Hello. I'm Simon from AWS.
Welcome to another episode of This is My Architecture.
I'm joined today by James, from the Ministry of Justice.
Hi.
Could you just start off by telling me a little bit about what the Ministry of Justice does?
Yeah, sure. The Ministry of Justice is the part of Central UK Goverment
that is responsible for looking after the Justice System.
There are different parts of that.
There's things like the Court System, Prisons and Legal Aid.
And it's making sure that all that works together.
So James, we're gonna talk about the Landing Zone you built today.
But to start with, can you just explain to me a little bit about what a Landing Zone is?
Sure, yeah. So, a Landing Zone is,
I'm probably gonna get the phrase wrong and my AWS colleagues will frown at me.
But it's a way of defining our account structure
and our users and how we deploy and make updates to all of our AWS infrastructure.
So a predefined template for an AWS account or an AWS infrastructure?
- Exactly that. - OK, brilliant.
So let's start to talk about the architecture you've deployed here.
What is Cloudfront and WAF doing at the front end?
OK, sure. So we've got our users here which is a mix of citizen facing
and internal legal aid agency or MAG case workers.
And then going through the web browser into Cloudfront here,
which we are mainly using as a content delivery network.
That gives them a much faster experience.
We can cache and deploy assets here and we can bust the urls
so that they get a faster experience here.
From Cloudfront, they go into the WAF.
Now the Web Application Firewall here,
we're using to give us an enhance security posture.
Many of these applications that we've migrated here
are pretty old, sort of 10-15 years old.
And they haven't really had the love
and the rigorous patching regime that they should have done.
So by using a WAF here, we can quickly mitigate
some of the security issues that we know these applications have.
And that's a very quick way of us achieving that.
OK, so it's prolonging the life of some of those legacy applications for you.
- Absolutely. - OK. So if we continue from the WAF,
and we look at the ELB, what happens there? What are we using ELB for
and how does that connect to the rest of the architecture?
OK, so from the WAF, it goes into the ELB.
The ELB is the standard laid balance here that is letting us split traffic
between two availabilities zones. And that gives us high availability and resilience.
So that helps us do things like zero downtime deployment later on.
OK.
From ELB we're going to ECS.
The applications have been repackaged in Docker.
They were primarily running in our local application server previously.
Then now, Docker images that contain Tomcat and they run in that process.
And that's a much better way of us deploying the applications.
It gives us a chance to build the artifact once and then we promote that artifact everywhere.
So we have a very strong confidence that what we're testing in development
is the thing that's actually going to be deployed to production.
Also supporting this, we have RDS.
So a lot of these are using Oracle as a DataBase
and we're using Multi-AZ Oracle RDS,
and that gives us high availability again.
OK. So outside of these components, I noticed we've got X-RAY.
Can you tell me a little bit about what you use X-RAY for?
Yes, X-RAY, we're really big fans of.
It helped us make very small changes to the applications, to instrument them.
So that we could collect good data on how the application was behaving in production.
Previously, we didn't have that insight. Now, we have that insight and
we can see these are the bits that we need to fix
and these are the bits that will have the biggest impacts on our users,
in terms of making them productive and making them happier, as well.
OK. And as part of the Landing Zone, you've put IAM in there.
What are you using IAM in there in this particular structure for?
So, IAM here has a number of capabilities that it's giving us.
We're defining the users once, for all the different roles, as well.
And we have cross-account connectivity, so that we can promote,
we can define a user in the shared services account,
and then that user will have permissions in the DEV accounts,
in the test accounts, possibly the production account, depending on on their level of access.
Se we define it in once and then we can use it everywhere.
So you define it in a Jump account, and then cross-account access
into these very traditional accounts you're creating.
That's a much better way of saying it, yeah.
OK. And it would be remiss of me not to mention GuardDuty at the top.
Could you explain what you're using GuardDuty for?
Yes, with GuardDuty, we have that alerting on the VPC flow logs.
As I mentioned earlier, some of these applications are pretty old.
They have gone through at least two, possibly more, migrations in the past.
So we are treating them slightly as tainted. We don't know entirely what they contain.
So with looking GuardDuty. GuardDuty gives us nice capabilities, like alerting
if anything was to try and connect to a commander control server or anything else.
And that gives us a high level of confidence we have a good security posture.
OK. And obviously you've got Cloudtrail and Cloudwatch here,
which are tools that we recommend for any AWS deployment.
Were those automatically deployed as part of the Landing Zone as well?
Yes, we have them both in the Landing Zone.
So we have a guest order accounts, as part of our landing zone,
where all of the API actions are logged
and they get shipped off to an order account in Couldtrail.
And we also use them for every application stack that we define.
We have a number of these applications living in the Landing Zone.
Each of them has their own stack and they're collecting metrics and logs
for each of them using those two services.
So when you went about creating the Landing Zone in the first place,
how long did it take and how did you do it? What tools did you use?
So all of our Landing Zone is defining CloudFormation.
But when we did this, it was back in December,
January of 2017, 2018.
And the Landing Zone wasn't really a concept that AWS had talked about much beyond that point.
I think the initial blogpost came out in June of this year or something like that.
So we didn't have anyone we could copy.
But that said, it took us about six weeks, I think, to get the initial version up and running
using CloudFormation, and since then we've been iterating on it constantly.
And we're very happy with it.
And so you're going to continue to update the CloudFormation template
as in when new features come out?
- Yes, it'll certainly keep us busy. - I imagine it will.
- Thank you for joining us today, James. - Thank you.
And thank you for joining us on This is My Architecture.