Amazon Relational Database Service (Amazon RDS) simplifies setup, operation, and management of databases in the cloud. In this session, we will explore Amazon RDS features and best practices that offer graceful migration, high performance, elastic scaling, and high availability for Oracle databases. You will also learn from the Chief Architect for Intuit’s Small Business Division how the QuickBooks Online team is using Amazon RDS for Oracle to scale the world's largest online accounting platform.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Ru nni ng Or ac l e Datab ase s o n A m azo n RDS
M i c h a e l B a r r a s , S r . D a t a b a s e E n g i n e e r , A m a z o n R D S
S i d d h a r t h R a m , C h i e f A r c h i t e c t — S m a l l B u s i n e s s D i v i s i o n , I n t u i t
D A T 3 1 3
N o v e m b e r 3 0 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AGENDA
• Amazon RDS Overview
• Intuit and RDS
Siddharth Ram, Chief Architect—Small Business Division, Intuit
• RDS for Oracle Deep Dive
• New features
• Scalability and administration
• High availability
• Security and compliance

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to Administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
• Managed infrastructure
• Available in minutes
• Manage parameters and options
across instances
• Web console, CLI, SDK, AWS
CloudFormation templates
AMAZON RELATIONAL DATABASE SERVICE

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
AMAZON RELATIONAL DATABASE SERVICE
Storage
SSD, Magnetic
Compute
CPU, RAM, network

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
• Automatic host replacement
• Managed high availability
• Managed backups
• Durable storage—Amazon EBS
and Amazon S3
AMAZON RELATIONAL DATABASE SERVICE

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
• VPC by default
• VPN/Direct Connect to
on-premises
• Encryption at rest—KMS, TDE,
HSM
• Encryption in transit
• Strong account controls
AMAZON RELATIONAL DATABASE SERVICE

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
• Pay for what you use
• Trade CAPEX for OPEX
• Scale down when appropriate
• Reserved instances
AMAZON RELATIONAL DATABASE SERVICE

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Easy to administer
Scalable and fast
Available and durable
Secure
Inexpensive
Oracle licensing
License included (LI)
• License included in instance price
• 11.2.0.4 SE1
• 12.1.0.2 SE2
Bring your own license (BYOL)
• Use existing licenses/agreements
• Manage your own licenses and
support
• 11.2.0.4 EE, SE, SE1
• 12.1.0.2 EE, SE2
AMAZON RELATIONAL DATABASE SERVICE

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
On-Premises EC2 RDS
AMAZON RELATIONAL DATABASE SERVICE
App optimization
Scaling
High availability
Database backups
DB s/w patching
DB s/w install
OS patching
OS installation
Server maintenance
Hardware lifecycle
Power/HVAC/Network
App optimization
Scaling
High availability
Database backups
DB s/w patching
DB s/w install
OS patching
OS installation
Server maintenance
Hardware lifecycle
Power/HVAC/Network
App optimization
Scaling
High availability
Database backups
DB s/w patching
DB s/w install
OS patching
OS installation
Server maintenance
Hardware lifecycle
Power/HVAC/Network
Youmanage
AWSmanages

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Siddharth Ram, Chief Architect, Small Business/Self-Employed, Intuit
INTUIT & RDS

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ABOUT: INTUIT

13. RECOGNIZED AS ONE OF THE WORLD’S
LEADING COMPANIES:
2004 - 2017
Most Admired:
Software Industry
2002 - 2017
100 Best Companies
to Work For
2013
Most Innovative
Companies

14. ALL OF INTUIT’S PRODUCTS
HAVE A PRESENCE IN AWS

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
INTUIT’S AWS JOURNEY
”Intuit plans to move all its
products to AWS.”
– Tayloe Stansbury, Intuit CTO

17. Speed and agility
Cloud elasticity
gives us the ability
to move quickly
AWS is a ’how’ for our goal of velocity
Global footprint
Our customers are
everywhere. We need
to be where they are,
for performance and
compliance
Cost
Mature cloud
hosting can yield
cost benefits
1 2 3
INTUIT’S AWS JOURNEY

