More customers are moving their Microsoft applications to AWS to become more agile, improve their security posture, and dramatically lower costs. Attend this session to learn how to architect fully available and scalable Microsoft environments on AWS. Find out how Microsoft solutions can leverage various AWS services to achieve more resiliency, reduce complexity, improve security, and increase scalability. We discuss how you can leverage AWS services to meet compliance and governance requirements for your Microsoft applications. We introduce DevOps concepts that you can deploy to help implement automation and repeatability. Learn how to plan authentication and authorization for hybrid cloud scenarios between your AWS and on-premises environments. Learn about common architecture patterns for network design, Active Directory, and business productivity solutions such as Dynamics AX, CRM, and SharePoint, and common scenarios for custom .NET and .NET Core with SQL deployments.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Simplifying Microsoft Architectures
with AWS
Z l a t a n D z i n i c — S o l u t i o n A r c h i t e c t , A W S
N o v e m b e r 2 9 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Challenge
• Can AWS simplify the infrastructure environment that I already know well?
• Active Directory?
• Corporate Applications
• O365
• Exchange
• SharePoint
• Dynamics
• System Center
• SQL?
• How do I deploy all this?
• Any good migration suggestion for simplifying my Microsoft workloads?
• Can AWS help me simplify my legacy .NET Architecture?
• I want to innovate!
• I want to use the latest architectural concepts and platforms!
• I want an efficient, fully supported CD/CI!
• Can AWS make managing my Windows workloads simpler?

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify Infrastructure Environment

4. Innovation: Windows on AWS

5. VPC Design Patterns: Single VPN – Multi-VPC
Shared Services VPC
Transit VPC

6. Private subnetPrivate subnet
Availability Zone 2
Corporate Network
San Francisco
DC1
VPN/Direct
Connect
Availability Zone 1
DC3
Cost 10
Existing AD domain extended to AWS, new Active
Directory sites configured in each AZ, domain
controllers on EC2 Windows servers, site-link costs
correctly configured, and try next-closest site
configured
DC4
AD Domain: abc.com
AD Replication
AD Site: AwsEastAZ1
AD Domain: abc.com
AD Site: AwsEastAZ2
Cost 50
New York
AD Domain: abc.com
AD Site: SanFran
DC2
AD Domain: abc.com
AD Site: NewYork
Active Directory Pattern: Extending AD Domain to AWS

7. Private subnetPrivate subnet
Availability Zone 2
Corporate Network
Availability Zone 1
Federated
Trust
Corporate Network
San Francisco
DC1
Cost 50
New York
AD Domain: abc.com
AD Site: SanFran
DC2
AD Domain: abc.com
AD Site: NewYork
Internet
ADFS2
ADFS1
AD Domain:
abc.aws.com
Identities mastered on-premises, Federated Trust
(ADFS) configured between on-premises AD and
domain controllers running on EC2 Windows
servers
DC3DC1 or
ADFS
1
AD Domain:
abc.aws.com
DC3DC2 or
ADFS
2
Active Directory Pattern: Federated Trust

8. Private subnetPrivate subnet
Availability Zone 2
Corporate Network
San Francisco
DC1
VPN / Direct
Connect
Availability Zone 1
DC3
Identities mastered on-premises, Forest Trusts
configured between on-premises AD and AWS
Directory Services for Managed Active Directory
DC4
AD Domain:
abc.aws.com
AD
Authentication
AD Domain: abc.aws.com
Cost 50
New York
AD Domain: abc.com
AD Site: SanFran
DC2
AD Domain: abc.com
AD Site: NewYork
AD Trust
DC1 or DC3DC2 or
Active Directory Pattern: Forest Trusts

9. Office 365 with AWS Microsoft Active Directory
Credentials

10. Configuration
• Add two containers to AWS
Microsoft AD for use by AD FS
• Install AD FS
• Integrate AD FS with Azure AD
• Synchronize users from AWS
Microsoft AD to Azure AD with
Azure AD Connect
• Sign in to Office 365 using
your Microsoft AD identities

11. Options for Deploying SQL Server on AWS
Amazon RDS for SQL Server SQL Server on Amazon EC2
Customer-managedAWS-managed
Power, HVAC, net
OS install/maintenance
OS patching
DBMS install/maintenance
DBMS patching
Database backups
High availability
Scaling
Power, HVAC, net
OS install/maintenance
OS patching
DBMS install/maintenance
DBMS patching
Database backups
High availability
Scaling
• Consider RDS first
• Focus on business
value tasks
• High-level tuning
asks
• Schema optimization
• No in-house
database expertise
• Need full control over
DB instance
• Backups
• Replication
• Clustering
• Options that are not
available in RDS

