happens during scale-
down events?

83. Scale-down All user sessions
existing within the
web server are
lost

84. Users needs to re-
establish their
session

85. Stateless web tier
Move the state out of the
auto scaling tier

86. Sessions
stored in
Elasticache

87. No sessions are
lost during scale
down operation

88. Apache Tomcat

89. Apache Tomcat
Install memcached-session-manager on each tomcat
server

90. Apache Tomcat
Install memcached-session-manager on each tomcat
server
Configure memcached to store copy of state in
Elasticache

91. Apache Tomcat
Install memcached-session-manager on each tomcat
server
Configure memcached to store copy of state in
Elasticache
If user session is not available from local cache, request
it from Elasticache

92. Apache Tomcat
Install memcached-session-manager on each tomcat
server
Configure memcached to store copy of state in
Elasticache
If user session is not available from local cache, request
it from Elasticache
Use with or without session affinity

93. Deploying
Resources
Techniques to increase
efficiency and productivity

94. You probably started with…

95. And then moved to …

96. You might even be using …

97. Room for improvement?

98. You bet!

99. CloudFormation
Allows you to predictably create and
manage a collection of AWS
resources via text-based templates

100. Cloud formation templates

101. CloudFormation
Define application stack via simple text file

102. CloudFormation
Define application stack via simple text file
Use stack parameters to customise

103. CloudFormation
Define application stack via simple text file
Use stack parameters to customise
Deploy new stacks/update existing stacks

104. CloudFormation
Define application stack via simple text file
Use stack parameters to customise
Deploy new stacks/update existing stacks
Create templates from existing resources with
CloudFormer

105. Define a load balancer

106. Specify AZs

107. Define cookie policy

108. Define listener ports

109. Define health check

110. Demonstration
Deploying AWS VPC including
subnets, ELB and web server
auto scaling group

112. Demonstration
Using CloudFormer to
generate a cloud formation
template

113. Log onto management console

114. Select CloudFormation stack

115. Specify parameters

116. Create stack

117. Specify parameters

118. Select region

119. Filter resources

120. Select DNS records

121. Select network resources

122. Select remaining resources
Compute

123. Select remaining resources
Compute
Auto scaling configuration

124. Select remaining resources
Compute
Auto scaling configuration
Storage

125. Select remaining resources
Compute
Auto scaling configuration
Storage
Security

126. Select remaining resources
Compute
Auto scaling configuration
Storage
Security
Other – SQS/SimpleDB

127. Select remaining resources
• Compute
• Auto scaling configuration
• Storage
• Security
• Other – SQS/SimpleDB
• Operational – Auto scaling triggers

128. Save template

129. Access to
Resources
Securely providing access to
AWS resources

130. Secure access from EC2

131. Providing
access to
DynamoDB

132. Option #1
Bake in AWS credentials

133. Bake in AWS credentials
• AWS credentials provide full access to all your AWS
resources

134. Bake in AWS credentials
• AWS credentials provide full access to all your AWS
resources
• If the AMI or EC2 instance is compromised then the
credentials can be used to access all your resources

135. Bake in AWS credentials
• AWS credentials provide full access to all your AWS
resources
• If the AMI or EC2 instance is compromised then the
credentials can be used to access all your resources
• Rotating credentials requires rebuilding AMI

136. Need to improve security
and manageability

137. Identity & Access
Management
Securely control user access
to AWS resources

138. IAM Role based access control

139. Option #2
Bake in IAM credentials

140. Bake in IAM credentials
• Reduced the impact in the event that instance or AMI is
compromised

141. Bake in IAM credentials
• Reduced the impact in the event that instance or AMI is
compromised
• Rotating credentials still requires rebuilding AMI

142. Need to improve
manageability

143. Option #3
Pass in IAM credentials at boot

144. Bake in IAM credentials
• Pass in IAM credentials as user-data

145. Bake in IAM credentials
• Pass in IAM credentials as user-data
• Rotating credentials does not require rebuilding an AMI

146. Bake in IAM credentials
• Pass in IAM credentials as user-data
• Rotating credentials does not require rebuilding an AMI
• We still need a way to rotate credentials if an instance is
compromised

147. Bake in IAM credentials
• Pass in IAM credentials as user-data
• Rotating credentials does not require rebuilding an AMI
• We still need a way to rotate credentials if an instance is
compromised
• IAM credentials available to any local user with access to
http://169.254.169.254

148. Option #4
Two stage look-up of IAM credentials

149. Two stage look-up of IAM credentials
• Pass in a time-based pre-authenticated URL to IAM
credentials stored in S3

150. Two stage look-up of IAM credentials
• Pass in a time-based pre-authenticated URL to IAM
credentials stored in S3
• Download credentials from S3

