Creating a Multi-Region Application with AWS Services – Part 3, Application Management and Monitoring
AWS Architecture BlogCreating a Multi-Region Application with AWS Services – Part 3, Application Management and Monitoringby Joe Chapman and Seth Eliot | on28 MAR 2022| inAWS CloudFormation,AWS Config|Permalink|ShareIn Part 1 of this series, we built a foundation for your multi-Region application using AWScompute, networking, and securityservices. In Part 2, we integratedAWS data and replication servicesto move and sync data between AWS Regions.In Part 3, we cover AWS services and features used for messaging, deployment, monitoring, and management.Developer toolsAutomation that uses infrastructure as code (IaC) removes manual steps to create and configure infrastructure. It offers a repeatable template that can deploy consistent environments in different Regions.IaC withAWS CloudFormation StackSetsuses a single template to create, update, and deletestacks across multiple accounts and Regionsin a single operation. When writing anAWS CloudFormationtemplate, you can change the deployment behavior by pairing parameters with conditional logic. For example, you can set a “standby” parameter that, when “true,” limits the number of AmazonElastic Compute Cloud (Amazon EC2)instances in anAmazon EC2 Auto Scalinggroup deployed to a standby Region.Applications with deployments that span multiple Regions can usecross-Region actionsinAWS CodePipelinefor a consistent release pipeline. This way you won’t need to set up different actions in each Region.EC2 Image BuilderandAmazon Elastic Container Registry (Amazon ECR)have cross-Region copy features to help with consistent AMI and image deployments, as covered inPart 1.Event-driven architectureDecoupled, event-driven applications produce a more extensible and maintainable architecture by having each component perform its specific task independently.Amazon EventBridge, a serverless event bus, can send events between AWS resources. By utilizingcross-Region event routing, you can share events between workloads indifferent Regions(Figure 1) andaccounts. For example, you can share health and utilization events across Regions to determine which Regional workload deployment is best suited for requests.Figure 1. EventBridge routing events from one Region to event buses in other RegionsIf your event-driven application relies on pub/sub messaging,Amazon Simple Notification Service (Amazon SNS)can fan out to multiple destinations. When the destination targets areAmazon Simple Queue Service (Amazon SQS)queues orAWS Lambdafunctions, Amazon SNS cannotify recipients in different Regions. For example, you can send messages to a central SQS queue that processes orders for a multi-Region application.Monitoring and observabilityObservability becomes even more important as the number of resources and deployment locations increases. Being able to quickly identify the impact and root cause of an issue will influence recovery activities, and ensuring your observability stack is resilient to failures will help you make these decisions. When building on AWS, you can pair the health of AWS services with your application metrics to obtain a more complete view of the health of your infrastructure.AWS HealthdashboardsandAPIsshow account-specific events and scheduled activities that may affect your resources. These events cover all Regions, and can expand to include all accounts in yourAWS Organization. EventBridge can monitor events fromAWS Healthto take immediate actions based on an event. For example, if multiple services are reporting as degraded, you could set the EventBridge event target to anAWS Systems Manager automated runbookthat prepares your disaster recovery (DR) application for failover.AWS Trusted Advisoroffers actionable alerts to optimize cost, increase performance, and improve security and fault tolerance. Trusted Advisor shows results across all Regions and can generate a report that shows an aggregated view of all check resultsacross all accounts within an organization.To maintain visibility over an application deployed across multiple Regions and accounts, you can create aTrusted Advisor dashboardand anoperations dashboardwithAWS Systems Manager Explorer. The operations dashboard offers a unified view of resources, such as Amazon EC2,Amazon CloudWatch, andAWS Configdata. You can combine the metadata withAmazon Athenato create amulti-Region and multi-account inventory viewof resources.You can view metrics from applications and resources deployed across multiple Regions in the CloudWatch console. This makes it easy to create graphs and dashboards for multi-Region applications.Cross-account functionalityis also available in CloudWatch, so you can create a centralized view of dashboards, alarms, and metrics across your organization.Amazon OpenSearch Serviceaggregates unstructured and semi-structured log files, messages, metrics, documents, configuration data, and more.Cross-cluster replicationreplicatesindices, mappings, and metadata in an active-passive setup from one OpenSearch Service domain to another. This reduces latency across Regions and ensures high availability of your data.AWS Resilience Hubassesses and tracks the resiliency of your application. It checks how well an application will maintain availability when performing a Regional failover. For example, it can check if an application has cross-Region replication configured onAmazon Simple Storage Service (Amazon S3)buckets or thatAmazon Relational Database Service (Amazon RDS)instances have a cross-Region read-replica. Figure 2 shows an output of a Resilience Hub assessment. It recommends use ofRoute 53 Application Recovery