12. Multi-AZ AlwaysOn Availability Group

13. Multi-Region AlwaysOn Availability Group

14. Failover Cluster Instance
SIOS DataKeeper
Cluster Edition
Windows Server 2016
Storage Replica

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify Infrastructure Deployment

17. Template CloudFormation Stack
JSON/YAML formatted file
Parameter definition
Resource creation
Configuration actions
Configured AWS resources
Comprehensive service support
Service event aware
Customizable
Framework
Stack creation
Stack updates
Error detection and rollback
CloudFormation—Components & Technology

18. How CloudFormation Works

19. AWS Quick Starts

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify Migration

21. Migration Tools From AWS & Partners
Data transfer
AWS Storage and
File Gateway
Amazon S3
Transfer
Acceleration
AWS Direct
Connect
Amazon Kinesis
Firehose
AWS Snowball
and Snowmobile
AWS Database
Migration Service
Server and database
migrations
AWS Server
Migration Service
Application
monitoring/profiling
Amazon
CloudWatch
AWS Config
Discovery and planning
AWS Application
Discovery Service

22. Example Migration Sequence
• Account Structure
• Network/VPC
• Security
• Active Directory
Step 1. Landing Zone
On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
VPN /
DirectConnect
Security Prod
Root
Dev
Private Subnet, 10.0.0.64/18
10.0.0.0/16
Public Subnet, 10.0.0.0/18
On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
VPN /
DirectConnect
AWS Shield AWS WAF
CloudTrail
CloudWatch
VPC Flow Logs
Systems Mgr
Inspector
Config
Security Group
Security Group
Security Group
Security Prod
Root
Dev
10.0.0.0/16
Private Subnet, 10.0.0.64/18
Public Subnet, 10.0.0.0/18
On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
or
Active Directory
on EC2
VPN /
DirectConnect
AWS Shield AWS WAF
AWS Managed
Active Directory
CloudTrail
CloudWatch
VPC Flow Logs
Systems Mgr
Inspector
Config
Security Prod
Root
Dev

23. Example Migration Sequence
Step 2. Database Tier
• Build out your DBMS
infrastructure
• Choose a database
replication and
synchronization strategy
• One-step migration
(suitable for smaller
databases and good
connectivity)
• Full-Diff migration (suitable
for larger databases and
good connectivity)
• Zero-downtime migration
(software tool-based
solution)
On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
or
Active Directory
on EC2
or
SQL Server
on EC2
SQL Server
on AWS RDS
VPN /
DirectConnect
Security Prod
Root
Dev
AWS Shield AWS WAF
AWS Managed
Active Directory
CloudTrail
CloudWatch
VPC Flow Logs
Systems Mgr
Inspector
Config

24. Example Migration Sequence
Step 3. Server / App Migration
• Perform extensive testing at
this stage
• Choose a server/app
migration strategy
• Manual migration (build new
servers—migrate app)
• Tool based migration (block-
level migration and
synchronization)
• Always maintain rollback
capability On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
or
Active Directory
on EC2
or
SQL Server
on EC2
SQL Server
on AWS RDS
VPN /
DirectConnect
App Server App Server
Web Server Web Server
Security Prod
Root
Dev
AWS Shield AWS WAF
AWS Managed
Active Directory
CloudTrail
CloudWatch
VPC Flow Logs
Systems Mgr
Inspector
Config

25. Example Migration Sequence
Step 4. Production Cutover
• Plan your final cutoff carefully
• Ensure any final replication
and/or synchronization
occurs
• Test your cutover
mechanism (DNS TTL, etc.)
• Maintain rollback after cutoff
if possible
On-Premises Data Center
Domain
Controller
Amazon
Route 53
Domain
Controller
SQL
Server
SQL
Server
App
Server
App
Server
Web
Server
Web
Server
or
Active Directory
on EC2
or
SQL Server
on EC2
SQL Server
on AWS RDS
VPN /
DirectConnect
App Server App Server
Web Server Web Server
Security Prod
Root
Dev
AWS Shield AWS WAF
AWS Managed
Active Directory
CloudTrail
CloudWatch
VPC Flow Logs
Systems Mgr
Inspector
Config

26. AWS Server Migration Service Overview
• Support VMware virtual machine
migration (support for additional
hypervisors coming soon)
• Agentless VM migration
• Capture incremental change made
to on-premises VMs and
automatically transfer to AWS
• Migrate a group of VMs
simultaneously and orchestrate
multiple migrations
• AWS Management Console and
API/CLI access
Source: On-premises server AWS Server Migration Service Target: Amazon Machine
Image

