Lessons from 10 Years of Amazon Web Services(allthingsdistributed.com)
allthingsdistributed.com
Lessons from 10 Years of Amazon Web Services
http://www.allthingsdistributed.com/2016/03/10-lessons-from-10-years-of-aws.html
4 comments
James Hamilton listed some of the highlights over the last decade at his blog - http://perspectives.mvdirona.com/2016/03/a-decade-of-innovat...
James has put out a lot of great material. He's given a talk series and wrote a conference paper called "On Designing and Deploying Internet-Scale Services" which is a trove of valuable design insights:
https://www.usenix.org/legacy/event/lisa07/tech/full_papers/... (somewhat condensed)
Slides from a talk: http://mvdirona.com/jrh/talksAndPapers/JamesRH_AmazonDev.pdf
He writes some of the more practical and useful advice I've seen about how to run a successful business based on high-scale distributed systems.
One of his mnemonics that's stuck with me is the "Four Rs" of recovery-oriented computing: Restart, Reboot, Reimage, Replace (slide 6 in PDF). A human shouldn't be engaged to troubleshoot a problem until the platform has first tried in successing to restart the software, reboot the OS, re-image the machine, and finally replace the hardware entirely. After these auto-recovery steps have failed, only then is it time to engage a human. He describes the connection between these techniques and significantly lower operations costs.
https://www.usenix.org/legacy/event/lisa07/tech/full_papers/... (somewhat condensed)
Slides from a talk: http://mvdirona.com/jrh/talksAndPapers/JamesRH_AmazonDev.pdf
He writes some of the more practical and useful advice I've seen about how to run a successful business based on high-scale distributed systems.
One of his mnemonics that's stuck with me is the "Four Rs" of recovery-oriented computing: Restart, Reboot, Reimage, Replace (slide 6 in PDF). A human shouldn't be engaged to troubleshoot a problem until the platform has first tried in successing to restart the software, reboot the OS, re-image the machine, and finally replace the hardware entirely. After these auto-recovery steps have failed, only then is it time to engage a human. He describes the connection between these techniques and significantly lower operations costs.
"Primitives not frameworks"
This is why Amazon beat Google in the "as a Service" space. Google provided a framework with AppEngine, but customers wanted the flexibility of the primitives offered by AWS.
This is why Amazon beat Google in the "as a Service" space. Google provided a framework with AppEngine, but customers wanted the flexibility of the primitives offered by AWS.
I think that Amazon being first in 2005/2006 helped a lot, too. Google now provides "primitives" through GCE. I think Google realizes that the future is GCE not GAE.
I think there's tremendous value still in GAE. To this day the fact that a company the size of Snapchat is able to operate on a PaaS, with virtually no ops people, is STILL a game-changer. The fact that it's still true 3+ years in is equally as impressive.
The narrative shifted away from PaaS for a number of reasons, but the value prop is still present.
(Disclaimer: work on BigQuery, a DBaaS, which is, in my opinion, is clearly the future)
The narrative shifted away from PaaS for a number of reasons, but the value prop is still present.
(Disclaimer: work on BigQuery, a DBaaS, which is, in my opinion, is clearly the future)
But Amazon wasn't the first. The Sun Grid was first (launched in March 2006).
Sun Grid was more about batch processing across many machines, rather than individual VMs, wasn't it?
Plenty of people in the web hosting industry offered competitive x86 linux instances or dedicated servers, way prior to 2006.
I think AMZN deserves credit for delivering a price compelling option that delivered (1) elasticity (per hour billing) and (2) automation (API, available in minutes), among other things.
Plenty of people in the web hosting industry offered competitive x86 linux instances or dedicated servers, way prior to 2006.
I think AMZN deserves credit for delivering a price compelling option that delivered (1) elasticity (per hour billing) and (2) automation (API, available in minutes), among other things.
Exactly
Offer IaaS first, the PaaS. Google had it backward.
While AWS does have a small vendor lock in too, in the end it's still recognizable , I mean it's doable for example to move an AWS architecture to open stack without a major code rewrite. If you built your web app on GAE and GWT however, your investment to move it out of Google will be much bigger.
Offer IaaS first, the PaaS. Google had it backward.
While AWS does have a small vendor lock in too, in the end it's still recognizable , I mean it's doable for example to move an AWS architecture to open stack without a major code rewrite. If you built your web app on GAE and GWT however, your investment to move it out of Google will be much bigger.
You have to give full credit to AWS for inventing previously unknown pricing models. In some cases, it was actually the pricing model that created new use cases. Glacier and S3 comes to mind.
That's a very important observation. When I describe AWS to audiences I always make clear that it is a combination of a technology and a business model.
"A good litmus test has been that if you need to SSH into a server or an instance, you still have more to automate."
