AWS Integration

Introduction to Abiquo and AWS

The Abiquo Amazon EC2 integration is a hybrid cloud feature that enables our customers to add Amazon public cloud regions to the Abiquo platform as part of our agnostic public cloud management. With the Abiquo hybrid cloud platform you will be able to offer a service that is a federation of Abiquo private clouds and the public cloud. Cloud tenants can deploy virtual resources in public cloud regions or in Abiquo datacenters through the same award-winning user interface. You can control the use of public cloud resources in the same way as in the Abiquo Datacenter (quotas, limits, etc).

Amazon Regions are added as Abiquo public cloud regions. Abiquo manages public cloud regions using a set of the Abiquo Remote Services. The remote services used in a public cloud region can be shared with other datacenters or public cloud regions. No NFS repository is required to use with a public cloud region.

Diagram of private and public cloud providers managed by Abiquo with remote services

Each Abiquo public cloud region corresponds to a single Region in Amazon EC2. Each Abiquo enterprise using the Amazon public cloud region should have its own Amazon account. Abiquo will validate your Amazon credentials (Access Key ID and Secret Access Key) with AWS. Each enterprise may register ONE set of credentials for the enterprise's AWS account.

Diagram of tenant entities in Abiquo and AWS

When users create a virtual datacenter in the public cloud region, Abiquo works with Amazon EC2. Abiquo creates a Virtual Private Cloud (VPC) for each Abiquo virtual datacenter. By default, for each Amazon VPC, Abiquo creates a public subnet and a private subnet, which is a private connect network. The private subnet has an Internet gateway and access to the VPC from outside the cloud is through NAT or Elastic IPs via the public subnet. Elastic IPs are registered in Abiquo as floating IPs. Floating IPs are managed like public IPs but they do not belong to any Abiquo network. Within your virtual datacenter, you can create more Abiquo private networks (subnets in your VPC), which will enable you to deploy to different Availability Zones. The private subnets in the same availability zone as the public subnet will have internet access through the public subnet.

Diagram of Abiquo entities and AWS entities

VMs deployed in the VPC virtual datacenter are Amazon Instances. Add your public key to your Abiquo user before you deploy a VM. Your Amazon instance will be created using your RSA public key to enable remote access. You will need the corresponding RSA private key to access the instance.

Manage Amazon Instances with Abiquo

Do not rename an Amazon instance in AWS or you will break the link between Abiquo and the VM. If the link is broken, you will not be able to manage the VM with Abiquo again. Do not delete the tags created by Abiquo.

If you need to manage your Abiquo Elastic IPs in Amazon, synchronize them to update changes in Abiquo or you may see unexpected results.

How Abiquo Creates a Virtual Private Cloud

In the AWS integration, Abiquo creates VPCs with NAT support with a public subnet, and allows VMs on different subnets to be connected to the same load balancer. Abiquo supports the AWS gateway address as the first address in the network.

Abiquo configures VPC networking Scenario 2 as described in the AWS documentation http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html.
Under this configuration, users must attach Elastic IPs to VMs with a connection to the public subnet. And by default, VMs in private networks will have internet access through the public subnet. This is helpful for automation because a VM can now connect to the internet to download its configuration, for example, using Chef, without an Elastic IP.

Diagram of how Abiquo creates a VPC in AWS with a NAT gateway

VPC and Subnet

When you create an Abiquo virtual datacenter in an AWS public datacenter, Abiquo creates a VPC with a minimum size of /16 and a subnet of size /24 (or with the sizes defined by the user). The default CIDR for the VPC and the subnet is 192.168.0.0, which is the default private network in Abiquo. You can set a custom private network in Abiquo and this network will be used to create the VPC and subnet in Abiquo. You can create multiple address ranges and Abiquo private networks in different availability zones in the same VPC.

AWS reserves IP addresses in your private networks. It reserves the first four IP addresses and the last IP address of the VPC private connect network. These IP addresses are not displayed or used by Abiquo. Therefore the first available IP address in a network that is defined to start with address 0, will be address 4, and the gateway address will be address 1.

For example, in the default_private_network with network address 192.168.0.0, the following addresses would be reserved or used as the gateway.

IP Address	Notes
192.168.0.1	Reserved by AWS, default gateway address
192.168.0.2	Reserved by AWS
192.168.0.3	Reserved by AWS
192.168.0.254	Reserved by AWS

Internet Access

Abiquo creates a route table that is equivalent to the AWS route table with the values of the Abiquo private network. You can use the AWS NAT instance for Internet access from the Abiquo virtual datacenter private network. You can acquire floating public IPs for your virtual datacenter and in AWS, these will be created as Elastic IPs with public network addresses. Note that AWS may charge for Elastic IPs when they are NOT in use, i.e. when they are not assigned to a VM or when the VM is not deployed in AWS. You must assign the Elastic IPs to VMs with connections to the Public subnet. When creating a NAT gateway, Abiquo will reuse floating IPs that are not assigned to a VDC.

Security groups

By default Abiquo assigns instances to the default VPC security group. This means that by default, all outbound traffic from instances is allowed. Enterprise administrators should configure an Abiquo firewall. Abiquo will create an AWS Security group in the VPC when this firewall is assigned to a virtual datacenter. Users can synchronize their firewalls with AWS, which will import existing security groups. The most basic configuration is to allow SSH inbound traffic, for example, port 22, which will allow SSH connections to the machine through a public IP, NAT, or from a private IP within the virtual datacenter. See AWS Security Groups as Abiquo Firewalls.

Number of IP Addresses per VM

Abiquo supports multiple IP addresses in the AWS integration. You can synchronize existing VMs with multiple IP addresses and create multiple IP addresses through Abiquo, including multiple Elastic IPs.

Abiquo supports the number of IP addresses supported by the AWS hardware profile (instance type). See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI

If the user adds multiple IPs in the same subnet, Abiquo adds them to the same elastic network interface. And if the IPs are in a different subnet, Abiquo adds them to a different elastic network interface. For information about Elastic Network Interfaces, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html