Building Resilient and High Performing Cloud-based Applications in Hawaii
AWS Architecture BlogBuilding Resilient and High Performing Cloud-based Applications in Hawaiiby Marie Yap, Hang Long, and Nick Sciarrilli | on21 JAN 2022| inAmazon WorkSpaces,Architecture,AWS Direct Connect,AWS Outposts,AWS VPN,Intermediate (200)|Permalink|ShareHawaii is building a digital economy for a sustainable future. Many local businesses are already embarking on their journey to the cloud to meet their customers’ growing demand for digital services. To accessAmazon Web Services (AWS)on the US mainland, customers’ data must traverse through submarine fiber-optic cable networks approximately 2,800 miles across the Pacific Ocean. As a result, organizations have two primary concerns:Resiliency concerns about multiple outage events that could arise from breaks in the submarine cables.Latency concerns for mission-critical applications driven by physical distance.These problems can be solved by architecting the workloads for reliability, secure connectivity, and high performance.Designing network connectivity that is reliable, secure, and highly performantA typical workload in AWS can be broken down into three layers – Network, Infrastructure, and Application. For each layer, we can design for resiliency and latency concerns. Starting at the network layer, there are two recommended options for connecting the on-premises network within the island to AWS.Use of AWS Direct Connect over a physical connection.AWS Direct Connectis a dedicated network connection that connects your on-premises environment to AWS Regions. In this case, the connection is traversing the fiber-optic cable across the Pacific Ocean to the mainland’s meet-me-point facilities. It can be provisioned from 50 Mbps up to 100 Gbps. This provides you with a presence in an AWS Direct Connect location, a third-party colocation facility, or an Internet Service Provider (ISP) that provides last-mile connectivity to AWS. In addition, the Direct Connect location establishes dedicated connectivity toAmazon Virtual Private Clouds (VPC). This improves application performance and addresses latency concerns by connecting directly to AWS and bypassing the public internet.Use of AWS VPN over an internet connection.As a secondary option to Direct Connect,AWS Site-to-Site VPNprovide connectivity into AWS over the public internet usingVPN encryption technologies. The Site-to-Site VPN connects on-premises sites to AWS resources in an Amazon VPC. As a result, you can securely connect your on-premises network to AWS using an internet connection.We recommend choosing the us-west-2 AWS Region in Oregon to build high performant connectivity closest to Hawaii. The us-west-2 Region generally provides more AWS services at a lower cost versus us-west-1. In addition, there are various options forAWS Direct Connect Locationsin the US West Region. Many of these locations support up to 100 Gbps and support MACsec, which is an IEEE standard for security encryption in wired Ethernet LANs. Typically, customers will use multiple 10-Gbps connections for higher throughput and redundancy.Subsea CableHawaii Cable Landing StationMainland Cable Landing StationNearest Direct Connect LocationSouthern Cross Cable Network (SCCN)Kahe Point (Oahu)Morro Bay, CACoreSite, EquinixSouthern Cross Cable Network (SCCN)Kahe Point (Oahu)Hillsboro, OREqunix, EdgeConnex, Pittock Block, CoreSite, T5, TierPointHawaikiKapolei (Oahu)Hillsboro, OREqunix, EdgeConnex, Pittock Block, CoreSite, T5, TierPointAsia-America Gateway (AAG)Keawaula (Oahu)San Luis Obispo, CACoreSite, EquinixJapan-US Cable Network (JUS)Makaha (Oahu)Morro Bay, CACoreSite, EquinixSEA-USMakaha (Oahu)Hermosa Beach, CACoreSite, Equinix, T5Table 1. Subsea fiber-optic cables connecting Hawaii to the US mainland(Source: Submarine Cable Map fromTeleGeography)To build resilient connectivity, sixcablesconnect Hawaii to the mainland US: Hawaiki, SEA-US, Asia-America Gateway (AAG), Japan-US (JUS), and two Southern Cross (SCCN) cables. In addition, these cables connect to various locations on the US West Coast. If you require high resiliency, we recommend a minimum of two physically redundant Direct Connect connections into AWS. In addition, we recommend designing four Direct Connect connections that span two Direct Connect locations for maximum resiliency. If you build your architecture following these recommendations, AWS offers this published service level agreement (SLA).Figure 1. Redundant direct connection from Hawaii to the US mainlandMost customers select an ISP to get them connectivity across the Pacific Ocean to an AWS Direct location. The Direct Connect locations are third-party colocation providers who act as meet-me points for AWS customers and the AWS Regions.  