SlideShare a Scribd company logo
1 of 28
Download to read offline
© 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Matt Tavis, AWS Principal Solutions
Architect
October 2015
ARC340
Multi-Tenant Application
Deployment Models
What to Expect from the Session
 Key challenges of multi-tenant architectures
 Common deployment models for multi-tenant
architectures
 Common strategies for addressing challenges in each
model
What Not to Expect
 Multi-account, multi-VPC strategies
 Detailed IAM security strategies
Key Challenges in Multi-Tenant Architectures
 Request routing and handling
 Change management
 Data security and isolation
 Deployment patterns
Pattern 1: The Retro
 Deploy an entire application stack per tenant
 Isolation at the AWS resource level (e.g., EC2 instance,
ELB, RDS instance, …)
 When to consider:
 Black box applications – packaged software, legacy apps…
 Snowflakes configurations – every install is different…
 Low-effort but with cloud-scale
 Challenges:
 Cost efficiency, resource management (aka “urban sprawl”)
 This is *not* modern cloud architecture
The Retro: Architecture Example
Auto
Scaling
Auto
Scaling
Auto
Scaling
Auto
Scaling
Auto
Scaling
Auto
Scaling
ELB
ELB
ELB
EC2
EC2
EC2
EC2
EC2
EC2
RDS
RDS
RDS
Pattern 2: The Bridge
 Hybrid model to bridge from Retro to modern
 Leverage “containerization” to drive greater efficiency
 Drive request context throughout architecture
 When to consider:
 See the Retro – same reasons plus…
 Transitioning to SOA/μServices – enabling re-factoring
 Blending monolithic components into a modern architecture
 Challenges:
 Multiple change management approaches
 Refactoring to a shared services model
Legacy Refactored Migrating
Service 2
The Bridge: Architecture Example
Auto
Scaling
Auto
Scaling
DataServicesLayer
Service 1
ELB
ELB
ELB
ELB
EC2
EC2
EC2
ECS
ECS
RDS
DynamoDB
S3
Pattern 3: The Pool
 All resources are shared across all tenants
 Any service can handle any request from any tenant
 Pure services models embracing “share nothing”
architecture
 When to consider:
 Always – usually new app development
 SOA/μServices and Service Ownership is embraced
 Challenges:
 Factoring out request context, state, and data locality
 Evolving state through deployment
The Pool: Architectural Example
Auto
Scaling
Service 1
Service 2
Service 3
ELB
ECS
RDS
DynamoDB
DynamoDB
EC2
ECS
Elastic
Beanstalk
ELB
ELB
ELB
Pattern 4: The Serverless
 Event-driven model for service interactions
 No (or few) managed server instances
 Leverages AWS managed scalable services
 When to consider:
 IoT, batch/event processing, mobile apps – new architectures
 Async-oriented interaction models
 Challenges:
 Transient nature of processing and debugging
 Monitoring state of fully transient system
The Serverless: Architectural Example
Amazon SWF
ELB
ELB
DynamoDB
Lambda
LambdaAmazon
Kinesis
API Gateway
Addressing Challenges in
Each Pattern
Request Routing and Processing Challenges
 Routing the request or processing any request
 Sufficient context at every layer to properly process
 Scaling the environment consistent with volume
The Retro: Architecture Example
Auto
Scaling
Auto
Scaling
Auto
Scaling
Auto
Scaling
ELB
ELB
EC2
EC2
EC2
EC2
RDS
RDS
Legacy Refactored Migrating
Service 2
The Bridge: Architecture Example
Auto
Scaling
Auto
Scaling
DataServicesLayer
