1. Welcome! 4:00 – 4:15 PM: socialize 4:15 – 5:00 PM: Overview of Microsoft Azure cloud platform toolbox 5:00 – 5:30 PM: networking break with snacks & food packs 5:30 – 6:15 PM: Cloud Architecture Patterns & Anti-Patterns 6:15 – 6:30 PM: give aways and wrap up Thanks to Finomial, our host:

2. Contents © 2015 Bill Wilder Microsoft Azure Overview It’s a toolbox Bill Wilder, Finomial CTO @codingoutloud codingoutloud@gmail.com blog.codingoutloud.com linkedin.com/in/billwilder Kolkata Azure 21-Aug-2015

3. the term “cloud” is nebulous… multiple types of cloud platform

4. “Bring Your Own” ____ as a Service NIST: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

5. Why Azure?

6. IaaS According to Gartner http://www.gartner.com/technology/reprints.do?id=1-1IMDMZ8&ct=130819&st=sb http://www.gartner.com/technology/reprints.do?id=1-1IMDMZ8&ct=130819&st=sb Aug 2013

7. PaaS According to Gartner http://www.gartner.com/technology/reprints.do?ct=140108&id=1-1P502BX&st=sb http://www.gartner.com/technology/reprints.do?ct=140108&id=1-1P502BX&st=sb Jan 2014

8. Azure is a Toolbox Key Point to remember!

9. Azure is a Toolbox Code your app Deploy your app Host your app source code Host your app database Manage and Monitor your app User management Integration (hybrid cloud) Dev/Test Automate Operations And much much much much more…

10. Amount we’ll touch on

11. Code Your App Visual Studio integration & cross-platform tooling Platform support for PaaS and IaaS Fast-start templates for creating a web site in many languages / toolkits Supports many frameworks and languages – ASP.NET, Node.js, Python, Java, PHP, … DEMO

12. Deploy Your App Visual Studio Online (VSO) Continuous Deployment (CD) from VSO, github, others DEMO

13. Monitor Your App: App Insights Monitoring support Alerting support Services for gathering logs – “pets vs. cattle” Application Insights DEMO

14. Automating Automation: RunBooks I have stuff to automate … … with PowerShell On a schedule or ad hoc Might have sensitive credentials Might require auditing DEMO

15. A Tale of Two Portals

16. Where’s Azure? A global map: http://azuremap.blob.core.wind ows.net/apps/bingmap- geojson-display.html

17. Azure “Geo” Coming to India http://www.business-standard.com/article/news-ians/microsoft-s-private-preview-of-cloud-services-from-india-in-july-115060401040_1.html http://news.microsoft.com/en-in/microsoft-announces-commercial-cloud-services-from-local-datacenters-by-end-2015/ “Microsoft Announces Commercial Cloud Services from Local Datacenters by End 2015” “Microsoft's private preview of cloud services from India in July”

18. What’s Next? There’s a lot MORE to Azure! http://www.meetup.com/KolkataAzure/ Free Trial: MSDN credits Free ebook: Microsoft Azure Essentials Fundamentals of Azure

19. Questions?

20. Take a Break 5:00 – 5:30 PM: networking break with snacks & food packs 5:35 – 6:20 PM: Cloud Architecture Patterns & Anti-Patterns 6:20 – 6:30 PM: give aways and wrap up

21. Content © 2015 Bill Wilder Cloud Architecture Patterns & Anti-Patterns Some bad ideas and some better ones Bill Wilder, Finomial CTO @codingoutloud codingoutloud@gmail.com blog.codingoutloud.com linkedin.com/in/billwilder Kolkata Azure 21-Aug-2015

22. Contents © 2015 Bill Wilder Cloud Architecture Patterns & Anti-Patterns Some bad ideas and some better ones Bill Wilder, Finomial CTO @codingoutloud codingoutloud@gmail.com blog.codingoutloud.com linkedin.com/in/billwilder Kolkata Azure 21-Aug-2015 Find this slide deck here