27. AWS Migration Hub
Discover Migrate Track
Discover servers in
existing data centers
(optional)
Group servers as
applications
Track application
migration status
Migrate using tools
outside Migration Hub
• Better understand your application portfolio
• Streamline application portfolio migration planning and tracking
• Track migration progress from multiple tools in one place
• Reduce time spent determining current status and next steps

28. Tracking Status Made Easy

29. Migration via AlwaysOn Availability Groups

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify .NET Development

31. Running AWS Toolkit for Visual Studio

32. AWS Code Services
Source Build Test Production
Third-party
tooling
Software Release Steps:
AWS CodeCommit AWS CodeBuild AWS CodeDeploy
AWS CodePipeline

33. CI/CD Pipeline
Continuous Integration / Continuous Deployment

34. AWS CodeStar

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify .NET Architecture

36. Continuous
scaling
No servers
to manage
Never pay for
idle—no cold
servers
AWS Lambda
With AWS Lambda, you are charged for every 100ms your code executes
and the number of times your code is triggered.
Java Python .NET Node.js

37. AWS Lambda: Run Code in Response to Events
FUNCTION
Changes
in data state
Requests
to endpoints
Changes in
resource state
C#
NodeJS
Python
Java
EVENT SOURCE
2 + 2 = 4

38. Amazon S3 Amazon
DynamoDB
Amazon
Kinesis
AWS
CloudFormation
AWS CloudTrail Amazon
CloudWatch
Amazon
Cognito
Amazon SNSAmazon
SES
Cron events
DATA STORES ENDPOINTS
DEVELOPMENT AND MANAGEMENT TOOLS EVENT/MESSAGE SERVICES
Example of Services Used for Serverless Architecture
… and a few more, with more on the way!
AWS
CodeCommit
Amazon
API Gateway
Amazon
Alexa
AWS IoT AWS Step
Functions

39. • Stateless
• Highly scalable, self-healing,
available
• Containerized microservices
• AWS serverless platform
• Lambda
• Step Functions
• API Gateway
• DynamoDB
• SNS
• SQS
• Dynamic/managed allocation of
resources
• Route 53 - DNS
Serverless Architecture

40. CloudFormation Template
AWSTemplateFormatVersion: '2010-09-09'
Resources:
GetHtmlFunctionGetHtmlPermissionProd:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/Prod/ANY/*
ServerlessRestApiProdStage:
Type: AWS::ApiGateway::Stage
Properties:
DeploymentId:
Ref: ServerlessRestApiDeployment
RestApiId:
Ref: ServerlessRestApi
StageName: Prod
ListTable:
Type: AWS::DynamoDB::Table
Properties:
ProvisionedThroughput:
WriteCapacityUnits: 5
ReadCapacityUnits: 5
AttributeDefinitions:
- AttributeName: id
AttributeType: S
KeySchema:
- KeyType: HASH
AttributeName: id
GetHtmlFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.gethtml
Code:
S3Bucket: flourish-demo-bucket
S3Key: todo_list.zip
Role:
Fn::GetAtt:
- GetHtmlFunctionRole
- Arn
Runtime: nodejs4.3
GetHtmlFunctionRole:
Type: AWS::IAM::Role
Properties:
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
ServerlessRestApiDeployment:
Type: AWS::ApiGateway::Deployment
Properties:
RestApiId:
Ref: ServerlessRestApi
Description: 'RestApi deployment id: 127e3fb91142ab1ddc5f5446adb094442581a90d'
StageName: Stage
GetHtmlFunctionGetHtmlPermissionTest:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/*/ANY/*
ServerlessRestApi:
Type: AWS::ApiGateway::RestApi
Properties:
Body:
info:
version: '1.0'
title:
Ref: AWS::StackName
paths:
"/{proxy+}":
x-amazon-apigateway-any-method:
x-amazon-apigateway-integration:
httpMethod: ANY
type: aws_proxy
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-
31/functions/${GetHtmlFunction.Arn}/invocations
responses: {}
swagger: '2.0'