Service 1
ELB
ELB
ELB
ELB
EC2
EC2
EC2
ECS
ECS
RDS
DynamoDB
S3
Request Routing and Processing - Comparison
 Unique endpoints
per tenant stack
 Dedicated
resources
 Dedicated data
stores
 Dedicated
endpoints if
needed
 Request context
flows through
 Shared resources
where refactored
 Try containers
 Shared endpoints
for all
 Complete context
flows through
 Data stores
wrapped by
services
 Complete context
in the event
(metadata)
 Tenant IDs are 1st
class construct
 Use Tenant IDs for
auth and auth
Retro Bridge Pool Serverless
Change Management
 Rolling out new versions
 Running multiple versions side by side
 Handling massive fleet deployment
The Retro: Architecture Example
ELB
Auto
Scaling
Auto
Scaling
EC2 EC2
Auto
Scaling
Auto
Scaling
EC2 EC2
RDS
The Pool: Architectural Example
Auto
Scaling
Service 1
Service 2
Service 3
ELB
ECS
RDS
DynamoDB
DynamoDB
EC2
ECS
Elastic
Beanstalk
ELB
ELB
ELB
CodeDeploy
Change Management
 Each stack stands
alone 
 vNext cutover or
true blue/green
 Application repo &
infra code repo
 Adopt ALM
solution for future
 Treat each service
individually
 Flexibility for
dedicated
endpoints
 Rolling deploy for
shared services –
handle rollback
 Data location
services for data
migrations
 Treat each service
individuaily
 Rolling deploy for
all services –
handle rollback
 Data sources
always hidden
behind service
layer
 Leverage API
Gateway deploy
 Embed versioning
into API Gateway
call
 Update Lambda
function directly or
“cutover” through
API Gateway
resource
mappings
Retro Bridge Pool Serverless
Data Security and Isolation
 Ensuring rights and permissions at every tier
 Protecting data from insecure access
 Isolating data between tenants
The Retro: Architecture Example
Auto
Scaling
Auto
Scaling
Auto
Scaling
Auto
Scaling
ELB
ELB
EC2
EC2
EC2
EC2
RDS
RDS
KMS
Legacy Refactored Migrating
Service 2
The Bridge: Architecture Example
Auto
Scaling
Auto
Scaling
DataServicesLayer
Service 1
ELB
ELB
ELB
ELB
EC2
EC2
EC2
ECS
ECS
RDS
DynamoDB
S3
KMS
Data Security and Isolation
 Unique resources
end to end
 IAM roles for
resource access
 Consider unique
encryption keys
per tenant with
KMS
 Embed data
access
authorization in
shared layers
 Leverage tenant
identity in context
for access and
encryption
 Use unique
encryption keys
per tenant via
KMS
 Embed data
access
authorization in
shared layers
 Leverage tenant
identity in context
for access and
encryption
 Use unique
encryption keys
per tenant via
KMS
 Secure API
Gateway with IAM
 Embed data
access
authorization into
Lambda functions
 Leverage tenant
identity for access
and encryption
 Use unique
encryption keys
per tenant via
KMS
Retro Bridge Pool Serverless
TL;DL – Too Long; Didn’t Listen
Legacy
Arch? Go Retro
Dive into
Pool
Event-
based
Model?
Bliss with
Serverless
Refactor
to Bridge
Fight inertia!
Crack the code
Learn to share
Embrace the Cloud
Share and share alike
Learn to let go
Yes
No
No
Yes
Go SOA & μServices
Share nothing
Think async
Qui(e)t SSH
Leverage what you have
Measure what you do
Thank you!
Remember to complete
your evaluations!
Related Sessions
 ARC201 - Microservices Architecture for Digital
Platforms with AWS Lambda, Amazon CloudFront and
Amazon DynamoDB
 DVO401 - Deep Dive into Blue/Green Deployments on
AWS
 ARC309 - From Monolithic to Microservices: Evolving
Architecture Patterns in the Cloud