23. www.bostonazure.org www.cloudarchitecturepatterns.com

24. My name is Bill Wilder Bill Wilder @codingoutloud blog.codingoutloud.com

25. Lots of ♥ to all the clouds etc…

26. 26

27. Architect Skills Technical Business Decisions

28. 28 Famous Architect: Aristotle On Properties: Essential property = must have Accidental property = happens to have but could lack For effective software architect, all are Essential Properties Technology Skills Ability to Communicate Business Awareness

29. 29 Business Awareness

30. 30 Top 10 “Blunders” by Enterprise Architects #3. Not engaging the business partners #2. Insufficient understanding and support from stakeholders #1. The Wrong Lead Architect (for non- technical reasons) #7. Not … Communicating the Impact #10. Not Spending Enough Time on Communications Source http://www.sdtimes.com/link/33787 The top 10 enterprise architecture blunders By Alex Handy, September 25, 2009http://www.sdtimes.com/link/33787Alex Handy

31. To cloud or not to cloud? control vs. cost

32. Ctrl € $¥

33. Ctrl € $¥ Technology Skills Ability to Communicate Business Awareness

34. Cloud Services … in the Cloud “who would’ve thought” Cloud is a business innovation  technology services + flexible rental model  new types and combinations of services

35. 1/9 th above water  Services: TTM & Sleeping well  SOA

36. Treating your ops team as equivalent to the cloud vendor’s ops team (They are not. Let cloud vendor handle service operations. Use services. You focus on your app.) Anti-Pattern #1

37. What is an Anti-Pattern Wikipedia says: (http://en.wikipedia.org/wiki/Anti-pattern)http://en.wikipedia.org/wiki/Anti-pattern “A common response to a recurring problem that is usually ineffective and risks being highly counterproductive.” Bill’s amplification: “An anti-pattern approach may seem reasonable, or actually be reasonable in other contexts. There may be problems that are not yet be apparent.” Often depends on the situation. This talk will span: Architecture and Architects

38. N-tier, SOA, μSvcs Multi-data center Horizontal scaling Expects failure Eventual consist Traditional Cloud-Native 2-tier Single data center Vertical scaling Ignores failure Transactional consist Less flexible More manual/attention Less reliable (SPoF) Maintenance window Less scalable, more $$ Agile/faster TTM Auto-scaling Self-healing HA Geo-LB/FO TELLS/CLUES CONSEQUENCES Tells: Traditional vs Cloud-Native   Which is “best” architecture? There is no “best” architecture – it is situational, a Technical Business Decision. Cloud-native popularity growing in proportion to the shrinking cost and competitive benefits.

39. One-size-fits-all architecture Anti-Pattern #2

40. [Cloud] Anti-Pattern Causes Abstraction misalignment Not reading the fine print Insufficient ongoing attention to cost Insufficient ongoing attention to automation

41. www.pageofphotos.com (PoP)

42. Move Simple PoP App to Cloud WHAT NOW?

43. Scalability & Performance & Cost & Automation

44. Are Cloud Resources Infinite? “We often hear that public cloud platforms offer the illusion of infinite resources. Obviously, resources are not literally infinite (infinite is rather a lot), but you can expect that any time you need more resources, they will be available (though not always instantly). This does not mean each resource has infinite capacity, just that you can request as many instances of the type of resource that you need.” Page 21, my (Bill Wilder’s) Cloud Architecture Patterns book

45. Time passes… PoP has lots of photos

46. www.pageofphotos.com

47. One-size-fits-all data storage (perf, scalability, cost) Anti-Pattern #3

48. Upgrade to scenario-specific storage Some $, Perf, Scale benefits

49. PoP uses Valet Key Pattern Even more $, Perf, Scale benefits

50. CDN for public content Many, many other storage options also available: NoSQL varieties, caches, etc.

51. Always access raw data (regardless of distance, cost) (performance, scalability, cost) Anti-Pattern #4

52. Scalability != Performance ∞ performance does not imply ∞ scale (but sure would be a good start!) “Performance is what an individual user experiences; scalability is how many users get to experience it.” Page 8, my (Bill Wilder’s) Cloud Architecture Patterns book

