(upbeat music)
(air whooshing)
Andrea: Hi everyone
and thank you for taking the time to join our session today
where we're going to be talking about
Architecting Secure Enterprise-Ready Solutions
for the Cloud with Azure and MySQL.
My name is Andrea Lam
and I'm a Senior Program Manager
on the Azure database for MySQL and MariaDB team.
And I'm very excited to be here
today to talk to you about this topic.
In this session, we're going to be covering
a few key components.
The first we're going to be talking about
the microservices architecture.
Next, I'm going to introduce
Azure Database for MySQL
and actually give you a sneak peek
into the Azure Database for MySQL architecture.
Next, we're going to talk about securing your data.
And finally, we'll talk about some of the new innovations
our team has been working on.
First, let's go over the microservices architecture.
In microservices
we typically see customers
splitting out the stateless front-end
from the stateful back-end.
And this architecture here
that I'm showing you on the slide
is actually based on one of our real life customers.
And they use this
to support millions of banking transactions daily.
And we see them using microservices
running in different containers
with Docker being their most preferred technology.
First, they want to consider
how to manage a large scale of microservices.
And they use this
manage this using some form of container
orchestration in Kubernetes.
In Azure, we offer the Azure Kubernetes Service
which can be used to manage your microservices.
From there, they want to ensure that
all of this gets encapsulated in a network boundary.
And this ensures that you're protecting
and having some form of network isolation
and ensuring that you are able to
monitor who has access to the application
and how to protect your data.
So now that we talked about the stateless
front end of things
let's talk about the stateful component of the application.
This is where PaaS offerings typically come into play
and also provide some type of open source technology.
And this can be used as a persistent data store
for your application.
And on top of that
in Azure
we also have a ton of really great analytic tools
that can be used to integrate with your data storage
allowing you to perform additional analysis
and help to make data driven decisions.
So what's the advantage of the setup?
Well, when you're splitting your application
across different services and modules
this allows you to scale each component individually
and allows you to scale to grow
your demands for your particular workload.
Another benefit of using a persistent PaaS layer
is to help alleviate some of the manageability
headaches that may come with it.
And this includes
the ability to perform automatic backups
and maintain high availability to name a few.
And finally
when you're using a PaaS layer
and building on top of the security
tools that are available in the cloud provider
you can take advantage of some of the key innovations
that we here in Azure
are helping to provide our customers with.
So when you think about the stateful PaaS layer
what are some of the requirements
that you should be considering?
Well, first, you want to think about something that is
truly a fully managed solution.
And this includes the ability to provide
automatic backups
built in high availability
resiliency
and disaster recovery tools.
Another thing to think about is
how to scale on-demand when you need to
and this ensures that your application is able to meet
the workloads needs.
And this can be done using
a couple clicks of a button in the Azure portal
or using some simple Azure CLI commands.
From there
you might want to also consider
the different security tooling
and compliance certifications
that a particular service has.
And so many of you may be thinking about PCI
HIPAA or FedRamP to name a few.
And then when it comes to developers
we really want to make sure that
many of these services are integrated with each other.
This ensures that
you as a developer don't really have to think about
how to do this additional integration yourself.
And then we also want to make sure
that many of the tools and frameworks
that you're already used to using
can all be used directly against these PaaS services.
Lastly
cost efficiency is something that's top of mind.
And this includes things like
stopping your server
over the weekend and starting and again
when you're back in the office on a weekday.
And then also things really around low prices
in terms of providing you with dev tests queues
to name a few.
So now that we've talked about some of the requirements
of a PaaS layer
I now wanted to introduce Azure Database for MySQL
which can help with
meeting some of these requirements
in terms of data storage needs.
Azure Database for MySQL
is a fully managed database service here in Azure.
And it's integrated with
many of the different Azure services we have available.
One of the great things about this MySQL service
is we're actually running the Community edition
of MySQL.
So many of the tools and frameworks that you as a developer
are already used to using against MySQL
can all just be re leveraged.
Secondly
the MySQL service comes with a built in
high availability SLA
and this is money backed with 99.99% high availability.
And this also ensures that you have the lowest
total cost of ownership
because you don't actually need to stand up a second server
in order to get that high availability.
We offer it for every individual server that you provision.
And as I mentioned earlier
Azure also wants
also keeps in mind that
security is one of the top priorities for you and for us.
And to help with that we offer
things like Advanced Threat Protection
which we'll talk about a little bit later
which provides you with some of the latest innovations
that we've been working on in the security space.
Next, there are also some great built in intelligence
performance features that we have.
And this includes
the intelligent performance
suite of features that we have
that allows you to get more insight
into some of the query performance
that you have on your server
and offers recommendations on how we can potentially
improve your performance
on the server as well.
And like I mentioned
integration with other Azure services
is also super important
as it also helps us simplify your life as a developer
and integrate with other things like
the Azure App Service or Power BI.
Next, I wanted to give you a sneak peek into
the Azure database for MySQL architecture
and give you a little bit of a better idea
of how we can actually offer you
that 99.99% high availability SLA.
So as you can see here on the right side of your screen
we have MySQL application that tried to connect to
an Azure database for MySQL server.
First, the connection is routed through our gateway
and the gateway sits in front of all the back end nodes
in our service.
From there, the connection goes to the gateway
and then the gateway interprets the connection string
and is able to then route that connection
to the appropriate MySQL server running on the back end.
That MySQL server is also connected to Azure storage.
Azure storage is what we use to host all the data files
and backup files for your particular server.