For example, our local AWS PartnerDRFortressconnects multiple ISPs in a data center in Hawaii to the AWS US West Region. We recommend having at least two ISPs for resilient applications, each providing connectivity across a separate subsea cable from Hawaii to the mainland. If one cable should fail for any reason, connectivity to AWS would still be available. The red links in figure 2 are the ISP-provided connectivity that spans the Pacific Ocean. This is a minimum starting point for business-critical applications and should be designed with additional Direct Connect links for greater resiliency.Architecting for high performance and resiliencyMoving from the network to the infrastructure and application layer, organizations have the option in building their application all in the cloud or in combination with an on-premises environment. An example of an application built all in the cloud is theLumiSightplatform in AWS built by local AWS Partner, DataHouse. LumiSight has helped dozens of organizations quickly and securely reopen safely during the pandemic.Other customers need a hybrid cloud architecture solution. These organizations require that their data processing and locally hosted applications analysis is close to other components within the island’s data center. With this proximity, they can deliver near real-time responses to their end users.AWS Outposts Familyextends the capabilities of an AWS Region to the island. This enables local businesses to build and run low latency applications on-premises on an AWS fully managed infrastructure. You can now deploy Compute, Storage, Containers, Data Analytics clusters, Relational, and Cache databases in high performance, redundant and secure infrastructure maintained by AWS. Outposts can be shipped to Hawaii, connecting to the us-west-1 or us-west-2 Regions.Another option for improving application performance is providing an efficient virtual desktop to access their applications anywhere.Amazon WorkSpacesprovides a secure, managed cloud-based virtual desktop experience. Many workers who bring their own device (BYOD) or work remotely use Workspaces to access their corporate applications securely. Workspaces use streaming protocols that provide a secure and responsive desktop experience to end users located in remote Regions, like Hawaii. Workspaces can quickly provide a virtual desktop without managing the infrastructure, OS versions, and patches. You can test your connection to Workspaces from Hawaii, or anywhere else in the world, at theConnection Health Check page.Architecting for resiliency in the infrastructure and application stack is vital for Business Continuity and Disaster Recovery (BCDR) plans. Organizations in Hawaii who are already using VMware can take advantage of creating a recovery site usingVMware Cloud on AWSas their solution for disaster recovery. The VMware Cloud on AWS is a fully managed VMware software-defined Data Center (SDDC) running on AWS, which provides access to native AWS services. Organizations can pair their on-premises vCenter and virtual machines to the fully managed vCenter and virtual machines residing in the cloud. The active Site Recovery Manager provides the automation of failing over and failing back applications between on-premises to the cloud DR site and vice versa. Additionally, organizations can define their SDDC in the us-west-2 Region using AWS Direct Connect to minimize the latency of replicating the data from and to the data centers in the islands.ConclusionOrganizations in Hawaii can build resilient and high performant cloud-based workloads with the help of AWS services in each layer of their workloads. Starting with the network layer, you can establish reliable and lower latency connectivity through redundant AWS Direct Connect connections. Next, for low latency, hybrid applications, we extend infrastructure capabilities locally through AWS Outposts. We also improve the user experience in accessing cloud-based applications by providing Amazon WorkSpaces as the virtual desktop. Finally, we build resilient infrastructure and applications using a familiar solution called VMware Cloud on AWS.To start learning the fundamentals and building on AWS, visit theGetting Started Resource Center.Marie YapMarie Yap is a Principal Solutions Architect for Amazon Web Services based in Hawaii. In this role, she helps various organizations begin their journey to the cloud. She also specializes in analytics and modern data architectures.Hang LongHang Long is a Principal Account Executive with AWS. He currently works to enable builders in Hawaii on their cloud journeys. His IT career has spanned application architecture design, cybersecurity, and operational management in Financial Services and Media and Entertainment.Nick SciarrilliNick Sciarrilli is an Enterprise Solutions Architect at Amazon Web Services. He works with AWS customers to provide guidance and technical assistance on AWS architectures.
Hawaii is building a digital economy for a sustainable future. Many local businesses are already embarking on their journey to the cloud to meet their customers’ growing demand for digital services. To access Amazon Web Services (AWS) on the US mainland, customers’ data must traverse through submarine fiber-optic cable networks approximately 2,800 miles across the […]
Marie Yap
Amazon WorkSpaces Architecture AWS Direct Connect AWS Outposts AWS VPN Intermediate (200)