Augmenting VMware Cloud on AWS Workloads with Native AWS services
AWS Architecture BlogAugmenting VMware Cloud on AWS Workloads with Native AWS servicesby Talha Kalim and Harsha Sanku | on26 AUG 2021| inAmazon CloudFront,Amazon Elastic File System (EFS),Amazon FSx,Amazon VPC,Architecture,AWS Transit Gateway,Intermediate (200),VMware Cloud on AWS|Permalink|ShareVMware Cloud on AWSallows you to quickly migrate VMware workloads to a VMware-managed Software-Defined Data Center (SDDC) running in the AWS Cloud and extend your on-premises data centers without replatforming or refactoring applications.You can use native AWS services with Virtual Machines (VMs) in the SDDC, to reduce operational overhead and lower your Total Cost of Ownership (TCO) while increasing your workload’s agility and scalability.This post covers patterns for connectivity between native AWS services and VMware workloads. We also explore common integrations, including using AWS Cloud storage from an SDDC, securing VM workloads using AWS networking services, and using AWS databases and analytics services with workloads running in the SDDC.Networking between SDDC and native AWS servicesEstablishing robust network connectivity with VMware Cloud SDDC VMs is critical to successfully integrating AWS services. This section shows you different options to connect the VMware SDDC with yournative AWS account.The simplest way to get started is to use AWS services in the connectedAmazon Virtual Private Cloud (VPC)that is selected during theSDDC deployment process. Figure 1 shows this connectivity, which is automatically configured and available once the SDDC is deployed.Figure 1. SDDC to Customer Account VPC connectivity configured at deploymentThe SDDC Elastic Network Interface (ENI) allows you to connect to native AWS services within the connected VPC, but it doesn’t provide transitive routing beyond the connected VPC. For example, it will not connect the SDDC to other VPCs and the internet.If you’re looking to connect to native AWS services in multiple accounts and VPCs in the same AWS Region, you have two connectivity options. These are explained in the following sections.Attaching VPCs to VMware Transit ConnectWhen you need high-throughput connectivity in a multi-VPC environment, useVMware Transit Connect (VTGW), as shown in Figure 2.Figure 2. Multi-account VPC connectivity through VMware Transit Connect VPC attachmentsVTGW uses a VMware-managedAWS Transit Gatewayto interconnect SDDCs within an SDDC group. It also allows you to attach your VPCs in the same Region to the VTGW by providing connectivity to any SDDC within the SDDC group.Connecting through an AWS Transit GatewayTo connect to your VPCs through an existing Transit Gateway in your account, use IPsec virtual private network (VPN) connections from the SDDC with Border Gateway Protocol (BGP)-based routing, as shown in Figure 3. Multiple IPsec tunnels to the Transit Gateway use equal-cost multi-path routing, which increases bandwidth by load-balancing traffic.Figure 3. Multi-account VPC connectivity through an AWS Transit GatewayFor scalable, high throughput connectivity to an existing Transit Gateway, connect to the SDDC via a Transit VPC that is attached to the VTGW, as shown in Figure 3. You must manually configure the routes between the VPCs and SDDC for this architecture.In the following sections, we’ll show you how to use some of these connectivity options for common native AWS services integrations with VMware SDDC workloads.Reducing TCO with Amazon EFS, Amazon FSx, and Amazon S3As you are sizing your VMware Cloud on AWS SDDC, consider using AWS Cloud storage for VMs that provide files services or require object storage. Migrating these workloads to cloud storage likeAmazon Simple Storage Service (Amazon S3),Amazon Elastic File System (Amazon EFS), orAmazon FSxcan reduce your overall TCO through optimized SDDC sizing.Additionally, you can reduce the undifferentiated heavy lifting involved with deploying and managing complex architectures for file services in VM disks. Figure 4 shows how these services integrate with VMs in the SDDC.Figure 4. Connectivity examples for AWS Cloud storage servicesWe recommend connecting to your S3 buckets via the VPC gateway endpoint in the connected VPC. This is a more cost-effective approach because it avoids the data processing costs associated with a VTGW andAWS PrivateLink for Amazon S3.Similarly, the recommended approach for Amazon EFS and Amazon FSx is to deploy the services in the connected VPC for VM access through the SDDC elastic network interface. You can also connect to existing Amazon EFS and Amazon FSx file shares in other accounts and VPCs using a VTGW, but consider the data transfer costs first.Integrating AWS networking and content delivery servicesUsing variousAWS networking and content deliveryservices with VMware Cloud on AWS workloads will provide robust traffic management, security, and fast content delivery. Figure 5 shows how AWS networking and content delivery services integrate with workloads running on VMs.Figure 5. Connectivity examples for AWS networking and content delivery servicesDeployElastic Load Balancing (ELB)services