菊池之裕 JAWS DAYS 2020 ONLINE AWS LT

1. © 2020, Amazon Web Services, Inc. or its Affiliates.
菊池 之裕/Yukihiro Kikuchi
2020/03/28
AWS Networking 2020
JAWS DAYS 2020 Online

2. © 2020, Amazon Web Services, Inc. or its Affiliates.
自己紹介
名前：菊池 之裕(きくち ゆきひろ)
所属：シニアソリューションアーキテクト ネットワークスペシャリスト
ロール：Network系サービスについてのご支援
経歴：ISP,IXP,VPN運用、開発を経てネットワーク機器、仮想ルー
タ販売会社のプリセールス、プロダクトSEからAWSへ
好きな AWS サービス:
AWS Transit Gateway,AWS Direct Connect,AWS Marketplace
2

3. © 2020, Amazon Web Services, Inc. or its Affiliates.
Networking update 2020

4. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Update for Networking（抜粋）
Amazon Route 53 Resolver endpoints for hybrid cloud are now available in the South America (São Paulo) and
Middle East (Bahrain) Regions
03/25/2020
AWS Transit Gateway Network Manager now includes support for AWS CloudFormation
03/23/2020
Use Amazon VPC Endpoint Policies for granular control of Amazon EC2 APIs
03/23/2020
AWS Global Accelerator launches TCP Termination at the Edge
03/23/2020
AWS Site-to-Site VPN now supports certificate authentication for connections to AWS Transit Gateway
03/20/2020
Amazon Elastic Container Service (Amazon ECS) now supports Service Discovery in three additional AWS regions
03/19/2020
Amazon VPC Flow Logs Now Support Resource Tagging and Tag-on-Create
03/17/2020
AWS App Mesh launches support for end to end encryption
03/16/2020
API Gateway offers private integrations with AWS ELB and AWS CloudMap as part of HTTP APIs GA release
03/13/2020
AWS App Mesh is now available in Asia Pacific (Hong Kong) Region
03/11/2020
Amazon VPC NAT Gateway Now Supports Tag-on-Create
03/09/2020
AWS adds the ability for customers to enable AWS Local Zones themselves
03/09/2020
Amazon VPC Endpoints For Amazon SQS Are Now Available In The Middle East (Bahrain) Region
03/03/2020
AWS Lambda@Edge now supports Node 12.x and Python 3.8
03/02/2020
Amazon FSx now enables you to create and use file systems in Shared Amazon Virtual Private Clouds (VPCs)
02/28/2020
AWS Global Accelerator now supports Bring Your Own IP Addresses and Resource Tagging
02/27/2020
Amazon CloudFront in China announces support for Usage and Activity Reports in the Console
02/21/2020
Amazon VPC Endpoints and Endpoint Services now support Tag-On Create
02/18/2020
Amazon EKS Announces Release of VPC CNI Version 1.6
02/14/2020
AWS App Mesh is now available in Europe (Stockholm), South America (São Paulo) and Middle East (Bahrain)
regions
02/13/2020
Amazon VPC Flow Logs Now Support 1-minute Aggregation Intervals
02/05/2020
Introducing the Desktop Client for AWS Client VPN
02/05/2020
New Digital Course: AWS Transit Gateway Networking and Scaling
01/28/2020
New Digital Course: Architecting Serverless Solutions
01/28/2020
AWS Cloud Map supports editing custom service instance attributes in the AWS Console
01/24/2020
Amazon VPC Ingress Routing Now Supports AWS CloudFormation
01/21/2020
Query Volume Metrics Now Available for Amazon Route 53 Resolver Endpoints
01/21/2020
AWS to Launch Standard AWS Region in Osaka in Early 2021
01/21/2020
AWS Direct Connect supports AWS Transit Gateway for AWS Middle East (Bahrain) Region
01/17/2020
AWS Client VPN now Supports Port Configuration
01/16/2020
AWS Transit Gateway is Now Available in the Europe (Stockholm) AWS Region
01/14/2020
Amazon CloudFront launches in five new countries - Bulgaria, Greece, Hungary, Kenya, and Romania
01/10/2020
Amazon Route 53 Resolver Endpoints for Hybrid Cloud Now Available in the Asia Pacific (Hong Kong) AWS
Region
01/09/2020
AWS PrivateLink now supports Private DNS names for internal and 3rd party services
01/06/2020
AWS Direct Connect supports AWS Transit Gateway for AWS Asia Pacific (Hong Kong) Region
01/06/2020
AWS Step Functions now supports AWS PrivateLink

5. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Update for Networking（抜粋）
Amazon Route 53 Resolver endpoints for hybrid cloud are now available in the South America (São Paulo) and
Middle East (Bahrain) Regions
03/25/2020
AWS Transit Gateway Network Manager now includes support for AWS CloudFormation
03/23/2020
Use Amazon VPC Endpoint Policies for granular control of Amazon EC2 APIs
03/23/2020
AWS Global Accelerator launches TCP Termination at the Edge
03/23/2020
AWS Site-to-Site VPN now supports certificate authentication for connections to AWS Transit Gateway
03/20/2020
Amazon Elastic Container Service (Amazon ECS) now supports Service Discovery in three additional AWS regions
03/19/2020
Amazon VPC Flow Logs Now Support Resource Tagging and Tag-on-Create
03/17/2020
AWS App Mesh launches support for end to end encryption
03/16/2020
API Gateway offers private integrations with AWS ELB and AWS CloudMap as part of HTTP APIs GA release
03/13/2020
AWS App Mesh is now available in Asia Pacific (Hong Kong) Region
03/11/2020
Amazon VPC NAT Gateway Now Supports Tag-on-Create
03/09/2020
AWS adds the ability for customers to enable AWS Local Zones themselves
03/09/2020
Amazon VPC Endpoints For Amazon SQS Are Now Available In The Middle East (Bahrain) Region
03/03/2020
AWS Lambda@Edge now supports Node 12.x and Python 3.8
03/02/2020
Amazon FSx now enables you to create and use file systems in Shared Amazon Virtual Private Clouds (VPCs)
02/28/2020
AWS Global Accelerator now supports Bring Your Own IP Addresses and Resource Tagging
02/27/2020
Amazon CloudFront in China announces support for Usage and Activity Reports in the Console
02/21/2020
Amazon VPC Endpoints and Endpoint Services now support Tag-On Create
02/18/2020
Amazon EKS Announces Release of VPC CNI Version 1.6
02/14/2020
AWS App Mesh is now available in Europe (Stockholm), South America (São Paulo) and Middle East (Bahrain)
regions
02/13/2020
Amazon VPC Flow Logs Now Support 1-minute Aggregation Intervals
02/05/2020
Introducing the Desktop Client for AWS Client VPN
02/05/2020
New Digital Course: AWS Transit Gateway Networking and Scaling
01/28/2020
New Digital Course: Architecting Serverless Solutions
01/28/2020
AWS Cloud Map supports editing custom service instance attributes in the AWS Console
01/24/2020
Amazon VPC Ingress Routing Now Supports AWS CloudFormation
01/21/2020
Query Volume Metrics Now Available for Amazon Route 53 Resolver Endpoints
01/21/2020
AWS to Launch Standard AWS Region in Osaka in Early 2021
01/21/2020
AWS Direct Connect supports AWS Transit Gateway for AWS Middle East (Bahrain) Region
01/17/2020
AWS Client VPN now Supports Port Configuration
01/16/2020
AWS Transit Gateway is Now Available in the Europe (Stockholm) AWS Region
01/14/2020
Amazon CloudFront launches in five new countries - Bulgaria, Greece, Hungary, Kenya, and Romania
01/10/2020
Amazon Route 53 Resolver Endpoints for Hybrid Cloud Now Available in the Asia Pacific (Hong Kong) AWS
Region
01/09/2020
AWS PrivateLink now supports Private DNS names for internal and 3rd party services
01/06/2020
AWS Direct Connect supports AWS Transit Gateway for AWS Asia Pacific (Hong Kong) Region
01/06/2020
AWS Step Functions now supports AWS PrivateLink
37個もありました！

6. © 2020, Amazon Web Services, Inc. or its Affiliates.
きりがないので、3つ説明します
• Transit Gateway/VPN/Direct Connect
• VPC
• ELB

7. © 2020, Amazon Web Services, Inc. or its Affiliates.
Transit Gateway

8. © 2020, Amazon Web Services, Inc. or its Affiliates.
Reference Network
Architecture
AWSVPN AWS Direct
Connect
Account Account Account Account IAM, cross-account roles
Route
tables
Route
tables
Transit Gateway
Account Account
Account Account
Account Account
Account Account
Account Account
Account Account
Internet

9. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWS Region
Transit Gateway
ENIs
VPN
Routing domain
Routing domain
AWS Direct
Connect
Regional router
• CentralizeVPN andAWS Direct
Connect
Scalable
• Thousands ofVPCs
across accounts
• Spread traffic over manyVPN
connections
• AcceleratedVPN - new
Flexible routing
• Network interfaces in subnets
• Control segmentation and sharing
with routing
• Inter-region routing - new
Multicast Support
• Multicast Routing – new
Operations / Management
• TGW Network Manager – new
Transit Gateway – 2020

10. © 2020, Amazon Web Services, Inc. or its Affiliates.
Transit GatewayのMulticast対応
• Multicast
• AWS Transit Gatewayの機能として、データスト
リームを仮想的に複数のアプリケーションに配信
することが可能に
• 株価配信やマルチメディアコンテンツ配信など、
データを購読者にストリームする際に最適
• バージニアのリージョンで利用可能
AWS Transit Gateway
Instance
Instance Instance
Traditional
server

11. © 2020, Amazon Web Services, Inc. or its Affiliates.
注意する点
• OSPFやVRRPを使うための機能ではない
• IGMP(v2)は当初未サポート
• 手動登録の必要があります。