More Related Content

More from Amazon Web Services

Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSAmazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAmazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceAmazon Web Services
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSAmazon Web Services
 
AWS Serverless per startup: come innovare senza preoccuparsi dei server
AWS Serverless per startup: come innovare senza preoccuparsi dei serverAWS Serverless per startup: come innovare senza preoccuparsi dei server
AWS Serverless per startup: come innovare senza preoccuparsi dei serverAmazon Web Services
 
Crea dashboard interattive con Amazon QuickSight
Crea dashboard interattive con Amazon QuickSightCrea dashboard interattive con Amazon QuickSight
Crea dashboard interattive con Amazon QuickSightAmazon Web Services
 

More from Amazon Web Services (20)

Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
 
AWS Serverless per startup: come innovare senza preoccuparsi dei server
AWS Serverless per startup: come innovare senza preoccuparsi dei serverAWS Serverless per startup: come innovare senza preoccuparsi dei server
AWS Serverless per startup: come innovare senza preoccuparsi dei server
 
Crea dashboard interattive con Amazon QuickSight
Crea dashboard interattive con Amazon QuickSightCrea dashboard interattive con Amazon QuickSight
Crea dashboard interattive con Amazon QuickSight
 

Recently uploaded

VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXTarek Kalaji
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Brian Pichman
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaborationbruanjhuli
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioChristian Posta
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDELiveplex
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarPrecisely
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfAijun Zhang
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-pyJamie (Taka) Wang
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxMatsuo Lab
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1DianaGray10
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 

Recently uploaded (20)

VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBX
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and Istio
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity Webinar
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdf
 
201610817 - edge part1
201610817 - edge part1201610817 - edge part1
201610817 - edge part1
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-py
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptx
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 

