Welcome to 'This is My Architecture' I am Hawn,
and today I am joined by Woon from Clumio, welcome.
Hi Hawn, thanks for having me.
Before we get into your architecture, can you tell me a little bit about Clumio.
Yes, so Clumio is a backup as a service
that allows our users to gain insights about their backups in their AWS environment,
as well as completely automate their backup strategy
in for the workloads running in AWS.
So let's say I'm a customer of Clumio, how do I enable your service?
Sure, let's do that.
So essentially, we provide a CloudFormation template to the customer,
which they will actually go ahead and install in their environment.
And that CloudFormation template will actually go ahead
and create, install things like an EventBridge in the CloudWatch,
as well as IAM roles.
While that is happening, we actually go ahead and create a dedicated AWS account
on behalf of the customer, with KMS keys and IAM roles.
This is basically a bubble that we're creating,
so that we can actually put everything related to the customer into that one bubble.
So how do you capture the metadata for the insights?
Right, so once the onboarding is complete,
we actually go ahead and leverage the IAM role,
to extract the metadata about data sources like EBS, RDS,
and DynamoDB.
Then from there, subsequent changes to the environment,
is actually captured through CloudWatch event triggers.
All that event is actually captured and sent through SQS messages.
And then all this metadata is actually continuously being analyzed by different Lambda functions,
that they consume these metadata messages,
and they will generate different output messages,
that they in turn, get stored into the different data engines.
And those data engines are actually leveraged to create different reports and recommendations.
So what type of metadata are you providing to the customer?
Yeah, so it's all about data protection.
So we actually go ahead and capture metadata about the data sources
and their respective backups.
The goal is to provide a comprehensive view about your data protection in AWS.
So essentially, Clumio generates recommendations and different reports,
such as compliance and audit reports, as well as cost reports.
So in summary, it's really telling the customers
about whether they're backing up too much, too little, and how much it's all costing them.
So how do you help the customer remediate those?
Right, so once you have the detail and then the view
about the landscape, about your data protection,
one of the things that you wanna do is to actually do a backup.
So this is the case where you can actually leverage Clumio again.
And this is when you can leverage Clumio again to actually extract and copy,
make secondary copy of the data sources on your account,
and you actually will copy them into Clumio for data protection.
So that copy happens across different accounts,
because the second account is managed by Clumio,
and you can also configure it to be in a different region.
So a lot of the customers that we have, they're leveraging the second copy,
basically, to satisfy compliance and audit requirements,
as well as protecting themselves from account level compromises or ransomware attacks,
and also sometimes regional outages if the backups were taken out of region.
So you must be moving quite a bit of data.
How do you perform that secure data movement?
Yeah, definitely.
So as you can see, we're moving EBS volumes on RDS,
which could be fairly, fairly big.
And then one of the things that we actually do is that,
we try to minimize the processing that happens on the customer side of the thing,
and do everything possible on the Clumio side.
So let's go through the data flow a little bit.
So the one thing that we actually must do, is actually encryption.
So every data that gets moved is actually encrypted using the KMS key.
And then that data is actually sent directly to the S3 bucket.
And again, this approach, we decided to take that approach of sending the data directly to S3,
without much processing on the customer side,
mainly from the point of view of leveraging S3's scalability.
Like AWS has done a great job in terms of S3,
and then we wanna take advantage of the scalability and reliability.
So that's one benefit.
And then the second benefit is that, because the post-processing happens in Clumio side,
the customers are not seeing, they're not incurring any of the fees related to the post-processing,
and all the complexity is actually managed by Clumio.
So then the next thing is that, let's talk about a little bit about the post-processing.
So by post-processing, I mean things like,
you know, backups, data verification, things like indexing and cataloging.
These are very heavy and complex operations.
And we actually do all that through Lambda functions.
So once the data lands in S3,
we will leverage very large number of Lambda functions,
that they assume this role, and they will actually start operating in these S3 objects.
Things like data optimizations and data integrity checks.
Well thank you so much for going over your architecture.
That's really cool that you were able to enable backup as a service in a secured manner,
and also provide that insights to help remediations for the customers, so thank you.
Thank you.
And thank you for watching 'This is My Architecture'.