NEXT-GENERATION END-USER COMPUTING: CLIENT SPOTLIGHT: Delivering Desktops as a Service Using Amazon WorkSpaces. Better Billing Through Metadata

Transcription

1 NEXT-GENERATION END-USER COMPUTING: Delivering Desktops as a Service Using Amazon WorkSpaces CLIENT SPOTLIGHT: Better Billing Through Metadata

2 The Enterprise Mobility marketplace has grown significantly in the last five years as more employees work away from corporate offices and use mobile devices and cloud-based services to perform their job functions. According to the most recent CSC Global CIO Survey, Security and Enterprise Mobility are top technology initiatives for most organizations, with more companies investing in solutions to enable a mobile workforce. The same report ranks Enterprise Mobility as one of the top three technology initiatives expected to positively impact an organization s rate of innovation. Enterprise Mobility is a key component of End-User Computing (EUC) that specifically addresses how organizations deliver virtual desktops and applications to end users. When AHEAD first built its EUC practice five years ago, CIOs were looking to EUC solutions to enable Bring Your Own Device (BYOD) policies, simplify or eliminate the management of physical endpoints, deliver applications securely and efficiently, and centralize user data for enhanced backup and disaster recovery capabilities. Today, CIOs are looking to EUC solutions to address a new set of business drivers, specifically the need to provide competitive services to end users as a way to attract and retain top talent, support business initiatives including mergers and acquisitions, enable innovation, and improve speedto-market, all while adhering to security and compliance policies and regulations. The expansion and maturity of public cloud services and the shift toward as a service delivery models have impacted nearly every facet of IT service delivery. EUC is no exception. The conversation is rapidly changing and we are seeing the first wave of early adopters for next-generation EUC technologies focused on delivering Desktops as a Service (DaaS). DaaS enables IT leaders to rapidly deliver any number of highly performant, secure desktop services to end users in a pay-as-you-go model. The race to capture the emerging DaaS market has already begun. Amazon WorkSpaces was one of the first solutions to hit the market and we believe they are positioned to be a leading DaaS provider. AHEAD has helped many IT organizations develop and execute a strategy for a DaaS solution. In this white paper, we will explore the primary use cases for DaaS, discuss when DaaS solutions like Amazon WorkSpaces may be a better fit than traditional EUC solutions, and provide best practice guidance for getting started with Amazon WorkSpaces. Use Cases for DaaS A key component of any EUC strategy we develop for our clients is a use case analysis. In the use case analysis, we rationalize architecture and technology alternatives against our client s use cases. By analyzing the capabilities and benefits of a set of technologies and products against the service level and functional requirements of a use case, coupled with financial analysis, we can identify the optimal solution to meet the client s technical, operational, and financial requirements. As DaaS solutions like Amazon WorkSpaces continue to mature and gain wider adoption, we expect to see its applicability in the enterprise widen. As of today, we are seeing DaaS be leveraged for use cases to embrace flexibility with security. In addition to flexibility, allowing enterprises to reduce upfront costs and to deploy a solution rapidly, the following use cases also emerge: 2 Next-Generation End-User Computing

3 Mergers and Acquisitions A merger or acquisition often requires organizations to rapidly onboard a large number of users and provide access to services such as , human resources information, and corporate intranet sites. Traditional solutions for this use case include provisioning hundreds of new endpoints or scaling an existing VDI solution with new infrastructure. Both of these options introduce significant upfront costs and lead times. Remote and Contractor Workforce Managing desktops for remote or contractor workforces comes with increased administrative, logistical and security challenges. The onboarding of non-employees introduces a change in the standard process as well as considerations for device ownership, data locality and security, and the security of the endpoint. Seasonal Demand Seasonal staff or just-in-time staff require the ability to be immediately productive with access to similar resources as full-time employees. A DaaS solution not only enables rapid and efficient onboarding and offboarding for seasonal demand, it enables the organization to avoid the cost and administrative overhead of underutilized desktops during non-peak seasons while also adhering to security and compliance policies and regulations. Bring Your Own Device (BYOD) BYOD policies offer the flexibility and mobility many workers are looking for and can be a powerful recruiting tool. In many cases, offering BYOD to candidates can attract highly skilled workers with very specific job requirements and talents. A DaaS solution shifts the burden of solving for device and operating system compatibility to a third-party provider like Amazon Web Services (AWS), while providing the required security and controls. Why Amazon WorkSpaces for DaaS Simplification Balancing security and compliance requirements, scalability needs, BYOD policies, applications, and mobile device support makes managing a traditional EUC environment complex. For companies using virtual desktop infrastructure (VDI), management can be even more difficult and solutions are usually inflexible. The need for infrastructure firmware upgrades, migrations, and change management procedures are just a few of the things driving the cost and complexity of a traditional VDI environment. Moving desktops to the cloud presents an opportunity to reduce complexity and increase agility. Amazon WorkSpaces introduces a new dimension of provisioning virtual desktops with a more dynamic and fluid approach that is not possible with on-premises VDI solutions. Additionally, Amazon WorkSpaces automatically extends the desktop experience to any supported device, including mobile devices. Amazon WorkSpaces allows organizations to focus on their business and keeping users productive. Amazon takes care of the end-user experience. Amazon WorkSpaces doesn t require any upfront CAPEX costs and instead offers a simple, predictable monthly OPEX cost model. This allows IT to extend one or many cloud-based desktops to users, each configured with the right Next-Generation End-User Computing 3