(ARC340) Multi-Tenant Application Deployment Models

  • 1. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Matt Tavis, AWS Principal Solutions Architect October 2015 ARC340 Multi-Tenant Application Deployment Models
  • 2. What to Expect from the Session  Key challenges of multi-tenant architectures  Common deployment models for multi-tenant architectures  Common strategies for addressing challenges in each model What Not to Expect  Multi-account, multi-VPC strategies  Detailed IAM security strategies
  • 3. Key Challenges in Multi-Tenant Architectures  Request routing and handling  Change management  Data security and isolation  Deployment patterns
  • 4. Pattern 1: The Retro  Deploy an entire application stack per tenant  Isolation at the AWS resource level (e.g., EC2 instance, ELB, RDS instance, …)  When to consider:  Black box applications – packaged software, legacy apps…  Snowflakes configurations – every install is different…  Low-effort but with cloud-scale  Challenges:  Cost efficiency, resource management (aka “urban sprawl”)  This is *not* modern cloud architecture
  • 5. The Retro: Architecture Example Auto Scaling Auto Scaling Auto Scaling Auto Scaling Auto Scaling Auto Scaling ELB ELB ELB EC2 EC2 EC2 EC2 EC2 EC2 RDS RDS RDS
  • 6. Pattern 2: The Bridge  Hybrid model to bridge from Retro to modern  Leverage “containerization” to drive greater efficiency  Drive request context throughout architecture  When to consider:  See the Retro – same reasons plus…  Transitioning to SOA/μServices – enabling re-factoring  Blending monolithic components into a modern architecture  Challenges:  Multiple change management approaches  Refactoring to a shared services model
  • 7. Legacy Refactored Migrating Service 2 The Bridge: Architecture Example Auto Scaling Auto Scaling DataServicesLayer Service 1 ELB ELB ELB ELB EC2 EC2 EC2 ECS ECS RDS DynamoDB S3
  • 8. Pattern 3: The Pool  All resources are shared across all tenants  Any service can handle any request from any tenant  Pure services models embracing “share nothing” architecture  When to consider:  Always – usually new app development  SOA/μServices and Service Ownership is embraced  Challenges:  Factoring out request context, state, and data locality  Evolving state through deployment
  • 9. The Pool: Architectural Example Auto Scaling Service 1 Service 2 Service 3 ELB ECS RDS DynamoDB DynamoDB EC2 ECS Elastic Beanstalk ELB ELB ELB
  • 10. Pattern 4: The Serverless  Event-driven model for service interactions  No (or few) managed server instances  Leverages AWS managed scalable services  When to consider:  IoT, batch/event processing, mobile apps – new architectures  Async-oriented interaction models  Challenges:  Transient nature of processing and debugging  Monitoring state of fully transient system
  • 11. The Serverless: Architectural Example Amazon SWF ELB ELB DynamoDB Lambda LambdaAmazon Kinesis API Gateway
  • 13. Request Routing and Processing Challenges  Routing the request or processing any request  Sufficient context at every layer to properly process  Scaling the environment consistent with volume
  • 14. The Retro: Architecture Example Auto Scaling Auto Scaling Auto Scaling Auto Scaling ELB ELB EC2 EC2 EC2 EC2 RDS RDS
  • 15. Legacy Refactored Migrating Service 2 The Bridge: Architecture Example Auto Scaling Auto Scaling DataServicesLayer Service 1 ELB ELB ELB ELB EC2 EC2 EC2 ECS ECS RDS DynamoDB S3
  • 16. Request Routing and Processing - Comparison  Unique endpoints per tenant stack  Dedicated resources  Dedicated data stores  Dedicated endpoints if needed  Request context flows through  Shared resources where refactored  Try containers  Shared endpoints for all  Complete context flows through  Data stores wrapped by services  Complete context in the event (metadata)  Tenant IDs are 1st class construct  Use Tenant IDs for auth and auth Retro Bridge Pool Serverless
  • 17. Change Management  Rolling out new versions  Running multiple versions side by side  Handling massive fleet deployment
  • 18. The Retro: Architecture Example ELB Auto Scaling Auto Scaling EC2 EC2 Auto Scaling Auto Scaling EC2 EC2 RDS
  • 19. The Pool: Architectural Example Auto Scaling Service 1 Service 2 Service 3 ELB ECS RDS DynamoDB DynamoDB EC2 ECS Elastic Beanstalk ELB ELB ELB CodeDeploy
  • 20. Change Management  Each stack stands alone   vNext cutover or true blue/green  Application repo & infra code repo  Adopt ALM solution for future  Treat each service individually  Flexibility for dedicated endpoints  Rolling deploy for shared services – handle rollback  Data location services for data migrations  Treat each service individuaily  Rolling deploy for all services – handle rollback  Data sources always hidden behind service layer  Leverage API Gateway deploy  Embed versioning into API Gateway call  Update Lambda function directly or “cutover” through API Gateway resource mappings Retro Bridge Pool Serverless
  • 21. Data Security and Isolation  Ensuring rights and permissions at every tier  Protecting data from insecure access  Isolating data between tenants
  • 22. The Retro: Architecture Example Auto Scaling Auto Scaling Auto Scaling Auto Scaling ELB ELB EC2 EC2 EC2 EC2 RDS RDS KMS
  • 23. Legacy Refactored Migrating Service 2 The Bridge: Architecture Example Auto Scaling Auto Scaling DataServicesLayer Service 1 ELB ELB ELB ELB EC2 EC2 EC2 ECS ECS RDS DynamoDB S3 KMS
  • 24. Data Security and Isolation  Unique resources end to end  IAM roles for resource access  Consider unique encryption keys per tenant with KMS  Embed data access authorization in shared layers  Leverage tenant identity in context for access and encryption  Use unique encryption keys per tenant via KMS  Embed data access authorization in shared layers  Leverage tenant identity in context for access and encryption  Use unique encryption keys per tenant via KMS  Secure API Gateway with IAM  Embed data access authorization into Lambda functions  Leverage tenant identity for access and encryption  Use unique encryption keys per tenant via KMS Retro Bridge Pool Serverless
  • 25. TL;DL – Too Long; Didn’t Listen Legacy Arch? Go Retro Dive into Pool Event- based Model? Bliss with Serverless Refactor to Bridge Fight inertia! Crack the code Learn to share Embrace the Cloud Share and share alike Learn to let go Yes No No Yes Go SOA & μServices Share nothing Think async Qui(e)t SSH Leverage what you have Measure what you do
  • 28. Related Sessions  ARC201 - Microservices Architecture for Digital Platforms with AWS Lambda, Amazon CloudFront and Amazon DynamoDB  DVO401 - Deep Dive into Blue/Green Deployments on AWS  ARC309 - From Monolithic to Microservices: Evolving Architecture Patterns in the Cloud