53. PoP web tier goes multi-instance… Users experiencing login issues * *Depending on configuration …

54. Are Cloud Resources Infinite? “We often hear that public cloud platforms offer the illusion of infinite resources. … This does not mean each resource has infinite capacity, just that you can request as many instances of the type of resource that you need.” Page 21, my (Bill Wilder’s) Cloud Architecture Patterns book

55. Running stateful VMs in web / service tiers (Limits horizontal scalability & complicates autoscale – but sometimes is reasonable option) Anti-Pattern #5

56. I don’t have a slide on this, so won’t mention it, but there’s also … sharding

57. Reliability

58. Treating commodity cloud VMs like the super- reliable iron your company buys. (Not internally redundant; failure is routine (not frequent); optimized for value.*) Anti-Pattern #99

59. PoP Adding Video Support (uh oh!)

60. Current

61. Let’s extend PoP with a Service Tier

62. REQUEST / RESPONSE (http + json) OPTION 1: Request/Response Services Services Tier Web Tier Data Tier Stateless Services web browser

63. Coupling Between Tiers (reliability, scalability, cost) (Situational: I frequently violate! Also relates to microservices.) Anti-Pattern #6

64. Cloud Platform Reliable Queues Azure Storage or ServiceBus Queue AWS Simple Queue Service Google Pub/Sub Durable – won’t lose your data Reliable – backed by SLA and ops team Scalable – Internet scale Approachable – REST + many SDKs

65. Basic Idea Reliable Queue Work Producers Work Consumers

66. OPTION 2: Async Services Services Tier Web Tier Data Tier Stateless Services web browser push pull

67. Stateless Services Notice anything “missing” ? There is no transaction Get used to idea of eventual consistency

68. Enables Responsive UX Response to interactive users is as fast as a work request can be persisted UX challenge due to async processing – Eventual consistency processing – Eventual satisfaction for users

69. Enables More Reliable Service Decoupled front/back provides insulation Blocking is bane of scalability

70. Limit yourself to transactionally-friendly operations (reliability, scalability, cost) Anti-Pattern #99

71. General Case: Many Queue Types Web Role (IIS) Web Role (IIS) Worker Role Worker Role Web Role (IIS) Web Role (IIS) Web Tier (Public) Web Tier (Public) Worker Role Worker Role Worker Role Worker Role Service Tier Type 1 Worker Role Worker Role Worker Role Worker Role Worker Role Worker Role Worker Role Type 2 Worker Role Type 2 Queue Type 1 Queue Type 2 Queue Type 1 Queue Type 2 Queue Type 3 Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Service Tier Type 2 Service Tier Type 2 Web Tier (Admin) Web Tier (Admin)

72. Enables Cost-Efficient Scaling Loosely coupled, concern-independent scaling Get Scale Units right Optimize for CO$T EFFICIENCY GOAL: cost α benefit

73. How about the queue API?

74. A reliable queue works just like any other queue, right? (beware the abstraction mismatch) Anti-Pattern #7

75. Reliable Queue & 2-step Delete Web Tier Web Tier Service Tier var url = “http://pageofphotos.blob.core.windows.net/up/.png”; queue.AddMessage( new CloudQueueMessage( url ) ); var invisibilityWindow = TimeSpan.FromSeconds( 10 ); CloudQueueMessage msg = queue.GetMessage( invisibilityWindow ); (… do some processing then …) Queue queue.DeleteMessage( msg );

76. Idempotent Processing An idempotent operation can be performed more than once without changing the end result. Key technique in lieue of distributed transactions

77. Poison Message Detection A poison message is a flawed message that can never be successfully processed.

78. QCW requires “Plan for Failure” VM restarts will happen – Hardware failure, O/S patching, crash (bug) Bake in handling of restarts into our apps – Restarts are routine: system “just keeps working” – Idempotent support needed important – Event Sourcing (commonly seen with CQRS) may help Not an exception case! Expect it! Consider N+1 Rule

79. Typical SiteAny 1 Role InstOverall System Operating System Upgrade Application Code Update Scale Up, Down, or In Hardware Failure Software Failure (Bug) Security Patch What’s Up? Reliability as EMERGENT PROPERTY

