AWS Global Accelerator

Overview

AWS Global Accelerator is a newer AWS service. It will appear on the exam.

Problem: an application is deployed in one region (e.g. a public ALB in India) but users are all over the world (America, Europe, Australia). Over the public internet traffic passes many router hops. Hops add latency and risk (connections can be lost), and are not as direct as possible into the AWS infrastructure.

Goal: enter the AWS private network as fast as possible, to minimize latency.

Unicast vs Anycast IP

Global Accelerator uses the Anycast IP concept.

How It Works

• Global Accelerator leverages the AWS internal global network to route to your application.
• Two Anycast IPs are created for your application, and they are global.
• The Anycast IPs send traffic directly to the closest edge location of the user.
• The edge location sends traffic to your application through the private AWS network, which is more stable and has less latency.
• It gives two static IP addresses worldwide for any application. The application can be one ALB in one region or multiple ALBs in multiple regions.

Features

Global Accelerator vs CloudFront

Hands-On Walkthrough

Console behavior

Whatever region you are in (e.g. Frankfurt), opening Global Accelerator takes you to US West (Oregon). It is a global service.

Create the application

1. Launch an EC2 instance in US East 1 (Amazon Linux 2 AMI, t2.micro, 1 instance) with the same user data as before, plus text showing the hostname and region ("... from hostname in US East 1").
2. Create a new security group allowing HTTP from anywhere (name global accelerator Demo).
3. Proceed without a key pair (no SSH needed).
4. Repeat in Mumbai (AP South 1). Security groups are scoped by region, so create the security group again.
5. Open each instance's public DNS or IP to confirm "Hello World" from US East 1 and from AP South 1.

Create the accelerator

1. Name it my first accelerator, click Next.
2. Listener: port 80, protocol TCP (HTTP is built on TCP). Client affinity (stickiness, same user to same endpoint) can be set by source IP; here left at the default. Multiple listeners are possible.
3. Endpoint groups (group endpoints by region): US East 1 with traffic dial 100 (100% of traffic to the region), and AP South 1 with traffic dial 100.
4. Health checks: for the EC2 instance, TCP on port 80 or HTTP on /, check interval 10 or 30 seconds, threshold count 3. If endpoints are load balancers such as an ALB, the health check of the ALB is used automatically.
5. Add endpoints: ALB, NLB, EC2 instance, or Elastic IP. Pick the EC2 instance in each group; a weight can be assigned.
6. Click Create accelerator.

Result

• Two static IP addresses (the global Anycast IPs) and an associated DNS name. Status goes to Deployed.
• Health starts as unhealthy and may take a few minutes to update, then both endpoint groups show healthy.

Test routing

1. From Europe, the accelerator URL goes to US East 1, the closest and fastest region.
2. With a VPN to Indonesia (closer to India than America), refreshing returns a response from AP South 1.

Test failover

1. In the AP South 1 security group, remove the inbound rule so health checks fail.
2. Within about a minute, the AP South 1 endpoint shows unhealthy.
3. Refreshing the accelerator DNS name now returns a response from US East 1, because AP South 1 is unreachable.

Clean up

1. Terminate both EC2 instances (N. Virginia and Mumbai).
2. Disable the accelerator first, then delete it (type delete to confirm).

Pricing

• Fixed fee for every full or partial hour an accelerator runs in your account, until it is deleted. (The exact hourly figure is garbled in the transcript.)
• Data transfer fee that depends on source region and destination, from $0.01 per GB up to expensive destinations, e.g. $0.08 per GB for Australia.
• It is an expensive service, but worth knowing for the exam.

Questions & Answers