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRINCIPLE-BASED MIGRATION

19. Complexity
should be useful
Useful is more
important than cool
(Larry Wall)
(Siddharth Ram)

20. HighLow
Not Useful Useful
Kill this
Usefulness
Tolerate this Encourage this
Simplify this

21. Scaling Philosophy

22. Horizontal duplication
Services
Monolith Read replicas
Sharding
Services
Strategy
Ideal State

23. WHY RDS?
• Administration out of the Box
• Patching, Backups
• High Availability
• Read Replicas*

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Current QuickBooks platform in AWS

25. KEY DECISION POINTS
Cloud Agnostic vs AWS native
‘Lift & Shift’ Vs ‘Refactor and Shift’

26. LIFT AND SHIFT
Primary data storage is RDS Oracle (continuance)
Also used: Cassandra, RDS MySQL
Standard AWS Tech: ELB’s, EC2, MNAT, CloudWatch…

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
QUICKBOOKS & RDS

28. Characteristic Strategy Units
Scaling Sharding 6-12 TB per cluster
Capacity IOPS Provisioned IOPS
High Availability AZ Failure protection Multi-AZ deployment &
replication
Account Compromise Cross-Account RDS
Snapshot backup
Per cluster
Security Transparent Data
Encryption (TDE) for
data at rest

29. Characteristic Strategy Units
Backups Database backups to
allow point-in-time
recovery
Automated RDS Snapshots
Monitoring Database Monitoring AWS CloudWatch + cron jobs to
push custom CloudWatch metrics
Alerts Database Alerts AWS CloudWatch Alerts via SNS
Notification + cron jobs to send
SNS
Replication 3 way multi-master
replication
Data Migration Initial Data Migration from
Intuit DC to AWS
Golden Gate Sync

30. RDS Oracle performs equal to or better than our DC
Scalability is significantly better
The RDS team is incredibly responsive to problems
Usage of RDS has increased our velocity significantly
KEY TAKEAWAYS

31. INTERESTING MOMENTS
How to handle DB sizes > 6TB
Ability to tune kernel parameters in RDS
Key management and encryption decisions
API Rate limiting ceiling

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NEW FEATURES

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RECENT NEW FEATURES
• Deprecation of 11.2.0.2, 11.2.0.3, 12.1.0.1
• Huge pages
• Snapshot upgrade
• R4 instance class
• Start/stop (all engines)
• Flexible Reserved Instances (all engines)
• Storage—up to 16 TB, faster scaling (all engines)

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RECENT NEW/UPDATED OPTIONS
• Spatial (requires EE + Spatial and Graph Option license)
• Locator
• Multimedia
• Oracle Application Express—now supports 5.0.4, 5.1.2 (4.1.1, 4.2.6)
• Oracle SQLTXPLAIN (SQLT)
• Oracle Enterprise Manager Agent—now supports OMS 13cR1, 13cR2

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SCALABILITY AND ADMINISTRATION

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SCALING RDS
Compute Storage
• Change CPU/Memory/Networking
via instance class
• Scale up or down as needed
• Brief outage
• Consider new instance classes
• Change
• Size (increase only)
• Type
• IOPS
• Online (with some performance
impact)

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SCALING RDS
Year 1 Year 2 Year 3 Year 4 Year 5
On-Premises Actual Workload RDS Oracle

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
HUGE PAGES
• Improved memory and CPU utilization
• Enable via RDS Parameter Group
1. Disable Automatic Memory Management
2. Enable Automatic Shared Memory Management
3. Set use_large_pages to “ONLY”
• RDS automation takes care of kernel parameters
• Will be enabled by default on future instance classes (>100 GiB)
• Improved memory utilization
• Improved CPU utilization

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ADMINISTERING RDS ORACLE
On-Premises Amazon RDS
ALTER SYSTEM…; RDS Parameter Groups
Install features RDS Option Groups
ALTER DATABASE…;
GRANT…;
exec rdsadmin.rdsadmin_util…;
grant…;
Backups/RMAN RDS Snapshots
OEM, tools OEM, tools