80. What about the DATA? You: Azure Web Roles and Azure Worker Roles – Taking user input, dispatching work, doing work – Follow a decoupled queue-in-the-middle pattern – Stateless compute nodes Cloud: “Hard Part”: persistent, scalable data – Azure Queue & Blob Services – Three copies of each byte – Geo-replicated to sister data center – Busy Signal Pattern

81. Tiers of Cloud Failure Transient API/DB connection failures Temporary/Ephemeral drive loss DC outage (or smoking hole) Zone/Region outage (or smoking hole) Global outage

82. “Failure is not an option” (Failure is routine, at least at lower tiers.) Anti-Pattern #8

83. Programming against Cloud Services as though they were reliable (Transient Failures handled using Busy Signal Pattern) Anti-Pattern #9

84. Security

85. A1-Injection A2-Broken Authentication and Session Management A2-Broken Authentication and Session Management A3-Cross-Site Scripting (XSS) A4-Insecure Direct Object References A5-Security Misconfiguration A6-Sensitive Data Exposure A7-Missing Function Level Access Control A8-Cross-Site Request Forgery (CSRF) A9-Using Components with Known Vulnerabilities A10-Unvalidated Redirects and Forwards

86. unicorn cloud security for apps Copyright © 2013 Elizabeth B. O’Connor used with permission www.elizabethboconnor.comwww.elizabethboconnor.com SQL INJECTION SESSION HIJACKING CSRF XSS

87. Belief in cloud app security unicorns Reality: your app’s vulnerabilities will port very cleanly to your favorite cloud platform Anti-Pattern #10

88. Little Bobby Tables (still a problem)

89. Conflating App & Platform security secure  compliant Anti-Pattern #11

90. Cloud News from June 2014 http://www.codespaces.com/ A cautionary tale… – DDoS – Security Breach – Ransom / Extortion – Fighting Back – Malicious Destruction of Assets – Business Failure ELAPSED TIME 12 HOURS

91. 1FA single-factor auth (2FA/MFA is widely available) Anti-Pattern #12

92. Service Level Agreements (SLA)

93. PoP (pageofphotos.com) adds paid plans to corporate partners – wants to offer an SLA

94. What is “the SLA” for storage?

95. SLA Responsibilities From Google Storage (https://cloud.google.com/storage/sla) :https://cloud.google.com/storage/sla "Back-off Requirements" means, when an error occurs, the Application is responsible for waiting for a period of time before issuing another request. This means that after the first error, there is a minimum back-off interval of 1 second and for each consecutive error, the back-off interval increases exponentially up to 32 seconds.”

96. SLA Math All required: 99.99 4 = 99.96 All required: 99.95 x 99.9 2 x 99.99 = 99.74 Period of time over which an SLA applies matters

97. SLA Penalties Limited to the service costs – Service costs != your business losses Multiple instances might be needed to be eligible

98. Passing along the SLA The cloud SLA becomes my service’s SLA Anti-Pattern #13

99. Compose to boost reliability

100. Affordability

101. Maximizing value from public cloud platforms Key Concept Turn off or delete unused resources Leverage very aggressive pricing for non- production workloads Enhance agility & productivity ASIDE: Will your test team be ahead of – or behind – the curve when your company moves production apps to public cloud?

102. The term “cloud” is nebulous… Public cloud platforms are global (and getting “globalier”)

103. Automation

104. – – – – – –

105. 105 What is Architecture? "Architecture is the fundamental organization of a system embodied in its components, their relationships to each other, and to the environment, and the principals guiding its design and evolution." [IEEE 1471]

106. The architecture of a cloud-native application is aligned with the architecture of the underlying cloud platform.

107. Hiring! HIRING at Finomial Corporation Are you a talented senior engineer/architect interested in financial services space? Technology stack is ASP.NET on Azure + SPA

108. Except where noted, slide deck is © 2014 Development Partners Software Corporation http://www.devpartners.com http://www.devpartners.com And…. Bill Wilder @codingoutloud codingoutloud@gmail.com blog.codingoutloud.com linkedin.com/in/billwilder Find this slide deck here

110. des questions?