AWS Cost Control: Cloud Custodian

AWS Cost Control: Cloud Custodian

• 1.
  The Journey ofBecoming Scrooge McDuck Choon Ming Goh
• 2.
  ● Designing ourAWS infrastructure ● Discovery of new tools ● Experimentation ● Start spending! 2 The beginning of our journey
• 3.
  ● Optimisation ● Costsaving initiative ● Integration with third party ● etc... 3 Half way through
• 4.
  ● Do everythingyou need BUT!! ● Spend as little as you can! ● If possible, do not pay for anything at all 4 Scrooge McDuck lessons!
• 5.
  ● Use theright instance type ● Reserved instance ● Spot instances ● Monitoring and analysing your usage ● Don’t use AWS support ● Redesign the whole architecture ● Idle resources ● Remove unnecessary resources ● and the list goes on…. 5 AWS cost saving measures
• 6.
  ● Policy based ●Compliance ● Cost management ● Idle resources 6 Cloud Custodian
• 7.
  policies: - name: remediate-extant-keys description:Scan through all s3 buckets in an account and ensure all objects are encrypted (default to AES256). resource: s3 actions: - encrypt-keys - name: ec2-require-non-public-and-encrypted-volumes resource: ec2 description: Provision a lambda and cloud watch event target that looks at all new instances and terminates those with unencrypted volumes. mode: type: cloudtrail events: - RunInstances filters: - type: ebs key: Encrypted value: false actions: - terminate 7 Sample Policy
• 8.
  ● Amazon MachineImages (AMI) ● Application Load Balancers (AppELB) ● Auto Scaling Groups (ASG) ● ElastiCache Clusters ● ElastiCache Cluster Snapshots ● CloudFormation ● Elastic Block Store Volumes (EBS Volumes) ● Elastic Block Store Snapshots (EBS Snapshots) ● Elastic Cloud Compute (EC2) ● Elastic Load Balancers (ELB) ● Key Management Service (KMS) ● Relational Database Service (RDS) ● Relational Database Service DB Clusters (RDS DB Clusters) ● Relational Database Service DB Cluster Snapshots (RDS DB Cluster Snapshots) ● Relational Database Service DB Snapshots (RDS DB Snapshots) ● Redshift ● Simple Storage Service (S3) 8 Supported Resources
• 9.
  ● Multiple environments ○4 test environments ● Multiple EC2 hosts (SAP) ● Multiple RDS instances ● ECS cluster per environment ○ All test environments share a single cluster ● Tagging ● Public IP 9 Scenario
• 10.
  10 Policies - name: suspend-asg-tst resource:asg filters: - "tag:template": tst - "tag:ecs_cluster": app-tst - type: offhour tag: ecs_cluster offhour: 20 default_tz: cet weekends: true actions: - type: resize min-size: 0 max-size: 0 desired-size: 0 save-options-tag: OffhoursPrevious - name: resume-asg-tst resource: asg filters: - "tag:template": tst - "tag:ecs_cluster": app-tst - type: onhour tag: ecs_cluster onhour: 6 default_tz: cet weekends: true actions: - type: resize restore-options-tag: OffhoursPrevious
• 11.
  11 Policies - name: stop-hybris-tst01 resource:ec2 filters: - "tag:environment": tst01 - "State.Name": running - type: value key: "tag:type" op: regex value: (tst01_hybrismaster.*) - type: offhour tag: type offhour: 20 default_tz: cet weekends: true actions: - type: mark-for-op tag: "offhours" op: stop - stop - name: stop-rds-tst01 resource: rds filters: - "tag:environment": tst01 - "DBInstanceStatus": available - type: offhour tag: environment offhour: 6 default_tz: cet weekends: true actions: - type: mark-for-op tag: "offhours" op: stop - stop
• 12.
  12 Policies - name: start-hybris-tst01 resource:ec2 filters: - "tag:environment": tst01 - "State.Name": stopped - "tag:offhours": present - type: value key: "tag:type" op: regex value: (tst01_hybrismaster.*) - type: onhour tag: type onhour: 6 default_tz: cet weekends: true actions: - start - type: unmark tags: [ "offhours" ] - name: start-rds-tst01 resource: rds filters: - "tag:environment": tst01 - "DBInstanceStatus": stopped - "tag:offhours": present - type: onhour tag: offhours onhour: 5 default_tz: cet weekends: true actions: - start - type: unmark tags: [ "offhours" ]
• 13.
  13 Demo
• 14.
  14 Results