And we also have the Azure database management service
which is used to detect any issues
that may be running in your server
and also helps with facilitating any failovers.
Next, I wanted to highlight what happens
when something goes wrong with one of the data files.
So when we detect that
what we then do is then switch over your MySQL to point
to a different data file that's hosted within Azure Storage.
As I mentioned earlier Azure storage three
keeps three copies of those data files on your behalf.
Next, I wanted to highlight what happens
if something might go wrong with the MySQL server itself.
The Azure database management service
can detect unhealthy nodes.
And from there, it will stand up a new MySQL server.
And then the gateway gets rerouted and points
now to the updated server hosted in the back end
for your MySQL server.
And from there
we definitely recommend having retry logic built
into your application
to reconnect and then
once the server is back up and running
it will continue that connection.
So now that you've learned more about micro services
and Azure database for MySQL
I wanted to show you how all that comes together.
And to do that
I wanted to use Magento as an example.
Now, Magento is an open source e-commerce solution
developed in PHP
and it actually uses MySQL to store application data.
And I'm going to use Magento
to now highlight some of the traditional security gaps
that might come with hosting your application
in database in the cloud.
The first is really around
having your services and traffic be
exposed to the public Internet
leaving them vulnerable
potentially for security breaches.
The second is around how you store your data
both at rest on your database as well as storage drives.
These can be attractive targets for attackers
and can potentially be used for data exploitation.
The third is really around granting users
the correct access to the different resources
that you may have in a timely manner.
The fourth is really around detecting
unusual and harmful attempts
against your data.
So now we've talked about some traditional security gaps.
I now wanted to highlight
how I did a base for MySQL innovations
can help protect against some of those gaps.
The first is really around network isolation.
And to do that we provide
varying levels of isolation
for different networking solutions.
And this includes Azure Private Link
as well as Virtual Networks.
Secondly, when it comes to data security
we do provide data protection
both at rest and in motion.
And this is done through SSL and TLS enforcement
data encryption at rest using customer manage keys
which allows you to rotate your keys as you need
infrastructure double encryption
which is in preview
which gives you an additional layer
of data encryption.
The third was around access control.
And to do that we offer
Azure AD authentication
which uses a token based authentication method
to connect to your Azure database for MySQL Server.
And the fourth is around preventing
and monitoring unusual activities.
And for that
we have the Advanced Threat Protection preview
which can be used to monitor and alert you
for any unusual activities
that may be happening on your server.
We also offer audit locking
which allows you to
track database activity
and provide that as evidence
for different compliance certificates that you may have.
Next, I wanted to highlight some key points
for you to take away from this session.
The first is really around Microsoft's commitment
to making Azure the most secure cloud
for all of your data and application needs.
Secondly, Azure database for MySQL offers
a bunch of really great enterprise security controls
which are aligned with industry security controls
to help you as a customer quickly
efficiently and effectively
meet applicable security and compliance requirements.
Third, security and compliance
is a shared responsibility in the cloud.
And for that, I definitely recommend
that you check out the shared responsibility model
which I'll link for you at the end of the session.
Next, I wanted to talk to you
about some of the great new innovations
our team has been working on.
Recently, we introduced the preview of Flexible Server
which is a new deployment option
for Azure Database for MySQL
and offers three big key components.
The first is really around maximum control
for your databases.
And this is
this offers you the ability to actually deploy your server
within a virtual network
by delegating a subnet to
your MySQL Flexible Servers.
We also offer server parameters
for giving you more fine-grained tuning
for your particular workloads needs.
And we've also introduced custom maintenance windows
which allows you to tell us
when you can actually receive maintenance
against your servers.
The second is really around building resilient applications.
And for that we offer zone redundant high availability
allowing you to stand up a
hot standby in another availability zone.
And this helps with preventing
zero data loss when we perform fast failovers
and also allows you to co-locate your application
to a availability zone
to help with minmizing network latency.
And the third
is really around a simplified developer experience.
And for that
we went through every Azure Portal screen that we have
as well as every Azure CLI command that
we have available for Flexible Server
and tried to simplify those
as easily and as best as possible.
We also offer MySQL using the same community edition
that we have in our existing service.
And we've also introduced great new features
around cost optimization.
This includes Stop/Start and Burstable.
Stop/Start allows you to stop your server
and then restart it when you need to
so you can stop that over the weekend
and restart when you're back in the office on Monday.
And also offer Burstable
as a new as a new compute tier.
And Burstable is really great for
some workloads that don't need that
CPU consistently throughout the day
and allows you to bank up credits
and then with that spike up to 100% CPU.
Flexible Server is
a result of much of the feedback that
we've received from our existing customers.
So really thank you for the feedback that you've
provided us and definitely recommend
that you go check out the sneak preview today.
Last, I wanted to leave you with some great resources
to get started.
So definitely check out our MySQL documentation
to look through some of our quickstarts
learn more about the features that we have available.
And also recommend that you check out the cloud
shared responsibility model that we discussed earlier
to learn more about the different responsibilities
that you as a customer have
as well as us as a cloud provider.
And also recommend checking out our
Azure Database for MySQL blog
to learn more about the Flexible Server announcements
that we recently made.
And if you have any questions about Flexible Server
or anything that we discussed here today in this session
please feel free to reach out to us at
AskAzureDBforMySQL@service.microsoft.com
and also follow us on Twitter to keep up to date
on the latest announcements
for features that we're working on.
And with that
I wanted to thank everybody for taking the time
to watch this the session today.
I hope everybody is staying
happy and healthy.
(upbeat music)