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
HIGH AVAILABILITY

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS GLOBAL INFRASTRUCTURE

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
REGIONS AND AVAILABILITY ZONES
Availability
Zone B
Region 1
Availability
Zone C
Availability
Zone A
Availability
Zone B
Region 2
Availability
Zone C
Availability
Zone A
Internet

43. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RDS SINGLE-AZ
Availability Zone A
RDS primary
Availability Zone B Availability Zone C
Application Application Application

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RDS MULTI-AZ
Availability Zone A
RDS primary
Availability Zone B
RDS secondary
Availability Zone C
Application Application Application
DNS
CNAME

45. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RDS MULTI-AZ FAILOVER
Availability Zone A
RDS primary
Availability Zone B
RDS secondary
Availability Zone C
Application Application Application
DNS
CNAME

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RDS MULTI-AZ FAILOVER
Availability Zone A
RDS
secondary
Availability Zone B
RDS primary
Availability Zone C
Application Application Application
DNS
CNAME

47. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RDS MULTI-AZ FAILOVER
DNS
CNAME
Availability Zone A Availability Zone B
RDS Primary
Availability Zone C
Application Application Application

48. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
MULTI-AZ FAILOVER
UP Identify failure Crash recovery UP
DNS propagation
Typical failover time 1–2 minutest0 tN

49. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SECURITY AND COMPLIANCE

50. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ENCRYPTION AT REST
Oracle Transparent
Data Encryption (TDE)
Oracle TDE with
Hardware Security
Module (TDE_HSM)
RDS Storage
Encryption
EE + ASO EE + ASO All editions/engines
• RDS manages wallet
and keys
• RDS manages wallet
• Customer manages
HSM device
• EBS volume
encryption
• Completely
transparent to
host/database
• Customer manages
keys with Amazon
KMS

51. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ENCRYPTION IN TRANSIT
SSL Option Native Network Encryption (NNE)
All Oracle editions (no longer requires ASO as of 11.2)
• RDS manages wallets, certificates
• Customer imports RDS root
certificates into client wallets
• Separate TCPS listener port
• RDS manages sqlnet.ora
• Choose algorithms and level
(requested/required/allowed)

52. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DATABASE SECURITY
RDS Manages Customer Manages
• Physical infrastructure controls
• Host access
• Operating System
version/patches
• HOW database patches are
applied
• Database users and privileges
• Access to data (Virtual Private
Database, Oracle Label Security)
• Database Audit
• Network controls (VPC Security
Groups, Network ACL)
• WHEN database patches are
applied

53. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NETWORK SECURITY

54. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AUDITING
AWS API Auditing (AWS CloudTrail) Database Auditing (AUDIT_TRAIL)
• Audit user API calls (e.g. Create-,
Modify-, DeleteDBInstance)
• Integrates with AWS CloudWatch
Logs and Events
• Stored in Amazon S3
• Audit in-database operations
(AUDIT/NOAUDIT)
• Retention managed by customer
• Stored on RDS instance (DB, OS,
XML)
• DBMS_AUDIT_MGMT
• Location
• Retention

55. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Assurance programs for finance,
health care, government, and more
• Shared responsibility model
• AWS à Security of the cloud
• Customer à Security in the cloud
• https://aws.amazon.com/compliance/
COMPLIANCE

56. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AMAZON RDS RECAP
• Simplify infrastructure management
• Allow DBAs to focus on high-value tasks
• Automation and standardization let you
• Iterate fast and deploy quickly
• Build highly-available, reliable applications
• Run securely

57. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RESOURCES/WHITEPAPERS
• Amazon RDS
https://aws.amazon.com/rds
• Amazon RDS User Guide
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide
• AWS Free Tier
https://aws.amazon.com/free
• Oracle whitepapers and best practices
https://aws.amazon.com/oracle/resources

58. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!