Ensure Workload Resiliency and Comply with Data Residency Requirements with AWS Outposts
AWS Architecture BlogEnsure Workload Resiliency and Comply with Data Residency Requirements with AWS Outpostsby Pedram Jahangiri, Burak Gozluklu, and Suliman Lei | on07 SEP 2021| inArchitecture,AWS Outposts,Healthcare,Power & Utilities|Permalink|SharePersonally Identifiable Information (PII) and Personal Health Information (PHI) data are critical to the continued operation of healthcare organizations.Disaster recovery (DR)strategies must ensure that healthcare provider workloads with PII and PHI data operate with near-zero data lossrecovery point objective (RPO)andrecovery time objective (RTO). In most cases, an organization would typically use amulti-Region active/active strategyfor DR to achieve this goal.However, in a country like the UK where there is only oneAWS Regionavailable, you can’t use the typical approach to set up a multi-Region DR strategy. Additionally, laws like theUK General Data Protection Regulation (UK GDPR)apply to many businesses and organizations. These data residency requirements protect the privacy of data and workloads by storing and processing data within a particular country or geographic location.In this post, we show you a use case from a healthcare organization in the UK. This example shows you how to set up a modified multi-Region DR strategy that uses one Region andAWS Outpoststo ensure the resiliency of your workload and address data residency requirements. While our use case applies to healthcare, this solution can be applied to any industry where you need a highly available workload that must meet data residency requirements.Overview of AWS OutpostsWith Outposts, you get same reliable, secure, and high-performance infrastructure as AWS Cloud. It also provides services, APIs, tools for automation, deployment pipelines, and security controls.Outposts are racks (as shown in Figure 1) moved from a Region and placed in your local data center. They are typicallyconnected to a RegionusingAWS Direct Connector anAWS VPN. These racks reside in a particular country, state, or municipality for regulatory, contractual, or security reasons. They provide a secondary data store in the same country or geographic area, which can be independent from the Region.Outposts offers similar AWS infrastructure, AWS services, APIs, and tools to almost any data center, co-location space, or on-premises facility for a consistent integrated experience. They can run in any facility. AWS will deliver, install, and maintain the hardware infrastructure. If you do not want to host Outposts long term, you can migrate your applications to anAWS Local Zoneor a Region.Figure 1. Outpost (open standard 42U rack)Addressing UK GDPR requirements and maintaining workload RTO/RPOFor our use case, we worked with a healthcare organization in the UK. Their workload presented us with a couple of uncommon requirements. We had to set up a multi-Region DR strategy to comply with UK GDPR data residency requirements for PHI and PII data, and only one Region (eu-west-2 in London) was available.Implementing a multi-Region DR strategy with AWS OutpostsTo maintain business continuity in the event of a disaster, we physically installed an Outposts rack in the customer’s on-premises location in the UK. We selected the Outpost’s parent Region as another Region (Ireland). This way, the Outpost’s control plane stays accessible if the London Region is impacted by an outage.All customer and workload data is stored locally in the UK in Outposts and provisioned byAmazon Elastic Block Store (Amazon EBS)andAmazon Simple Storage Service (Amazon S3). It is then synced between the workload Region (London Region) and the Outpost.With the architecture shown in Figure 2, only control plane traffic such as instance health, instance activity (launched, stopped), and the underlying hypervisor system is sent back to the parent Region (Ireland). This information allows us to provide alerts on instance health and capacity and apply patches and updates to the Outpost.Figure 2. Architecture for a multi-Region setup using a Region and OutpostMeeting data residency requirementsIn our architecture, no customer data gets transferred out of the country. Also, through Direct Connect, all IP addressing is private. No public IPs are required.The data plane path for the Outposts local gateway travels from the Outpost, through the local gateway, and to a private local gateway LAN segment. It then follows a private path back to the AWS service endpoints in the London Region through Direct Connect.Figure 3 shows how to connect Outposts to a local network:The local network equipment is connected via ports provided in the Outpost’s top of rack (TOR) switches.Virtual interfaces (VIFs) are mapped to VLANs using Link Aggregation Control Protocol (LACP).The new local gateway (LGW) on the Outpost routes traffic to and from the local network using these VIFs.Figure 3. How to connect Outposts to your local networkSummaryThis post outlines our solution for running mission-critical workloads that need multi-Region environments and have data residency requirements. We showed you how to configure an Outpost to use a control plane in an external Region. This limits workload traffic to the country with the data residency requirement.Our use case applies to healthcare. However, this solution is widely applicable. It can be used for other industries, such as power and utilities, that have workloads that need a multi-Region DR strategy and must meet data residency requirements. To deploy an Outpost in your facility, follow the steps inGetting Started with AWS Outposts.Pedram JahangiriPedram is an Enterprise Solution Architect with AWS, with a PhD in Electrical Engineering. He has 10+ years experience in the energy and IT industry. Pedram has many years of hands-on experience in all aspects of Advanced Analytics for building quantitative and large-scale solutions for enterprises by leveraging cloud technologies.Burak GozlukluI am a Solutions Architect located in Boston, MA. Before joining AWS, I was a post-doctoral fellow at MIT in Cambridge, MA. I have a PhD in Aerospace engineering from METU and MSc in Systems Engineering from MIT. My deep technical expertise is AI/ML and Aerospace engineering.Suliman LeiSuliman Lei is a GreenField Solutions Architect with AWS.
Personally Identifiable Information (PII) and Personal Health Information (PHI) data are critical to the continued operation of healthcare organizations. Disaster recovery (DR) strategies must ensure that healthcare provider workloads with PII and PHI data operate with near-zero data loss recovery point objective (RPO) and recovery time objective (RTO). In most cases, an organization would typically […]
Pedram Jahangiri
Architecture AWS Outposts Healthcare Power & Utilities