CourseAWS Region Migration: Hub-and-Spoke and Zero Trust with Check Point
Lesson 1 of 12

AWS Region Migration: The Project, the 7 Rs and the Target Architecture

What you’ll learn

  • Understand the client's migration brief
  • Know the 7 migration strategies, and why this one is Refactor
  • See the network today, and the network we will build
  • Know the lesson plan and how we keep the cost under 100 dollars

The brief

A research organization runs its workloads in AWS, in us-east-1. They need everything moved to us-east-2.

A research organization runs its workloads in AWS, in us-east-1. They need everything moved to us-east-2.

The people who use it are researchers and data scientists. They are experts in their field, not in networking. So the move has to be safe, quick, and clearly explained to them.

The people who use it are researchers and data scientists. They are experts in their field, not in networking. So the move has to be safe, quick, and clearly explained to them.

The network today

Here is the network today. One VPC, with its own internet gateway. An EC2 app server with a data volume, a PostgreSQL database, a bucket of research data in S3, and a SageMaker notebook for the data scientists.

Here is the network today. One VPC, with its own internet gateway. An EC2 app server with a data volume, a PostgreSQL database, a bucket of research data in S3, and a SageMaker notebook for the data scientists.

The target network

And here is the target in us-east-2. A hub VPC holds the Check Point firewall. The app and the data each get their own spoke VPC, with no internet gateway. A Transit Gateway connects them, and every flow passes through the firewall. Anything not on the allow list is dropped.

And here is the target in us-east-2. A hub VPC holds the Check Point firewall. The app and the data each get their own spoke VPC, with no internet gateway. A Transit Gateway connects them, and every flow passes through the firewall. Anything not on the allow list is dropped.

The 7 migration strategies

AWS describes seven migration strategies, the seven Rs. Retire, retain, relocate, rehost, replatform, repurchase, and refactor.

AWS describes seven migration strategies, the seven Rs. Retire, retain, relocate, rehost, replatform, repurchase, and refactor.

This project is mainly refactor, also called re-architect. The servers can't just be copied across, because the network model changes. The app moves into a private spoke, with no public address. Its routes go through the firewall. And its access is rebuilt on least privilege.

This project is mainly refactor, also called re-architect. The servers can't just be copied across, because the network model changes. The app moves into a private spoke, with no public address. Its routes go through the firewall. And its access is rebuilt on least privilege.

In practice, the data is copied, and the compute is rebuilt. S3 objects, the database and the volumes move across with replication and snapshots. The app server and the notebook are launched again in the new network.

In practice, the data is copied, and the compute is rebuilt. S3 objects, the database and the volumes move across with replication and snapshots. The app server and the notebook are launched again in the new network.

Zero Trust

The target follows Zero Trust. Nothing is trusted because it is inside the network. The Check Point firewall denies everything, and we open only the flows the researchers really need, one rule at a time.

The target follows Zero Trust. Nothing is trusted because it is inside the network. The Check Point firewall denies everything, and we open only the flows the researchers really need, one rule at a time.

The lesson plan

Here's the plan. First we build the client's workload in us-east-1, so we have something real to move. Then the hub-and-spoke network and the firewall in us-east-2. Then we migrate the data and the compute, cut over, and clean up.

Here's the plan. First we build the client's workload in us-east-1, so we have something real to move. Then the hub-and-spoke network and the firewall in us-east-2. Then we migrate the data and the compute, cut over, and clean up.

Cost and safety

The whole course costs about fifty dollars in AWS, and we set a budget of one hundred dollars to be safe. The firewall is the expensive part, so we stop it whenever we're not using it, and we delete everything at the end.

The whole course costs about fifty dollars in AWS, and we set a budget of one hundred dollars to be safe. The firewall is the expensive part, so we stop it whenever we're not using it, and we delete everything at the end.

One note. In a large company, the hub and each spoke often live in separate AWS accounts. We use a single account, so you can follow along, and the network design is exactly the same.

One note. In a large company, the hub and each spoke often live in separate AWS accounts. We use a single account, so you can follow along, and the network design is exactly the same.

Every command and every setting is in the written guide on our website, ready to copy.

Every command and every setting is in the written guide on our website, ready to copy.

Summary

  • The workload moves from a standalone VPC in us-east-1 to a hub-and-spoke network in us-east-2
  • Refactor, or re-architect, is the main strategy, because the network model changes
  • Zero Trust – a Check Point firewall denies all traffic unless it is on the allow list
  • Every resource is created, migrated and tested on camera, then deleted

What’s next

That's the brief. In the next lesson, we set the budget and start building the client's workload in us-east-1.