Tom Vachon, Harvard

Harvard’s cloud at a glance

• 684 applications targeted for migration by 7/18, 300+ migrated already
  • Shutting down one on-prem data center
• 1 VPC per account on average
  • Centrally Billed: 131 Accounts
  • 45 Accounts/VPCs on Direct Connect
  • Looking to make Cloud a University-wide strategic program
• Cloud Shield – physical firewall
  • Kicked off 7/15 in response to a security breach
  • POC – 11/15 – 2/16
  • Started automation code 3/16
  • 15,000 lines of code
  • Production ready 7/16
  • Design goals
    • provide highly available and highly redundant AWS network access
    • Provide visibility of traffic into, out of, and between cloud applications
    • Provide next-gen firewall protections
    • Inline web filtering to simplify server configuration
    • Provide multicloud connectivity
  • Tech details
    • Diverse paths and POPs – Boston has 2 direct connects, and a POP in Equinix in Virginia with private network connection to campus
    • Primarily done for visibility
  • Actively discourage host-based firewalls
    • Use security groups instead
    • Don’t use Network ACLs
• Will provision services with public IPs
  • They have overlapping private address spaces
• Design manager of managers in Python
  • Create an ops & maintenance free architecture in Lambda
  • Provide REST API through AWS API Gateway
  • Isolate changes by segregating integrations in AWS Lambda
• Leverage AWS DynamoDB for
  • Schemaless session cache
  • Dynamic reconfiguration
• Challenges
  • Static DNS names
    • use ELB or ALB for applications
  • Everyone needs to be on Harvard IP space
    • Delegates six /16s for AWS
  • Legacy application stacks
    • Java has a “mostly hate” relationship with DNS
      • Lots of apps cache DNS forever
  • Reduced S3 visibility
  • Inability to do app-by-app identification
    • Grouping by data classifications
  • Items which are unknowingly locked down to AWS IP space
    • eg doing a yum update to AWS Linux from a non-AWS ip space
• Virtual firewalls per VPC were going to cost >$4 million over three years, this model costs $1.6 million over five years
• Most applications got faster when distributed across this model
  • Less switching in the way

Panel Discussion

• Biggest technical challenges so far?
  • Georgetown  – have to run virtual firewalls in HA. Looking at replacing with TrendMicro
  • Harvard – lack of visibility in AWS
  • UNL – Vast offerings from vendors – how to wrap heads around it?
  • How to support on prem and burst out, especially for research instruments?
  • Cornell – Keeping up with the technology. Having people to manage and implement solutions. Encouraging lack of consistency in an effort to use the best new technology to solve problems.
  • Wisconsin – Have to worry about security a whole new paradigm in the cloud.
  • Notre Dame – pace of innovation. Do we prepare for a more rapid pace of change (and those costs) or learn to live with not implementing the latest?