Controller(covered in Part 1) to ensure the Amazon EC2 Auto Scaling group in a Region is scaled and ready to accept traffic before we fail over to it.Figure 2. Resilience Hub recommendationsManagement: GovernanceGrowing an application into a new country means there may be additional data privacy laws and regulations to follow. These will vary depending on the country, and we encourage you to investigate with your legal team to fully understand how this affects your application.AWS Control Towersupports data compliance by providingguardrails to control and meet data residency requirements. These guardrails are a collection of Service Control Policies (SCPs) and AWS Config rules. You can implement them independently of AWS Control Tower if needed. Additional security-centric multi-Region services arecovered in part 1.AWS Config provides a detailed view of the configuration and history of AWS resources. An AWS Config aggregator collects configuration and compliance data frommultiple accounts and Regionsinto a central account. This centralized view offers a comprehensive view of the compliance and actions on resources, regardless of which account or Region they reside in.Management: OperationsSeveralAWS Systems Managercapabilities allow for easier administration of AWS resources, especially as applications grow. Systems Manager Automation simplifies common maintenance and deployment tasks for AWS resources with automated runbooks. These runbooks automate actions on resourcesacross Regions and accounts. You can pair Systems Manager Automation withSystems Manager Patch Managerto ensure instances maintain thelatest patches across accounts and Regions. Figure 3 shows Systems Manager running several automation documents on a multi-Region architecture.Figure 3. Using Systems Manager automation from a central operations AWS account to automate actions across multiple RegionsBringing it togetherAt the end of each part of this blog series, we build on a sample application based on the services covered. This shows you how to bring these services together to build a multi-Region application with AWS services. We don’t use every service mentioned, just those that fit the use case.We built this example to expand to a global audience. It requires high availability across Regions, and favors performance over strict consistency. We have chosen the following services covered in this post to accomplish our goals, building on our foundation frompart 1andpart 2:CloudFormation StackSets to deploy everything with IaC. This ensures the infrastructure is deployed consistently across Regions.AWS Config rules provide a centralized place to monitor, record, and evaluate the configuration of our resources.For added observability, we created dashboards with CloudWatch dashboard, Personal Health dashboard, and Trusted Advisor dashboard.Figure 4. Building an application with multi-Region servicesWhile our primary objective is expanding to a global audience, we note that some of the services such as CloudFormation StackSets rely on Region 1. Each Regional deployment is set up for static stability, but if there were an outage in Region 1 for an extended period of time, our DR playbook would outline how to make CloudFormation changes in Region 2.SummaryMany AWS services have features to help you build and manage a multi-Region architecture, but identifying those capabilities across 200+ services can be overwhelming.In this 3-part blog series, we’ve explored AWS services with features to assist you in building multi-Region applications. In Part 1, we built a foundation with AWS security, networking, and compute services. In Part 2, we added in data and replication strategies. Finally, in Part 3, we examined application and management layers.Ready to get started?We’ve chosen someAWS Solutions,AWS Blogs, andWell-Architected labsto help you!Other posts in this seriesCreating a Multi-Region Application with AWS Services – Part 1, Compute, Networking, and SecurityCreating a Multi-Region Application with AWS Services – Part 2, Data and ReplicationRelated informationCreating Disaster Recovery Mechanisms Using Amazon Route 53Disaster Recovery Blog SeriesAWS Observability ToolsTAGS:Creating a Multi-Region Application with AWS Services series,ResilienceJoe ChapmanJoe is a Sr. Solutions Architect with Amazon Web Services. He primarily serves AWS EdTech customers, providing architectural guidance and best practice recommendations for new and existing workloads. Outside of work, he enjoys going on new adventures while traveling the world.Seth EliotAs a Principal Developer Advocate, and before that Principal Reliability Solutions Architect, with AWS Seth helps guide AWS customers in how they architect and build resilient, scalable systems in the cloud. He draws on 11 years of experience in multiple engineering roles across the consumer side of Amazon.com, where, as Principal Solutions Architect, he worked hands-on with engineers to optimize how they use AWS for the services that power Amazon.com. Previously, he was Principal Engineer for Amazon Fresh and International Technologies. Seth joined Amazon in 2005 where soon after, he helped develop the technology that would become Prime Video. You can follow Seth on twitter @setheliot, or on LinkedIn at https://www.linkedin.com/in/setheliot/.
In Part 1 of this series, we built a foundation for your multi-Region application using AWS compute, networking, and security services. In Part 2, we integrated AWS data and replication services to move and sync data between AWS Regions. In Part 3, we cover AWS services and features used for messaging, deployment, monitoring, and management. […]
Joe Chapman
AWS CloudFormation AWS Config