Microsoft Azure Cloud Platform an overview CSCI E90

Microsoft Azure Cloud Platform an overview CSCI E-90 Cloud Computing Zoran B. Djordjević Harvard University November 14 th, 2014 (5: 30 – 7: 30) Boston Azure User Group http: //www. bostonazure. org @bostonazure Bill H my ELLO nam e is Wi Bill Wilder http: //blog. codingoutloud. com @codingoutloud lde r

O L L HE s i e m a n y m name is Bill Wilder My l l i B r e d l i W codingoutloud@gmail. com blog. codingoutloud. com @codingoutloud www. devpartners. com

www. cloudarchitecturepatterns. com Who is Bill Wilder? www. bostonazure. org www. devpartners. com

Reality is Resource-Constrained “Security is always a tradeoff; it must be balanced with the cost. ” - Bruce Schneier http: //www. schneier. com/essay-207. html @Bill Wilder 4

Reality is Resource-Constrained “_______ is always a tradeoff; it must be balanced with the cost. ” - Bruce Schneier http: //www. schneier. com/essay-207. html @Bill Wilder 5

Members of Microsoft Azure Security Team @Bill Wilder 6

Defense in Depth Approach Layer Data Application* Host Defense-in-Depth § Strong storage keys for access control § SSL support for data transfers between all parties § Front-end. NET framework code running under partial trust § Windows account with least privileges § Hardened version of Windows Server 2008 OS for both VM Host and VM Guest operating systems § Host boundaries enforced by external hypervisor Network § Host firewall limiting traffic to VMs § VLANs and packet filters in routers Physical § World-class physical security § ISO 27001 and SAS 70 Type II certifications for datacenter processes @Bill Wilder 7

Defenses Inherited by Azure Applications Spoofing Tampering/ Disclosure Repudiation Denial of Service VM switch hardening VLANs Top of Rack Switches Custom packet filtering Certificate Services Shared-Access Signatures Elevation of Privilege Partial Trust Runtime Monitoring Diagnostics Service HTTPS Configurable scale-out Hypervisor custom sandboxing Virtual Service Accounts Sidechannel protections @Bill Wilder 8

Developer Resources • www. windowsazure. com/develop/ is LOADED with Dev Libraries, Training Kits, How To Guides across: – Mobile (i. OS, Android, Win Phone, Win 8 SDKs) –. NET, Node. js, Java, PHP, Python, REST – Power. Shell, CLI • Example: Create Node. js web site from Mac CLI https: //www. windowsazure. com/en-us/develop/nodejs/tutorials/create-a-website-(mac)/ • Example: Create Linux (Cent. OS) VM from CLI (Node-based CLI – Windows not required) https: //www. windowsazure. com/en-us/develop/php/how-to-guides/command-line-tools/ https: //www. windowsazure. com/en-us/develop/nodejs/how-to-guides/command-linetools/ • Example: Install Couchbase + VNet on VM http: //blogs. msdn. com/b/jimoneil/archive/2012/06/16/couchbase-on-azure-a-tour-ofnew-windows-azure-features. aspx @Bill Wilder 9

PORTAL DEMO www. windowsazure. com manage. windowsazure. com @Bill Wilder 10

Cloud Computing Packaged Software (as a Service) You manage (as a Service) Applications (as a Service) Data Runtime Middleware O/S O/S Virtualization Servers Storage Networking Middleware You manage Runtime Data Managed by vendor Servers O/S Virtualization Servers Storage Networking Managed by vendor Applications Data You manage Platform Infrastructur e

od els __________ as a Service Infrastructure Software Platform BYO Users S en ta l. M d. R lou c. C bli Pu http: //csrc. nist. gov/publications/nistpubs/800 -145/SP 800 -145. pdf App. Harbor a. SIaa Virtualized Hardware as Op. Ex, Networking, Automation, Elasticity, Price Transparency, Global Data Centers, Expertise, SLA a. SPa BYO VMs Sa Apps, $/user, Expertise, SLA App Services as Op. Ex, BYO $/VM/Svcs, OS, DBMS, etc. Apps with patching & upgrades, Environment Monitoring, Expertise, SLA

Microsoft Azure Compute Options • HDInsight (Hadoop) – specialized: big data • Mobile Services – specialized: devices • Virtual Machines – most flexible • Web Sites – most convenient • Cloud Services – most scalable, most efficient

Cloud Services • Build highly scalable apps and • • services Multi-tier, multi-instance architectures Can be combined with other compute services Stateless node, horizontal scaling approach Automated management

Cloud Services Web Roles “Service Model” Worker Roles • 1+ types • Deployment • 1+ types • Windows Package • Windows Server • Config: VM sizes & Server • Running IIS instance counts, • Could run settings, endpoints, Tomcat, etc. certs…

Cloud Services Load Balancer Web Role Instances Worker Role Instances

Service Bus Queue • Durable – won’t lose your data • Reliable – backed by SLA and ops team • Scalable – Internet scale • Approachable – REST + SDKs • Feature rich – supports “at least once” and “at most once” delivery guarantees, pinning, suspend, & more… • See also: Azure Storage Queue

Scalable Architecture Web Role Instances Service Bus Queue Worker Role Instances

QCW Example: User Uploads Photo www. pageofphotos. com Web Server Reliable Queue Reliable Storage Compute Service

QCW [on Azure] WE NEED: • Compute (VM) resources to run our code üWeb Roles (IIS) and Worker Roles (w/o IIS) • Reliable Queue to communicate üAzure Storage Queues • Durable/Persistent Storage üAzure Storage Blobs & Tables; WASD

QCW on Azure: User Uploads a Photo www. pageofphotos. com push Web Role (IIS) pull Azure Queue Worker Role Azure Blob UX implications: user does not wait for thumbnail (architecture!)

