$30 off During Our Annual Pro Sale. View Details »

從傳統 IDC 到 Hybrid Cloud 的演進及架構設計

從傳統 IDC 到 Hybrid Cloud 的演進及架構設計

2016 年底的 104 是傳統 IDC 架構,2019 年的現在是 AWS + IDC 的 Hybrid Cloud 架構,擁有 120 以上的 AWS 帳號,在這段時間 104 如何邁向 AWS 雲端以及技術選型,從初建 Hybrid Cloud 到現在穩定的架構又踩了多少坑,這場分享將帶給各位這段期間的辛酸歷程 (哭
在此議題中您將可了解:

- 真實的企業技術轉型
- Hybrid Cloud 建置歷程
- Hybrid Cloud 架構
- Hybrid Cloud 的瓶頸與困難

More Decks by scott.liao (Mr. 沙先生)

Other Decks in Technology

Transcript

  1. 從傳統 IDC 到 Hybrid Cloud 的
    演進及架構設計
    S c o t t . l i a o @ M r. 沙 先 ⽣生
    < s h a z i . i n f o >

    View Slide

  2. 2
    HELLO!
    104 資訊科技 ⼯工程經理理
    我會 ... AWS、DevOps、打雜
    ⾁肉搜 Mr. 沙先⽣生 或是 Mr. 礦物先⽣生 找到我
    • IT 鐵⼈人賽第九屆:Puppet 從入⾨門就放棄
    • DevOpsDays Taipei 2018 講者
    • SITCON 2019 講者
    • DevOps Taiwan CI/CD/Pipeline Tools

    View Slide

  3. 每個技術轉型的企業
    104 & AWS
    都有⼀一個杯桑的故事

    View Slide

  4. 4
    Infrastructure
    Data Center Cloud
    Data Center
    +
    Cloud

    View Slide

  5. Data Center
    傳統
    5
    Cloud

    衝突

    View Slide

  6. 6
    「我要很復古⼜又很潮的設計」

    View Slide

  7. 「為了了⽣生活,我可以忍」
    洪⾦金金寶說:
    7

    View Slide

  8. 8
    「先攻他中路路」- 打通網路路環境
    Internet
    VPN Intranet
    Direct Connect Intranet
    ✘ policy
    ✔ money
    ✘ latency

    View Slide

  9. 9
    Direct Connect Intranet
    Provider:GCX / Chief
    Network:100M / 300M / 1G / 10G
    SLA:NO
    Type:Public / Private VIF
    Protocol:BGP

    View Slide

  10. 10
    Direct Connect Intranet

    View Slide

  11. 11
    130+ AWS Account

    View Slide

  12. 12
    Multiple Account Network
    REF:Netflix
    Solution:Internet
    VPC Peering
    Transit VPC ✔
    Transit Gateway
    ✘ policy
    ✘ proxy endpoint
    ✘ expensive

    View Slide

  13. 13
    Multiple Account Network

    View Slide

  14. 14
    Multiple Account Network
    《Transit VPC》
    Subnet Not Overlay
    Not Share Cross Account Resource
    Subnet Range Limit
    Manage Cisco Cloud Services Router 1000V
    NLB Not Working for Cross Account

    View Slide

  15. 15
    Private / Public / AWS Only
    Domain

    View Slide

  16. 16
    Mix DNS Network
    DNS Master for Configuration
    DNS Resolver for Query
    - Unbound
    - Route 53 Resolver
    DNS Slave for Zone transfer

    View Slide

  17. 17
    Mix DNS Network《DNS Resolver》

    View Slide

  18. 18
    Mix DNS Network《DNS Resolver》
    AWS Only Domain Name ? ex. VPC PrivateLink
    https://aws.amazon.com/tw/blogs/security/how-to-set-up-dns-resolution-between-on-premises-networks-and-aws-by-using-unbound/
    Unbound (DNS Resolver)
    forward-zone:
    name: “amazonaws.com”
    forward-addr: 169.254.169.253

    View Slide

  19. 19
    Hybrid Cloud latency ?
    Tokyo <> Taiwan

    View Slide

  20. 20
    Hybrid Cloud Latency
    AWS Direct Connect 30ms ~ 35ms
    - ProxySQL
    - Database Replication fo Read
    - API Data Cache
    Where are Database

    View Slide

  21. 21
    How to migrate ?
    AWS <> IDC

    View Slide

  22. 22
    How to Migrate
    AWS CloudFront
    - https://www.104.com.tw/datacenter
    - https://www.104.com.tw/cloud

    View Slide

  23. 23
    Security for ISO 27001 ?

    View Slide

  24. 24
    ISO 27001 on Cloud
    Logs - CloudWatch Log
    - CloudTrail
    - Fluentd
    Control - Console Login with AWS AD、 AWS SSO
    - SSH Login Without SSH (AWS SSM)
    - Internet access With Proxy
    - AWS Service with VPC Privatelink
    Security - WAF、Shield、KMS、SSM
    - Guardduty、AWS Config、 Macie

    View Slide

  25. 25
    Notice
    Cloud Without DNS Cache (TTL 60s)
    Status Not Local, Termination of instance is ALWAYS
    Cloud Computing is expensive
    EOL is ALWAYS
    Automation is everything

    View Slide

  26. THANK
    YOU!

    View Slide