best practices for partnering with aws

Leveraging Marketplace and AWS

Partner Network Resources

Josh Hofmann, Senior Manager, NA Partner Development

Barry Russell, Head of Global Marketplace BD

Matt Yanchyshyn, Senior Manager, Solution Architecture

PartnerNetwork

Agenda - Leveraging AWS Partner Network

resources

1. APN and AWS Global Partner

Programs and best practices

2. Leveraging the AWS

Marketplace

3. Incorporating security best

practices into your solutions

PartnerNetwork

AWS Global Partner Programs and

Best PracticesJosh Hofmann

NA Partner Leader West

jhof@amazon.com

Trends in the AWS Partner Network ecosystem

Partners are:• Joining the APN at record pace

• Growing their AWS offerings quickly

• Offering packaged services & solutions

Enterprises are:• Asking for DevOps and managed services

• Increasingly deploying SaaS software

• Using AWS Marketplace software for production

Provide:

• Software

• Databases

• OS and tooling solutions

Provide:

• Professional services

• AWS integration, migration,

managed services

Technology partners Consulting partners

Premier

Advanced

Standard

Registered

Delivery Model ExpertiseExperiencePartner Type

Your roadmap: AWS Global Partner Programs

Channel Programs

MSP Program

SaaS Program

Competency

Program

Government

Program

Test Drive

AWS Marketplace

Consulting

TechnologyGTM Resources

Go-To-Market

PartnerNetwork

APN Benefits for partnersTraining & Enablement

• On-Demand Sales & Technical

Training & Accreditations

• APN Webcast Videos

• 20% Discount Classroom Training

• Solutions Architect Office Hours

• AWS QuickStarts

• Subsidized Classroom Training

• ProServe Bootcamp Training

• Product Development Credits

• Named Solutions Architect

• 10 Days Free AWS ProServe

Marketing & Go-to-Market

• Syndicated Web Content

• Email Marketing Platform

• Partner Enablement Guides

• Opportunity Registration

• Listing in the AWS Directory

• Marketing Development Funding

• Demand Generation Campaigns

• AWS Written Case Study

• Proof-of-Concept Credits/Funding

• Listed on AWS Solution Pages

• Named Partner Manager

• Validates partners with proven workload and

vertical capabilities

• Differentiates APN Partners to AWS Customers

• Validated based on:

• Customer success, AWS certifications,

technical readiness, AWS product or practice

review, customer references

APN Competency Program

Current APN competencies

Digital media

Storage

Life sciences Healthcare

SAP Oracle

Big data

Microsoft

Channel Reseller Program

Validation Audit for all Partners in the Program

• Enables qualified APN Consulting

Partners to resell AWS services to

both commercial and public sector

AWS customers

• Ideal for partners building value-

added offerings on AWS

• Partner handles billing,

procurement, and support for their

customers

“Being an AWS Channel Reseller

enables us to establish an even

closer partnership with our

customers and deliver value to

them by accelerating adoption of

the services provided by AWS.“

- Cloudreach

Value-added solutions are driving revenue

AWS Managed Services ProgramFor Consulting Partners offering managed

services on AWS• Technical Enablement – DevOps Approach,

Security, Customer Expectations

• Business Enablement – Marketing and Go-to-Market

Validation Audit to Qualify for the Program• Migration, operations, security, and cloud infrastructure management

• Proactive monitoring and automation of customer’s environment

Self-Assess with the Validation Checklist in the APN Portal

“AWS is raising the bar on partners to ensure a consistent and rewarding

customer experience” – 2nd Watch

Professional Services / Strategy Consulting / Architecture

2x to 5x

Multiplier on top

Of AWS

Application / Development / Integration / Migration

$50k

To

$200K

Managed Infrastructure Services

15% to 40%

Uplift

On AWS

AWS Optimization

RI Purchases

Reduce Costs

30% to 60%

Software

5% to 30%

License

MarginsApp/Dev Example:

$150K to build app

$100K on-demand over 1 year to run on AWS

$50K in third-party SW license

On-premises to AWS cloud transformation:

3X to 10X uplift over AWS spend

Customer example for managed services

3X = $300K

$150K

25% = $25K

40% reduce

$40K 20% margin

$10K

Overall Cost:

$635K

$450K project

$85k recurring

Software-as-a-Service Program (Preview)

Enables partners to deploy on AWS in

a SaaS delivery model

Technical & Business Enablement

• Apply on APN Portal today

• SaaS Reference Page on Portal

• SaaS Webcasts

• SaaS Program Office Hours

• Creating a SaaS Partner Community to

collaborate and share best practices

“By 2017, about 26.2% of all new business software

purchases will be of service-enabled software.” - IDC

“We are pleased to be one of the

members of AWS’ SaaS Partner

Program, which gives us access to

tools and training to assist us in

designing and delivering cloud-based

applications.” - PegaSystems

Consulting Partner best practices

Packaged service

& solution offeringsFixed price

migration

DevOps

workshops

Security as a

service

Script most

common projects

Technology Partner best practices

Deploying

SaaS on AWS

Engaging

Consulting

Partners

Taking a solution

approach

Promotion via the

AWS brand

All-in on AWS

18% of all software delivery will be SaaS by 2017 (IDC)

Cloud software will grow to $76.1 billion by 2017 (IDC)

AWS Marketplace

Barry Russell

Head of Global Business Development

barryr@amazon.com

Where does AWS Marketplace fit?...as part of a

customer solution enabling Workloads moving to AWS

Enterprise Applications

Administration & Security

Core Services

Platform Services

Infrastructure

AWS Marketplace

Why cloud changes software procurement

“35MM+ physical servers

globally today – only

15% in the cloud” *IDC

Cloud is shifting software from

perpetuity to subscription OR

consumption-based

Enterprises invest $310B

annually in software

Selecting, purchasing, and

deploying is still slow and

manual

“…50% of workloads will

move to the cloud by

2018” *IDC

Companies use BYOL to

bring premise license over

or buy “as needed”

through AWS Marketplace

So what shift is happening?

• Enterprise, Government, SMB changing how they buy and deploy

• Procurement teams looking to cloud catalogs for departmental projects

• Software consumption “as you go”

• Software market now transforming with cloud, as did infrastructure

• And a 5 Workload to cloud model (we are aligning with our Global Field):

– Media Workloads

– BI/Big Data Workloads

– Storage Workloads

– WebSite Workloads

– DevOps Workloads

AWS Marketplace

About us

• Launched in April 2012

• Publishes software

• Over 700 software partners

• More than 2,200 product listings

Benefits to customers

• Easy product discovery

• Simplifies procurement for customers

• Eliminate license management

• One AWS bill

• Consume hourly, monthly, annually

By the numbers…

400% Usage Growth in

2014

Over 1B Hours of software

consumed annually

2,200 products and growing

AWS Marketplace customers – Who is buying?

AWS Intelligence Community (IC) Marketplace (*note we are taking ISV submissions now for this catalog)

SoftNAS – Success of the start-up on AWS

• With software vetted on AWS Marketplace,

Enterprises can buy start-up with confidence and

without any additional paperwork

• From 15 customers to 280+ in 1 year

• 87% conversion to paid customers from free trials

“AWS Marketplace reduced over 20 individual steps to a

simple ‘1-Click’ allowing us to deliver…in less than 2 minutes.

What took customers weeks if not months, and costs

thousands of dollars can now be accomplished in under two

minutes…It enables SoftNAS to deliver a seamless cloud

based storage solution, get access to the global AWS

customer base while at the same time provide a low-cost

channel compared to traditional IT channels.”

– Bill Hood, Founder and SVP Cloud Markets

Digital marketing drives adoption

How does an ISV, SI, or VAR get into AWS Marketplace?

• Simple process; can be ready in 30 days

• Security product testing and screen

• Provide us products as an AMI

• Give us metadata about your product

• Tell us how to price your products

• Engage AWS Marketplace BD for launch plan

…and you are ready to go!!!

How do I build a transformational business with

AWS Marketplace?