12. © 2020, Amazon Web Services, Inc. or its Affiliates.
Transit Gateway リージョン間接続
• リージョン間ピアリング
• 各リージョンに構成したAWS Transit Gatewayをリージョン間でピアリ
ングすることができるようになった
• 各リージョンにまたがるグローバルネットワークを構成可能になり、ト
ラフィックは常にAWSの回線を通過する
• さらにその通信経路はSPOFがないよう冗長化され、リージョン間トラ
フィックは暗号化が行われる
• バージニア、オハイオ、オレゴン、アイルランド、フランクフルトで利
用可能
• クロスアカウント接続可能
• Peeringにはアタッチメント料金がかかり、Peeringのデータアウトは
データ通信量にはカウントされない
• 通常のリージョン間データ転送料金はかかる
AWS Transit Gateway
InstanceInstance
AWS Transit Gateway

13. © 2020, Amazon Web Services, Inc. or its Affiliates.
Transit Gateway Network Manager
• Transit Gatewayを介したAWS/オンプレミスのグ
ローバルネットワークを可視化し、モニタリング
するダッシュボードを提供
• クラウドとオンプレミスの双方を単一のダッシュ
ボードで可視化・監視することができるようにな
る
• ネットワークの監視にはCloudWatchメトリクス
や、CloudWatch Eventsを利用して行う
• SD-WANパートナのソリューションを利用してい
る場合、自動的に接続し管理対象として登録して
くれる
• 東京を含む各リージョンで利用可能

14. © 2020, Amazon Web Services, Inc. or its Affiliates.
ネットワークマップの例

15. © 2020, Amazon Web Services, Inc. or its Affiliates.
Direct Connect Gateway Update
Direct Connect GatewayとVPCは同一支払いアカウントであれば、
別のアカウントでもアタッチ可能（2019/10/4 制限削除※1）
オフィス
データセンター
VGW
接続：Owner A
VPC:Account X
VPC:Account X
VPC:AccountY
DXGW:Account X
Direct Connect
Gateway
Direct Connect 接続
Private VIF
AWS
ルーター
VGW
VGW
VIF:Account X
DXGWと別アカウントの
VPCもアタッチ可能
DXGWと別アカウントの
VPCもアタッチ可能
DXGWと別アカウントの
VPCもアタッチ可能
DXGWと別アカウントの
VPCもアタッチ可能
※1 https://aws.amazon.com/jp/about-aws/whats-new/2019/10/aws-direct-connect-aws-direct-connect-announces-the-support-for-granular-cost-allocation-and-removal-of-
payer-id-restriction-for-direct-connect-gateway-association/

16. © 2020, Amazon Web Services, Inc. or its Affiliates.
VPC

17. © 2020, Amazon Web Services, Inc. or its Affiliates.
AmazonVPC Ingress Routing
• サードパーティ製品をAWS環境で活用することが
容易になる新機能を発表
• Internet Gateway/VGWに対するアウトバウンド・
インバウンド双方のトラフィックを特定EC2イン
スタンスのENIに向ける事ができる
• VPCに出入りする全トラフィックが特定EC2イン
スタンスを通過することを強制するため、IDS/IPS
やFirewallによる監視・通信制御を効果的に実行可
能になる
• Amazon VPCのIngress Routingは全てのリージョ
ンで利用可能

18. © 2020, Amazon Web Services, Inc. or its Affiliates.
ELB(ALB)

19. © 2020, Amazon Web Services, Inc. or its Affiliates.
ALBが重み付け負荷分散をサポート
• Application Load Balancerに紐付けられたターゲッ
トグループ毎に流入するトラフィック量を制御で
きるようになった
• ターゲットグループ毎に0-999の重みを設定する
と、それぞれが全体に占める割合に応じたトラ
フィックが流入するようALBが制御する
• Blue/Greenデプロイやカナリアリリースを行いた
いときにも有益
• すべてのリージョンで利用でき、追加費用はなし
Instances Instances
Application Load Balancer
TargetGroup #1 TargetGroup #2

20. © 2020, Amazon Web Services, Inc. or its Affiliates.
ALBがLORアルゴリズムによる負荷分散に対応
Application Load BalancerでLeast Outstanding
Requests(LOR)アルゴリズムが利用可能になった
処理中のリクエスト数が最小のインスタンスに新たなト
ラフィックをルーティングするように動作する
従来のアルゴリズムではリクエストの内容によって負荷
が変わる場合に、負荷のムラを抑えることが期待できる
Spot Fleetなどでバックエンドのインスタンスタイプが
混在している場合や、WebSocketのように持続する接続
を分散したい場合に有益
Application Load Balancer
Instance Instance

21. © 2020, Amazon Web Services, Inc. or its Affiliates.
まとめ
• Transit Gateway/VPN/Direct Connect
• VPC
• ELB（ALB）
どんどん進化するAWSネットワーク ご期待ください！

22. © 2020, Amazon Web Services, Inc. or its Affiliates.
ありがとうございました！