About the client:

Trimble Hosting Services provides global managed IT services for industry leading ASP and Software as a Service product. These application services include applications for mobile resource management, construction machine, construction site management and precision surveying. Companies use these services to maximize the productivity and efficiency of their mobile workforces and to optimize productivity of machines and other assets.

Why AWS

AWS provides a set of flexible services designed to enable companies to more rapidly and reliably build and deliver products using AWS and DevOps practices. These services simplify provisioning and managing infrastructure, deploying application code, automating software release processes, and monitoring your application and infrastructure performance. DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes. This speed enables organizations to better serve their customers and compete more effectively in the market.

DevOps on AWS

• Entire stack was provisioned automatically in AWS using Amazon CloudFormation template. AWS Cloud Formation offered the developers and systems administrators an easy way to create and manage a collection of related AWS resources, provisioning and updating them in an orderly and predictable fashion
• DevOps automation with Puppet, CFT, PowerShell DSC
• Monitoring tool (Foreman and its integration with Cloud Watch)
• Deployment to various environments was handle using GIT Hub
• Load Balanced using Amazon Elastic Load balancers
• Region based puppet master provisioning i.e. each region will have their own puppet master
• All virtual machines will be within a VPC
• All VPC’s will be VPC peered
• Traffic route to Puppet master to happen via Private DNS
• Puppet server will reside on a C3 Linux box (Redhat 6.6) with
  Hiera 1.3.4
  Puppet DB
  Facter 2.4.1
• Puppet master will be made highly available via Auto Healing
• Separate Git server will be provisioned and configured for version control management
• Foreman will be installed, paired with the Puppet master and will be used for view purposes
• Role based node identification while catalogue run and
  corresponding configuration management via Puppet master
• Secured Assets stored and delivered from Amazon S3
• Amazon CloudWatch and Amazon SNS set up to monitor resources, send notifications, track logs and metrics
• AWS CloudTrail and AWS Config set up for Security and Governance
• If any major change is being made to the Puppet Master Server, an automated script will take a new AMI of this machine and make it the Golden AMI for further Autohealing operation of the Puppet Master

Design for HA/DR

• HA ensured by using Multiple AWS Availability Zones within a region
• Usage of Fault tolerant building blocks like ELB, S3, SNS for HA
• ELB + Auto healing of puppet master was ensuring HA for newly created setup

Design for Security

• Isolated network using Virtual Private Cloud (VPC)
• Each layer of the architecture will be encapsulated with multiple layers of security which comprises of ACL’s, Security Groups and user accounts accesses
• All puppet related communication will be private. Each and every layer will have individual security groups created in AWS which will have layer specific inbound access. No other port communication will be allowed across layers
• VPC peering will be configured for inter VPC communication within the account and across accounts for the same region
• Inter region VPC communication will be made possible via VPN peering, which is already established and managed by the customer
• AWS IAM and MFA for access control deciding what role and how one will interact with provisioned services
• VPC Flow logs and CloudWatch logs for security