151. Two stage look-up of IAM credentials
• Pass in a time-based pre-authenticated URL to IAM
credentials stored in S3
• Download credentials from S3
• If instance is compromised after URL expires then we
expire the IAM credentials on S3

152. Two stage look-up of IAM credentials
• Pass in a time-based pre-authenticated URL to IAM
credentials stored in S3
• Download credentials from S3
• If instance is compromised after URL expires then we
expire the IAM credentials on S3
• Improved security but complicates auto scaling

153. Option #5
Add IAM to config file management

154. Add IAM to config file management
• Register instance with config management tool on boot
e.g. puppet/chef

155. Add IAM to config file management
• Register instance with config management tool on boot
e.g. puppet/chef
• Deploy latest valid credentials

156. Add IAM to config file management
• Register instance with config management tool on boot
e.g. puppet/chef
• Deploy latest valid credentials
• In the event that you need to rotate IAM credentials push
the latest set to to each instance

157. Secure access from mobile
devices

158. Option #1
Create an IAM user for each connecting
device

159. This isn’t
going to scale

160. IAM temporary
security credentials
Time-based access to AWS
resources for IAM users

161. IAM temporary security credentials

162. IAM temporary security credentials
• Create a small number of IAM users for mobile devices

163. IAM temporary security credentials
• Create a small number of IAM users for mobile devices
• Device user authenticates via session proxy

164. IAM temporary security credentials
• Create a small number of IAM users for mobile devices
• Device user authenticates via session proxy
• Session proxy requests token from AWS security token
service

165. IAM temporary security credentials
• Create a small number of IAM users for mobile devices
• Device user authenticates via session proxy
• Session proxy requests token from AWS security token
service
• Token passed to device

166. Tracking &
identification of
resources

167. How can I keep track of
my AWS resources?

168. Create order with tags

169. Create order with tags

170. View Name tags for EC2 resources

171. Filter based on tags

172. Tag instances based on use

173. Access Tags via the CLI
$ PROMPT>ec2-create-tags ami-1a2b3c4di i-6f5d4e3a
–tag webserver –tag stack=production
TAG ami-1a2b3c4di image webserver
TAG ami-1a2b3c4di image stack production
TAG i-6f5d4e3a image webserver
TAG i-6f5d4e3a image stack production

174. Tag auto scaling groups
$ PROMPT>as-describe-auto-scaling-groups MyTagASG
AUTO-SCALING-GROUP MyTagLC us-east-1a 1 10 5
INSTANCE INSTANCE-ID AVAILABILITY-ZONE STATE STATUS LAUNCH-CONFIG
TAG RESOURCE-ID RESOURCE-TYPE KEY VALUE PROPOGATE-AT-LAUNCH TAG
MyTagASG auto-scaling-group version 1.0 true

175. Tag EBS volumes

176. CloudFormation & tags

177. Tag many types of resource
• Image • VPC
• Instance • Subnet
• Security group • Internet gateway
• EBS volume • VPN connection
• EBS snap-shot • Virtual private gateway
• Reserved instance • Customer gateway
• Spot instance request • Route table
• Network ACL

178. Scaling Databases

179. NoSQL Vs relational databases

180. Managed database services
Amazon
Relational
Database
(Amazon RDS)

181. Play Video
• http://www.youtube.com/watch?v=oz-7wJJ9HZ0

182. Step #1: Availability
Replication between master and slave
database servers

183. Synchronous
replication

184. Step #2: Optimisation
Apply traditional DB best practices

185. Optimisation
• Index tables

186. Optimisation
• Index tables
• Write efficient queries

187. Optimisation
• Index tables
• Write efficient queries
• Archive old data when not required

188. Step #3: Scale-up
Use larger EC2 instance types

190. Step #4: Caching
Store common queries in a memory cache
such as ElastiCache

191. Elasticache

192. Form SQL statement

193. Return result if it is in the cache

194. Else query DB and update cache

195. Step 5: Scale-out
Use read-replicas

196. Read replicas

197. Read replicas
• Modify application to use a connection pool

198. Read replicas
• Modify application to use a connection pool
• Determine which reads need to be synchronous

199. Read replicas
• Modify application to use a connection pool
• Determine which reads need to be synchronous
• Determine which reads can be asynchronous

200. Step 6: Scale-out
Shard database

201. Shard database

202. Sharding
• Choose a suitable primary key to shard on

203. Sharding
• Choose a suitable primary key to shard on
• Split database across multiple database servers

204. Sharding
• Choose a suitable primary key to shard on
• Split database across multiple database servers
• Implement two-stage shard access at application tier
• Stage #1 – What shard modulus does customer X use
• Stage #2 - Direct query at relevant database

205. Thank You!