BBVA: Helping Global Remote Working with Amazon AppStream 2.0
AWS Architecture BlogBBVA: Helping Global Remote Working with Amazon AppStream 2.0by Jose Luis Prieto | on12 MAY 2020| inAdvanced (300),Amazon AppStream 2.0,Architecture,AWS Direct Connect,AWS Transit Gateway,Best Practices,Customer Solutions,Financial Services|Permalink|ShareThis post was co-written with Javier Jose Pecete, Cloud Security Architect at BBVA, and Javier Sanz Enjuto, Head of Platform Protection – Security Architecture at BBVA.IntroductionSpeed and elasticity are key when you are faced with unexpected scenarios such as a massive employee workforce working from home or running more workloads on the public cloud if data centers face staffing reductions. AWS customers can instantly benefit from implementing a fully managed turnkey solution to help cope with these scenarios.Companies not only need to use technology as the foundation to maintain business continuity and adjust their business model for the future, but they also must work to help their employees adapt to new situations.About BBVABBVAis a customer-centric, global financial services group present in more than 30 countries throughout the world, has more than 126,000 employees, and serves more than 78 million customers.Founded in 1857, BBVA is a leader in the Spanish market as well as the largest financial institution in Mexico. It has leading franchises in South America and the Sun Belt region of the United States and is the leading shareholder in Turkey’sGaranti BBVA.The challengeBBVA implemented a global remote working plan that protects customers and employees alike, including a significant reduction of the number of employees working in its branch offices. It also ensured continued and uninterrupted operations for both consumer and business customers by strengthening digital access to its full suite of services.Following the company’s policies and adhering to new rules announced by national authorities in the last weeks, more than 86,000 employees from across BBVA’s international network of offices and its central service functions now work remotely.BBVA, subject to a set of highly regulated requirements, and was looking for a global architecture to accommodate remote work. The solution needed to be fast to implement, adaptable to scale out gradually in the various countries in which it operates, and able to meet its operational, security, and regulatory requirements.The architectureBBVA selectedAmazon AppStream 2.0for particular use cases of applications that, due to their sensitivity, are not exposed to the internet (such as financial, employee, and security applications). Having had previous experience with the service, BBVA chose AppStream 2.0 to accommodate the remote work experience.AppStream 2.0 is a fully managed application streaming service that provides users with instant access to their desktop applications from anywhere, regardless of what device they are using.AppStream 2.0 works with IT environments, can be managed through the AWS SDK or console, automatically scales globally on demand, and is fully managed on AWS. This means there is no hardware or software to deploy, patch, or upgrade.The streamed video and user inputs are sent over HTTPS and are SSL-encrypted between the AppStream 2.0 instance executing your applications, and your end users.Security groups are used to control network access to the customer VPC.AppStream 2.0 streaming instance access to the internet is through the customer VPC.AppStream 2.0 fleets are created by use case to apply security restrictions depending on data sensitivity. Setting clipboard, file transfer, or print to local device options, the fleets control the data movement to and from employees’ AppStream 2.0 streaming sessions.BBVA relies on a proprietary service called Heimdal to authenticate employees through the corporate identity provider. Heimdal calls theAppStream 2.0 API CreateStreamingURLoperation to create a temporary URL to start a streaming session for the specified user, and tries to abstract the user from the service using:FleetName to connect the most appropriate fleet based on the user’s location (BBVA has fleets deployed in Europe and America to improve the user’s experience.)ApplicationIdto launch the proper application without having to use an intermediate portalSessionContextin situations where, for instance, the authentication service generates a token and needs to be forwarded to a browser application and injected as a session cookieTo simplify its overall network architecture, BBVA usesAWS Transit Gatewayto build a hub-and-spoke network topology with full control over network routing and security.There are situations where the application streamed in AppStream 2.0 needs to connect:On-premises, usingAWS Direct Connectplus VPN providing an IPsec-encrypted private connectionTo the Internet through an outbound VPC proxy with domain whitelisting and content filtering to control the information and threats in the navigation of the employeeAppStream 2.0 activity is logged into a centralized repository support byAmazon S3for detecting unusual behavior patterns and by regulatory requirements.ConclusionBBVA built a global solution reducing implementation time by 90% compared to on-premises projects, and is meeting its operational and security requirements. As well, the solution is helping with the company’s top concern: protecting the health and safety of its employees.TAGS:appstream 2.0,Architecture,AWS security best practices,Financial Services,remote employees,staffingJose Luis PrietoJose Luis Prieto Priego is a Global Solutions Architect at AWS Financial Services. Jose is based in Madrid, Spain, where he works with Financial Services customers to help them design, deploy, and scale applications to achieve their business goals. In his spare time, Jose loves to spend time with his wife and two young children, and feeding his (American) football freak condition.
This post was co-written with Javier Jose Pecete, Cloud Security Architect at BBVA, and Javier Sanz Enjuto, Head of Platform Protection – Security Architecture at BBVA. Introduction Speed and elasticity are key when you are faced with unexpected scenarios such as a massive employee workforce working from home or running more workloads on the public […]
Jose Luis Prieto
Advanced (300) Amazon AppStream 2.0 Architecture AWS Direct Connect AWS Transit Gateway Best Practices Customer Solutions Financial Services