• Use AWS Marketplace as primary sales and

delivery channel (ISV and Consulting Partners)

• Train your technical and field staff on AWS using

APN Programs

• Participate in our Customer Data Sharing Program

• GTM best practices:

– Comp your field to align with ours

– Build website assets; point to your listing

– Develop quarterly GTM plans

• List your full software suite - price annually

• Take advantage of PoC GTM funding

Security Best Practices

Matt Yanchyshyn

Sr. Manager, Solutions Architecture

AWS Foundation Services

Compute Storage Database Networking

AWS Global

Infrastructure Regions

Availability ZonesEdge

locations

AWS is responsible for the security of the cloud

AWS Foundation Services

Compute Storage Database Networking

AWS Global

Infrastructure Regions

Availability ZonesEdge

Locations

Client-side data

encryption

Server-side data

encryptionNetwork traffic

protection

Platform, applications, identity & access management

Operating system, network, & firewall configuration

Customer applications & contentC

usto

mers

Customers configure their security in the cloud

Defense-in-depthAWS compliance

program

Third-party

attestationsPhysic

al

Security groups

VPC configuration

Netw

ork

Web application firewalls

Bastion hosts

Encryption in-transit

Hardened AMIs

OS and apppatch mgmt.

IAM roles for EC2

IAM credentialsSyste

m s

ecurity

Logical access controls

User authentication

Encryption at-restD

ata

security

AWS security offerings

Auditability

Compliance

reports

Visibility

Amazon CloudWatch

AWS CloudTrail

AWS Config

“Describe” APIs

Control

AWS IAM

AWS CloudHSM

AWS CloudFormation

AWS KMS

Encryption: data at rest

EBS

Volume encryption

EBS encryption OS toolsAWS

marketplace/partner

Object encryption

S3 server-side

encryption (SSE)

S3 SSE w/ customer provided keys Client-side encryption

Database encryption

Amazon Redshift

encryption

RDS

PostgreSQL

KMS

RDS

MYSQL

KMS

RDS

ORACLE

TDE/HSM

RDS MSSQL

TDE

Built-in firewall: security groups and NACLs

• VPC security groups (mandatory)– Instance level, stateful

– Supports ALLOW rules only

– Default deny inbound, allow outbound

– Use as “whitelist” – least privilege

• VPC NACLs (optional)– Subnet level, stateless

– Supports ALLOW and DENY

– Default allow all

– Use as “blacklist”/“guardrails”(port 135,21,23…)

• Separation of duties

• Changes audited via AWS CloudTrail

• Additional cost for SGs/NACLs: $0

Physical Interfaces

Customer 1

Hypervisor

Customer 2 Customer n…

…

Virtual Interfaces

Firewall

Customer 1

Security

Groups

Customer 2

Security

Groups

Customer n

Security

Groups

Security Groups

Enforce consistent security on your hosts

Launch

instanceEC2

AMI catalog Running instance

Your instance

Hardening

Audit and logging

Vulnerability management

Malware and HIPS

Whitelisting and integrity

User administration

Operating system

Configure

instance

Configure and harden EC2 instances based on security and compliance needs

Host-based protection software

Restrict access where possible

Connect to existing services

Separate static assets and move servers away from

the edge

Inbound HTTP

CloudFront

Amazon S3

WAFDynamic

App

App

AppPeering

Identity and Access Management (IAM)Create appropriate principles, authorization, and privileges for AWS resources

Multi-factor authenticationAWS Identify and

Access Management

Policies

User

Groups

Roles

Principle of least privilege

User User Hardware Virtual

IAM AWS administrative users

Root account

Note: Always associate the account owner ID with

an MFA device and store it in a secured place!

AWS partner solutions extend & enhance security

• Some examples:– Cisco CSR (VPN)

– Sophos UTM (firewall, …)

– Alert Logic Web Security Manager (WAF)

– Alert Logic Threat Manager (NIDS)

– Trend Micro Deep Security (IDPS)

– Trend Micro SecureCloud (encryption)

– Dome9 SecOps (security group audit & management)

– …