QCW enables Responsive UX • Response to interactive users is as fast as a work request can be persisted • Time consuming work done asynchronously • Comparable total resource consumption, arguably better subjective UX • UX challenge – how to express Async to users? – Communicate Progress – Display Final results – Long Polling/Web Sockets (e. g. , Signal. R or Node. io)

QCW enables Scalable App • Decoupled front/back provides insulation – Blocking is Bane of Scalability – Order processing partner doing maintenance – Twitter down – Email server unreachable – Internet connectivity interruption • Loosely coupled, concern-independent scaling – (see next slide) – Get Scale Units right – Key to optimizing operational CO$T$

General Case: Many Roles, Many Queues Web Role (Admin) Web Role (Public) Role (IIS) Queue Type 1 Queue Type 2 Queue Type 3 Worker Role Type 1 Worker Role Worker Role Worker Type. Role 2 Type 2 • Scaling best when Investment α Benefit • Optimize for CO$T EFFICIENCY • Logical vs. Physical Architecture depends on current scale

Reliable Queue & 2 -step Delete var url = “http: //pageofphotos. blob. core. windows. net/up/<guid>. png”; queue. Add. Message( new Cloud. Queue. Message( url ) ); (IIS) Web Role Queue Worker Role var invisibility. Window = Time. Span. From. Seconds( 10 ); Cloud. Queue. Message msg = queue. Get. Message( invisibility. Window ); (… do some processing then …) queue. Delete. Message( msg );

QCW requires Idempotent • Perform idempotent operation more than once, end result same as if we did it once • Example with Thumbnailing (easy case) • App-specific concerns dictate approaches – Compensating action, Last write wins, etc. • PARTNERSHIP: division of responsibility between cloud platform & app – Far cry from database transaction

QCW expects Poison Messages • A Poison Message cannot be processed – Error condition for non-transient reason – Use dequeue count property • Be proactive – Falling off the queue may kill your system • Determine a Max Retry policy per queue – Delete, put on “bad” queue, alert human, …

QCW requires “Plan for Failure” • VM restarts will happen – Hardware failure, O/S patching, crash (bug) • Bake in handling of restarts into our apps – Restarts are routine: system “just keeps working” – Idempotent support needed important – Event Sourcing (commonly seen with CQRS) may help • Not an exception case! Expect it! • Consider N+1 Rule

What’s Up? Reliability as EMERGENT PROPERTY Typical Site Any 1 Role Inst Operating System Upgrade Application Code Update Scale Up, Down, or In Hardware Failure Software Failure (Bug) Security Patch Overall System

What about the DATA? • You: Azure Web Roles and Azure Worker Roles – Taking user input, dispatching work, doing work – Follow a decoupled queue-in-the-middle pattern – Stateless compute nodes • Cloud: “Hard Part”: persistent, scalable data – Azure Queue & Blob Services – Three copies of each byte – Geo-replicated to sister data center – Busy Signal Pattern

Azure Services Compute Virtual Machines Cloud Services Websites Mobile Services Batch Network Services Express. Route Virtual Network Traffic Manager Data Services Storage SQL Database HDInsight Cache Backup Site Recovery Machine Learning Stor. Simple Document. DB Azure Search Data Factory Stream Analytics Operational Insights App Services Media Services Service Bus Push Notifications Scheduler Biz. Talk Services Active Directory Multi-Factor Authentication Automation CDN API Management Remote. Application Insights

Cloud Architecture Patterns book Primer Chapters 1. 2. 3. 4. Scalability Eventual Consistency Multitenancy and Commodity Hardware Network Latency

Cloud Architecture Patterns book Pattern Chapters 1. Horizontally Scaling Compute Pattern 2. Queue-Centric Workflow Pattern 3. Auto-Scaling Pattern 4. Map. Reduce Pattern 5. Database Sharding Pattern 6. Busy Signal Pattern 7. Node Failure Pattern 8. Colocate Pattern 9. Valet Key Pattern 10. CDN Pattern 11. Multisite Deployment Pattern

Business Card

Boston. Azure. org • Boston Azure cloud user group • Focused on Microsoft’s Public Cloud Platform • Monthly, 6: 00 -8: 30 PM in Boston area – Food; wifi; free; great topics; growing community • Follow on Twitter: @bostonazure • More info or to join our Meetup. com group: http: //www. bostonazure. org