4 set of services and applications per user, for as short or as long a period of time as the desktops are needed. The benefit to the organization is the flexibility to allocate IT spend when and where it is needed most. Features and Functions The Amazon cloud provides a secure, isolated environment that can be controlled, governed and monitored centrally. Amazon WorkSpaces leverages Amazon cloud capabilities such as Identity Access Management (IAM), Virtual Private Cloud (VPC), Multi-Factor Authentication (MFA), and other IaaS and PaaS services. This includes the ability to connect an enterprise Active Directory instance to the Amazon WorkSpaces service through an Active Directory connector. This feature, along with policies to keep all data contained in the Amazon cloud, make it a very attractive solution for securityfocused enterprises. Amazon WorkSpaces leverages the PCoIP protocol to deliver a performant and consistent end-user experience. PCoIP provides support for high-resolution, full frame rate graphics and HD media, multiple large displays, and high definition audio. Unlike traditional EUC platforms, the Amazon WorkSpaces end-user experience does not degrade at scale. There is no risk of saturating the desktop host. Here are a few other Amazon WorkSpaces features and functions that enhance either the management capabilities of the environment or the end-user experience, or both. Image Creation Letting go of creating an image can be hard. We love to do it and have been doing it since early Windows XP days. We wonder who could possibly do it better? One of the benefits of Amazon WorkSpaces discussed earlier was simplification; moving desktops to the cloud reduces complexity. Amazon WorkSpaces provides persistent desktops offering a Windows 7 experience built on Windows 2008 R2 operating system. Do yourself a favor and let Amazon handle your image instead of submitting your own. If you want to put your stamp on the environment, you can customize Amazon s image. WorkSpaces Application Manager Amazon offers a large catalog of pre-packaged applications that administrators can make available to end users. But most organizations have their own applications, including licensed applications, that they need to be able to deploy to WorkSpaces. WorkSpaces Application Manager (WAM) is an application delivery service that allows administrators to publish a catalogue of apps or push them directly to WorkSpaces. WAM can be used to administer applications you have developed yourself, applications you own licenses to, and applications purchased from the AWS Marketplace for Desktop Applications. Endpoint Management Whether you are using fat clients, thin clients, or zero clients, desktop management can be complex. An administrator s ability to upgrade firmware and software, deploy profiles and policies, secure devices, and remotely wipe devices is complicated by the sheer number of device types and operating systems that must be supported. Tools like Microsoft System Center and Altiris help administrators centrally manage servers, laptops, desktops, smartphones, and tablets in a traditional EUC environment. Amazon 4 Next-Generation End-User Computing

5 WorkSpaces does offer some native functionality to help, including automatic Windows updates. Desktop management tools can be extended to an Amazon WorkSpaces environment and are supported configurations by Amazon. AHEAD can help you navigate the marketplace and identify the tool(s) to simplify desktop management in your environment. WorkSpaces Bundles Amazon offers three hardware options for its desktop configurations: Value, Standard, and Performance. The bundles offer varying options for hardware resources including vcpu, Memory, and User Storage. For an additional monthly fee, each of those desktop configurations can be upgraded to Plus which includes Microsoft Office Professional and Trend Micro Worry-Free Business Security Services on top of the standard utilities like IE 11 and Firefox. Aligning the right desktop configuration to your use cases is important not only for delivering the desired end-user experience but also for controlling costs. A developer typically needs the additional resources offered in the Performance Plus bundle while a standard office worker needs can typically be met with the Value Plus bundle. For use cases that don t require Microsoft Office Professional and Trend Micro, like most seasonal workers and students, the base Value or Standard bundles are often sufficient and offer cost savings. We help clients identify the appropriate WorkSpaces bundles for each of their use cases as part of our AHEADStart for Amazon WorkSpaces service. Best Practices for Amazon WorkSpaces Through AHEAD s work with clients and Amazon, we ve developed a set of best practices for success with Amazon WorkSpaces. We ve built an AHEAD WorkSpaces Solution and a set of prescriptive services for moving to Amazon WorkSpaces. The AHEAD Innovation Framework The AHEAD Innovation Framework (AIF) aligns prescriptive services to every stage of your journey. Our collaborative approach allows us to drive consensus on the technical, operational, and financial impacts of a solution and our standardized processes allow us to deliver consistently high-quality services and business outcomes in a compressed timeframe. Strategy and Roadmap During this phase, we identify the potential use cases for DaaS within your organization, develop a financial cost benefit analysis, and assess Amazon WorkSpaces for architectural fit within your organization. Design and Plan During this phase, we work with you to develop a detailed budget, technical integration plan, governance model, and deployment plan. Deploy and Manage During this phase, we do the rollout, help with end-user training and support, and work to continuously optimize your investment and reduce your costs. Next-Generation End-User Computing 5