41. CloudFormation Template
AWSTemplateFormatVersion: '2010-09-09'
Resources:
GetHtmlFunctionGetHtmlPermissionProd:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/Prod/ANY/*
ServerlessRestApiProdStage:
Type: AWS::ApiGateway::Stage
Properties:
DeploymentId:
Ref: ServerlessRestApiDeployment
RestApiId:
Ref: ServerlessRestApi
StageName: Prod
ListTable:
Type: AWS::DynamoDB::Table
Properties:
ProvisionedThroughput:
WriteCapacityUnits: 5
ReadCapacityUnits: 5
AttributeDefinitions:
- AttributeName: id
AttributeType: S
KeySchema:
- KeyType: HASH
AttributeName: id
GetHtmlFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.gethtml
Code:
S3Bucket: flourish-demo-bucket
S3Key: todo_list.zip
Role:
Fn::GetAtt:
- GetHtmlFunctionRole
- Arn
Runtime: nodejs4.3
GetHtmlFunctionRole:
Type: AWS::IAM::Role
Properties:
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
ServerlessRestApiDeployment:
Type: AWS::ApiGateway::Deployment
Properties:
RestApiId:
Ref: ServerlessRestApi
Description: 'RestApi deployment id: 127e3fb91142ab1ddc5f5446adb094442581a90d'
StageName: Stage
GetHtmlFunctionGetHtmlPermissionTest:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/*/ANY/*
ServerlessRestApi:
Type: AWS::ApiGateway::RestApi
Properties:
Body:
info:
version: '1.0'
title:
Ref: AWS::StackName
paths:
"/{proxy+}":
x-amazon-apigateway-any-method:
x-amazon-apigateway-integration:
httpMethod: ANY
type: aws_proxy
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-
31/functions/${GetHtmlFunction.Arn}/invocations
responses: {}
swagger: '2.0'

42. AWS Serverless Application Model (SAM)
CloudFormation extension optimized for
serverless
New serverless resource types: functions, APIs,
and tables
Supports anything CloudFormation supports
Open specification (Apache 2.0)
https://github.com/awslabs/serverless-application-model

43. SAM Template
AWSTemplateFormatVersion: '2010-09-09’
Transform: AWS::Serverless-2016-10-31
Resources:
GetHtmlFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://sam-demo-bucket/todo_list.zip
Handler: index.gethtml
Runtime: nodejs4.3
Policies: AmazonDynamoDBReadOnlyAccess
Events:
GetHtml:
Type: Api
Properties:
Path: /{proxy+}
Method: ANY
ListTable:
Type: AWS::Serverless::SimpleTable
Tells CloudFormation that this is a
SAM template it needs to “transform”
Creates a Lambda function with the
referenced managed IAM policy,
runtime, code at the referenced zip
location, and handler as defined.
Also creates an API Gateway and
takes care of all necessary mapping/
permissions
Creates a DynamoDB table with five
read and write units

44. Source
Source
CodeCommit
MyApplication
An Example Minimal Pipeline
Build
test-build-source
CodeBuild
Deploy Testing
create-changeset
AWS
CloudFormation
execute-changeset
AWS
CloudFormation
Run-stubs
AWS Lambda
Deploy Staging
create-changeset
AWS
CloudFormation
execute-changeset
AWS
CloudFormation
Run-API-test
Runscope
QA-Sign-off
Manual Approval
Review
Deploy Prod
create-changeset
AWS
CloudFormation
execute-changeset
AWS
CloudFormation
Post-Deploy-Slack
AWS Lambda
This pipeline:
• Five stages
• Builds code artifact
• Three deployed to “environments”
• Uses CloudFormation to deploy
artifact and other AWS resources
• Has Lambda custom actions for
running my own testing functions
• Integrates with a third-party
tool/service
• Has a manual approval before
deploying to production

45. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplify Management

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Systems Manager Capabilities
Run Command
Maintenance
Window
Inventory
State Manager Parameter Store
Patch Manager
Automation
Deploy, configure,
and administer
Track and
update
Shared
capabilities

47. Amazon EC2 Systems Manager—Components
Run Command
State Manager
Inventory Maintenance
Window
Patch Manager Automation Parameter
Store
Documents

48. Managing Your Environment with Systems
Manager
Availability Zone
Web security group
Private subnet
Accept traffic from
SSM
WEB2
WEB1
AWS administrator
Corporate data
center
EC2 Systems Manager
Amazon S3
bucket
SNS topic CloudWatch
metric
IAM
policy

49. Monitor EC2 metrics
(CPU, Disk Usage, etc.)
Monitor AWS resources
(EBS Volumes, Elastic Load
Balancers, etc.)a
Monitor logs and configure
alerts
Store logs and perform
analytics
Availability Zone
S SharePoint
Front-end
SQL Server Domain
Controller
CloudWatch /
CloudWatch Logs
Amazon Kinesis
Amazon
S3
Amazon
Redshift
AWS
Lambda
Availability Zone
S SharePoint
Front-end
SQL Server Domain
Controller
CloudWatch /
CloudWatch Logs
Email
Amazon
SMS
Workflow
CloudWatch
Alarms
CloudWatch & CloudWatch Logs

50. Monitoring
Amazon
CloudWatch
AWS
CloudTrail
AWS
Config
AWS Trusted
Advisor
Flow logsAmazon
VPC
AWS
Lambda
Amazon
Elasticsearch Service
Amazon
QuickSight
EC2
Amazon
Kinesis

51. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!