in a VPC subnet that has network reachability to the SDDC VMs. This includes the connected VPC over the SDDC elastic network interface, a VPC attached via VTGW, and VPCs attached to a Transit Gateway connected to the SDDC.VTGW connectivity should be used when the design requires using existing networking services in other VPCs. For example, if you have a dedicated internet ingress/egress VPC. An internal ELB can also be used for load-balancing traffic between services running in SDDC VMs and services running within AWS VPCs.UseAmazon CloudFront, a global content delivery service, to integrate with load balancers, S3 buckets for static content, or directly with publicly accessible SDDC VMs. Additionally, useAmazon Route 53to provide public and privateDNS services for VMware Cloud on AWS. Deploy services such asAWS WAFandAWS Shieldto provide comprehensive networksecurity for VMware workloadsin the SDDC.Integrating with AWS database and analytics servicesData is one the most valuable assets in an organization, and databases are often the most demanding and critical workloads running in on-premises VMware environments.A common customer pattern to reduce TCO for storage-heavy or memory-intensive databases is to use purpose-builtDatabases on AWSlikeAmazon Relational Database Service (RDS). Amazon RDS lets you migrate on-premises relational databases to the cloud and integrate it with SDDC VMs. Using AWS databases also reduces operational overhead you may incur with tasks associated with managing availability, scalability, and disaster recovery (DR).WithAWS Analytics services integrations, you can take advantage of the close proximity of data within VMware Cloud on AWS data stores to gain meaningful insights from your business data. For example, you can useAmazon Redshiftto create a data warehouse to run analytics at scale on relational data from transactional systems, operational databases, and line-of-business applications running within the SDDC.Figure 6 shows integration options for AWS databases and analytics services with VMware Cloud on AWS VMs.Figure 6. Connectivity examples for AWS Database and Analytics servicesWe recommend deploying and consuming database services in the connected VPC. If you have existing databases in other accounts or VPCs that require integration with VMware VMs, connect them using the VTGW.Analytics services can involve ingesting large amounts of data from various sources, including from VMs within the SDDC, creating a significant amount of data traffic. In such scenarios, we recommend using the SDDC connected VPC to deploy any required interface endpoints for analytics services to achieve a cost-effective architecture.SummaryVMware Cloud on AWS is one of the fastest ways to migrate on-premises VMware workloads to the cloud. In this blog post, we provided different architecture options for connecting the SDDC to native AWS services. This lets you evaluate your requirements to select the most cost-effective option for your workload.The example integrations covered in this post are common AWS service integrations, including storage, network, and databases. They are a great starting point, but the possibilities are endless. Integrating services likeAmazon Machine Learning (Amazon ML), andServerless on AWSallows you to deliver innovative services to your users, often without having to re-factor existing application backends running on VMware Cloud on AWS.Additional ResourcesIf you need to integrate VMware Cloud on AWS with an AWS service, explore the following resources andreach out to us at AWS.VMware Cloud on AWS Reference ArchitecturesVMware Cloud on AWS Networking Reference ArchitectureStorage options and designs for VMware Cloud on AWSHow to Integrate VMware Cloud on AWS Datastores with AWS Analytics ServicesTAGS:SDDCTalha KalimTalha Kalim is a Specialist Solutions Architect with AWS specializing in VMware Cloud on AWS, AWS Outposts, and AWS Snow Family. He has a BS in Computer Science and over 10 years of experience designing and building infrastructure solutions across different industries. Talha works with customers to design solutions using VMware Cloud on AWS and AWS Outposts helping them accelerate their journey to the cloud.Harsha SankuHarsha Sanku is a Solutions Architect at AWS specializing in VMware Cloud on AWS and AWS Outposts. Prior to joining AWS, Harsha spent over a decade designing and deploying VMware based converged and hyper-converged infrastructure for customers at their on-premises data centers. Harsha has a Bachelors in Computer Applications and a Masters in Information Technology. He has been working in the IT industry since 2006.
VMware Cloud on AWS allows you to quickly migrate VMware workloads to a VMware-managed Software-Defined Data Center (SDDC) running in the AWS Cloud and extend your on-premises data centers without replatforming or refactoring applications. You can use native AWS services with Virtual Machines (VMs) in the SDDC, to reduce operational overhead and lower your Total […]
Talha Kalim
Amazon CloudFront Amazon Elastic File System (EFS) Amazon FSx Amazon VPC Architecture AWS Transit Gateway Intermediate (200) VMware Cloud on AWS