6 The AHEAD WorkSpaces Solution For clients looking to get started quickly, we offer an AHEADStart for Amazon WorkSpaces service. We leverage our reference architecture to guide and accelerate the design and deployment. Our reference architecture ensures the environment has the necessary foundation or scaffolding in the Amazon cloud and wraps additional services around the native Amazon WorkSpaces services. The result is a production-ready DaaS solution that not only delivers desktops to end users but has the built-in security, monitoring, and integration required for the ongoing management and optimization of the environment. As part of the AHEADStart for Amazon WorkSpaces service, we work with our clients to execute these critical steps: Define Your Use Cases and Growth Model Identify the initial business groups to be onboarded into the solution. Capture application and file services requirements. Estimate monthly costs and seek approvals. Establish the Foundational Architecture and Services Establish a VPC with Amazon cloud. Connect IAM services (e.g. Active Directory). Set up monitoring and management of the Amazon WorkSpaces environment. Configure Amazon WorkSpaces Create and customize a Windows 7 image from Amazon. 6 Next-Generation End-User Computing

7 Define desktop configuration and sizing (align WorkSpaces bundles to use cases). Package and deploy applications using WAM. Operationalize the Service Invest in training and knowledge transfer. Manage spend and actively manage the environment. Consider service expansion and DaaS innovation. Governance, Security, and Compliance We take an automation-centric approach to developing cloud solutions. Automation is not only about speed and ease of use; it is critical to governance, security, and compliance in your cloud environment. Governance We start with a focus on governance and creating a set of shared services. With this in mind, we establish architecture baselines for minimum configuration and associated automation methods. We build Architecture Frameworks in order to establish enterprise IT policies and guidelines to drive consistent decision making. Take as an example the process for decommissioning a WorkSpace when an employee leaves. We would define process hand-offs to enable robust ITSM, Change Management, and Incident Management. Security We help clients identify the right people and applications that need access to create and terminate WorkSpaces. Alignment with the enterprise Active Directory allows for central management of user permissions. Termination in Active Directory terminates user IAM permissions in Amazon. AHEAD helps clients integrate an MFA service and enforce MFA for all IAM users. Additionally, we recommend creating roles for application access to the Amazon API and use groups or roles to assign permissions to IAM users. Implement a Key Management Service and rotate credentials regularly. Implement secure user access and change management logging. Centralize logging in a secure, isolated management VPC and store CloudFormation templates and other infrastructure code in a secure code repository within the management VPC. When working with our clients to develop an Amazon WorkSpaces solution, we start with the following AHEAD best practices and then customize automation to align with their needs: Compliance While compliance is typically a rather cumbersome process, having the ability to log and audit activity is a key component of any compliance methodology. AHEAD recommends implementing CloudTrail as a central auditing tool for API-level auditing and using CloudWatch to collect and track metrics, monitor log files, and set alarms. Next-Generation End-User Computing 7

8 Microservices Approach for Amazon WorkSpaces Automation The aforementioned governance, security, and compliance framework can be managed via an Infrastructure as Code (IAC) model. Think DevOps for WorkSpaces. IAC is IT infrastructure that can be managed and provisioned automatically using code, reducing effort and errors typically seen with manual provisioning. As part of any WorkSpaces deployment, we use templates and standard builds wherever possible and automate through the use of an API to quickly spin up new WorkSpaces and terminate old ones. Billing and Cost Reporting In most organizations, the ability to showback or chargeback desktop costs is an important component of an EUC solution. Most services in the Amazon cloud allow resources to be tagged with metadata like user name or department in order to facilitate showback, chargeback, and auditing. AHEAD has developed a set of best practices for tagging in AWS. For example, it is best practice to leverage descriptive tags (not uncommon acronyms) for tagging applications to aid in auditing. We leverage our best practices for tagging to help clients understand their reporting requirements and develop a chargeback strategy to fit with their internal finance system. 8 Next-Generation End-User Computing