Amen. We couldn't agree more: https://boxfuse.com/blog/no-ssh
Amen. We couldn't agree more: https://boxfuse.com/blog/no-ssh
So, with No SSH - how do you debug that one-off problem that is only on machine abc12? I'm not talking about mutating, I'm talking about attaching gdb to the process while it's handling requests. I'm talking about collecting CPU profiling information from production. Stuff like that.
https://speakerdeck.com/niteshkant/distributed-tracing-at-ne...
http://techblog.netflix.com/2012/06/scalable-logging-and-tra...
https://github.com/Netflix/vector
Not terribly easy, but possible. I agree that "never have to SSH" is a bad target because there will always be edge cases, but for the majority of things it's possible to troubleshoot at the cluster level given immutable infrastructure; all the systems will be doing the exact same thing given an input. Reality shows that this is a bit idealistic, but if you start finding that e.g. A certain set of requests cause weird behavior, you can look at what makes those requests different, then set up some routing logic to send them to a debug farm (using something like https://github.com/Netflix/zuul ).
http://techblog.netflix.com/2012/06/scalable-logging-and-tra...
https://github.com/Netflix/vector
Not terribly easy, but possible. I agree that "never have to SSH" is a bad target because there will always be edge cases, but for the majority of things it's possible to troubleshoot at the cluster level given immutable infrastructure; all the systems will be doing the exact same thing given an input. Reality shows that this is a bit idealistic, but if you start finding that e.g. A certain set of requests cause weird behavior, you can look at what makes those requests different, then set up some routing logic to send them to a debug farm (using something like https://github.com/Netflix/zuul ).
Immutable Infrastructure is the modern day "have you tried turning it off and back on again?"
You could probably have a central logging service like graylog or logstash that automatically collects that information and just sort through the logs that way.
What if the problem is not diagnosable from logs?
In a perfect world production and development would be identical, all production issues would be easy to reproduce in development, and logging and error handling would be sufficient to diagnose any problem.
But what do you do when you have a problem that doesn't happen in a perfect world -- that you can't diagnose normally, doesn't occur in dev, shows nothing abnormal in logs, etc.? At some point you need the ability to inspect the actual thing. It's like diagnosing a problem with a bridge by doing experiments on a scale model replica. Doesn't always work.
In a perfect world production and development would be identical, all production issues would be easy to reproduce in development, and logging and error handling would be sufficient to diagnose any problem.
But what do you do when you have a problem that doesn't happen in a perfect world -- that you can't diagnose normally, doesn't occur in dev, shows nothing abnormal in logs, etc.? At some point you need the ability to inspect the actual thing. It's like diagnosing a problem with a bridge by doing experiments on a scale model replica. Doesn't always work.
In that case I'd agree with you, and you should still allow for the possibly of logging in via ssh, while aiming to reduce that need and focus on automation as much as possible, or as much as it's appropriate and possible for your environment, rather.
What if that 1 server ran out of file handles and can no longer log to anywhere?
Take the server out back and shoot it.
Launch a copy of that server with a new image (which I would hope is under a load balancer), update the sysctl.conf file template with a larger fs.file-max limit in whatever config management system you use for that instance, resume logging under freshly cloned instance.
How would you know to do that at all? The proposed issue is that the file handles are exhausted. Thus logging doesn't actually work, and thus you don't know anything about the problem except 'it's not working'. Your solution presupposed that you have figured out the issue, but the question is how do you find out about the problem at all. Without SSH/debugger/whatever, what is the process to inspect the system to find the problem?
After dealing with different enterprise systems in AWS for a few years now, I'd say that this is what AWS ELB feature to remove a system out of an ASG as part of its lifecycle exists for. If you aren't using similar horizontal scaling strategies, you have a disaster waiting to happen basically and basically deserve an outage you can't diagnose / RCA well. If you can't ssh in afterwards that means your provisioning for automation / instrumentation and you should stay be able to isolate attention to that part of an instance's lifecycle.
Great question. I'd probably look into something like Sysdig Cloud that can collect that information through its own agent, or one of the tools mentioned by seanp2k2. I do also agree with his point on edge cases though, it should be the goal for the majority of your infrastructure while still allowing for edge cases.
[deleted]
Proposal:
Instead of ssh vs. no-ssh debate, how about:
* Use SSH AllowGroups to limit logins to the development manager/lead or on-call engineer
* with a policy that for each time you have to call them beyond N times per week, you have to buy their team a round of drinks of their choosing?
Deal?
Instead of ssh vs. no-ssh debate, how about:
* Use SSH AllowGroups to limit logins to the development manager/lead or on-call engineer
* with a policy that for each time you have to call them beyond N times per week, you have to buy their team a round of drinks of their choosing?
Deal?