9 Getting Started with Amazon WorkSpaces Organizations are more dynamic than ever; they grow, they shrink, they acquire, they divest, they respond to seasonal demand, and they augment their workforce as needed. While they have to be agile and nimble, they still must operate as mature, well-governed, secure entities. In today s enterprises, keeping workers productive and creating an innovative environment can be a distinct differentiator to win in the market. The landscape is competitive, so the ability to attract and retain talent and remain agile as an organization is critical. Many choices exist, but often require complex infrastructure and capital investments, dramatically reducing the time to value. DaaS solutions like Amazon WorkSpaces provide organizations with the flexibility to rapidly respond to these dynamic business requirements by reducing upfront capital expenditures and simplifying ongoing management, all while providing the required security and controls. Understanding your use cases for DaaS and defining a strategy is just the first step. AHEAD can help you navigate the entire process, leveraging our AHEAD Innovation Framework, our AHEAD WorkSpaces Solution, and our best practices to help you get it right the first time. Next-Generation End-User Computing 9

10 CLIENT SPOTLIGHT: BETTER BILLING THROUGH METADATA When metadata is leveraged in Amazon Web Services (AWS), it allows organizations to have a better understanding of the state of their elastic public cloud environment. But what exactly is metadata, anyway? Think of it as one piece of data that describes another piece of data. For a real world example, pull your driver's license out of your wallet. There are at least three dates visible: your date of birth, the license issue date, and the license expiration date. These numbers make sense when prefixed with the metadata classifications: DOB, Issued, and Expires. But can you imagine how difficult it would be to interpret these numbers without metadata classifications? Similarly, an IT administrator would have a difficult time understanding how AWS resources are being consumed without key pieces of information like user, department, region, etc. AWS supports metadata classifications by allowing clients to tag resources with pieces of information like this. Most of our clients use tags to help gain a deeper understanding of a constantly elastic environment. The AHEAD public cloud team works with clients to provide best practice guidance and help determine the optimal tagging strategy to support their showback and chargeback requirements. The WorkSpaces service allows organizations to quickly deliver cloud-based desktops to end users in a pay-as-you-go model. At the time this was written, Amazon WorkSpaces did not support tagging. An AHEAD client utilizing the Consolidated Billing for AWS service needed a way to tie their WorkSpaces spend back to internal user IDs. Because metadata is so important and WorkSpaces didn't yet support tagging, our team created a custom application to capture the data needed to help them meet their chargeback requirements. In creating this custom solution, the team had three primary objectives: Avoid third-party services. AWS is a broad platform with robust capabilities. We set out to create a solution using only services available within the AWS platform. Avoid manual work. We needed to build an automated solution that didn t require ongoing effort and maintenance from the AWS administrator. Minimize ongoing costs. Because any query or function run in AWS consumes resources, we needed to create an efficient solution and avoid anything resource-intensive. The core of the solution we developed is an application that is written in Python and runs via the Lambda serverless compute service. The application queries the WorkSpaces API, processes the returned data, and stores the appropriate WorkSpaces metadata in DynamoDB, another AWS tool and a fully-managed NoSQL database service. Lambda is scheduled to run the application on 15-minute intervals, which is frequent enough to capture an accurate state of any new or existing WorkSpaces. On the first day of each month, a detailed report of user WorkSpaces consumption is generated and stored in S3, an object-based, highly scalable and secure AWS storage solution. We chose to utilize Lambda because it gives us access to compute resources and allows us to run code without the need to maintain additional infrastructure solely for the purpose of 10 Next-Generation End-User Computing

11 CLIENT SPOTLIGHT: BETTER BILLING THROUGH METADATA tracking resources. DynamoDB was chosen as the preferred storage backend due to extremely granular controls around cost, throughput, and storage. The combination of the services chosen provided a self-contained, cost-effective, and scalable solution. It captured the metadata required by our client to help IT staff better understand how their WorkSpaces resources are being consumed, as well as provided the business with the required chargeback information. If you're interested in learning more about the services AHEAD offers for Amazon Web Services, contact us at aws-ops@thinkahead. com Amazon WorkSpaces Lambda funtion queries WorkSpaces data AWS Lambda WorkSpaces data is processed and stored in DynamoDB Amazon DynamoDB Monthly report written to S3 S3 Bucket Next-Generation End-User Computing 11

12 When you need to innovate, think AHEAD. AHEAD helps simplify IT through innovation. We enable enterprise clients to rapidly deliver applications and services by providing a Cloud Delivery Platform and Innovation Framework for execution. For more details, visit S. Wacker Drive Suite 2500 Chicago, IL The material in this document is the proprietary information of AHEAD, LLC. All products, trademarks, and copyrights herein are the property of their respective owners AHEAD, LLC. All rights reserved. 5/26/16.