So, what should we be concerned about if we were about to run our web server on EC2? What are the pro's and cons?
The pros and cons of EC2 are somewhat dependent on your business. Below is a list of issues that I believe affect large organizations:
Separation of duties Your existing company probably has separate networking and server operations teams. With EC2 it may be difficult to separate these concerns. ie. The guy defining your Security Groups (firewall) is probably the same person who can spin up servers.
Home access to your servers Corporate environments are usually administered on-premise or through a Virtual Private Network (VPN) with two-factor authentication. Administrators with access to your EC2 control panel can likely make changes to your environment from home. Note further that your EC2 access keys/accounts may remain available to people who leave or get fired from your company, making home access an even bigger problem...
Difficulty in validating security Some security controls may inadvertently become weak. Within your premises you can be 99% certain that all servers are behind a firewall that restricts any admin access from outside your premises. When you're in the cloud it's a lot more difficult to ensure such controls are in place for all your systems.
Appliances and specialized tools do not go in the cloud Specialized tools cannot go into the cloud. This may impact your security posture. For example, you may have some sort of network intrusion detection appliances sitting in front of on-premise servers, and you will not be able to move these into the cloud.
Legislation and Regulations I am not sure about regulations in your country, but you should be aware of cross-border issues. For example, running European systems on American EC2 soil may open your up to Patriot Act regulations. If you're dealing with credit card numbers or personally identifiable information then you may also have various issues to deal with if infrastructure is outside of your organization.
Organizational processes Who has access to EC2 and what can they do? Can someone spin up an Extra Large machine and install their own software? (Side note: Our company http://LabSlice.com actually adds policies to stop this from happening). How do you backup and restore data? Will you start replicating processes within your company simply because you've got a separate cloud infrastructure?
Auditing challenges Any auditing activities that you normally undertake may be complicated if data is in the cloud. A good example is PCI -- Can you actually always prove data is within your control if it's hosted outside of your environment somewhere in the ether?
Public/private connectivity is a challenge Do you ever need to mix data between your public and private environments? It can become a challenge to send data between these two environments, and to do so securely.
Monitoring and logging You will likely have central systems monitoring your internal environment and collecting logs from your servers. Will you be able to achieve the monitoring and log collection activities if you run servers off-premise?
Penetration testing Some companies run periodic penetration testing activities directly on public infrastructure. I may be mistaken, but I think that running pen testing against Amazon infrastructure is against their contract (which make sense, as they would only see public hacking activity against infrastructure they own).
I believe that EC2 is definitely a good idea for small/medium businesses. They are rarely encumbered by the above issues, and usually Amazon can offer better services than an SMB could achieve themselves. For large organizations EC2 can obviously raise some concerns and issues that are not easily dealt with.
The main negative is that you are fully responsible for ALL server administration. Such as : Security patches, Firewall, Backup, server configuration and optimization.
Amazon will not provide you with any OS or higher level support.
If you would be FULLY comfortable running your own hardware then it can be a great cost savings.
i work in a company and we are hosting with amazon ec2, we are running one high cpu instance and two small instances. i won't say amazon ec2 is good or bad but just will give you a list of experiences of time
reliability: bad. they have a lot of outages. only segments mostly but yeah...
cost: expensive. its cloud computing and not server hosting! a friend works in a company and they do complex calculations that every day have to be finished at a certain time sharp and the calculation time depends on the amount of data they get... they run some servers themselves and if it gets scarce, they kick in a bunch of ec2's. thats the perfect use case but if you run a server 24/7 anways, you are better of with a dedicated rootserver
a dedicated root server will give you as well better performance. e.g. disk reads will be faster as it has a local disk!
traffic is expensive too
support: good and fast and flexible, thats definately very ok. we had a big launch of a product and had a lot of press stuff going on and there were problems with the reverse dns for email sending. the amazon guys got them set up all ripe conform and nice in not time.
amazon s3 hosting service is nice too, if you need it
in europe i would suggest going for a german hosting provider, they have very good connectivity as well.
One minus that forced me to move away from Amazon EC2:
spamhaus.org lists whole Amazon EC2 block on the Policy Block List (PBL)
This means that all mail servers using spamhaus.org will report "blocked using zen.dnsbl" in your /var/log/mail.info when sending email. The server I run uses email to register and reset passwords for users; this does not work any more.
With a stock EC2 server, if an instance goes down, it "goes away." Any information on the local disk is gone, and gone forever. You have the added responsibility of ensuring that any information you want to survive a server restart is persisted off of the EC2 instance (into S3, RDS, EBS, or some other off-server service).
I haven't tried Amazon EC2 in production, but I understand the appeal of it. My main issue with EC2 is that while it does provide a great and affordable way to move all the blinking lights in your server room to the cloud, they don't provide you with a higher level architecture to scale your application as demand increases. That is all left to you to figure out on your own.
This is not an issue for more experienced shops that can maintain all the needed infrastructure by themselves, but I think smaller shops are better served by something more along the lines of Microsoft's Azure or Google's AppEngine: Platforms that enforce constraints on your architecture in return for one-click scalability when you need it.
And I think the importance of quality support cannot be underestimated. Look at the BitBucket blog. It seems that for a while there every other post was about the downtime they had and the long hours it took for Amazon to get back to them with a resolution to their issues.
Compare that to Github, which uses the Rackspace cloud hosting service. I don't use Github, but I understand that they also have their share of downtime. Yet it doesn't seem that any of that downtime is attributed to Rackspace's slow customer support.
2) 与其他亚马逊网络服务集成——这一优势经常被忽视。与 Amazon SimpleDB 或 Amazon Relational Data Store 集成意味着您的数据可以独立于 EC2 提供的计算能力而存在。这是一个巨大的胜利，使 EC2 与众不同。
Two big pluses come to mind:
1) Cost - With Amazon EC2 you only pay for what you use and the prices are hard to beat. Being able to scale up quickly to meet demands and then later scale down and "return" the unneeded capacity is a huge win depending on your needs / use case.
2) Integration with other Amazon web services - this advantage is often overlooked. Having integration with Amazon SimpleDB or Amazon Relational Data Store means that your data can live separate from the computing power that EC2 provides. This is a huge win that sets EC2 apart from others.
Amazon cloud monitoring service and support is charged extra - the first one is quite useful and you should consider that and the second one too if your app is mission critical.
发布评论
评论（8）
EC2 的优缺点在某种程度上取决于您的业务。以下是我认为影响大型组织的问题列表：
我相信 EC2 对于中小型企业来说绝对是一个好主意。他们很少受到上述问题的困扰，通常亚马逊可以提供比中小企业自己更好的服务。对于大型组织来说，EC2 显然会引起一些不易处理的担忧和问题。
西蒙@http://blog.LabSlice.com
The pros and cons of EC2 are somewhat dependent on your business. Below is a list of issues that I believe affect large organizations:
I believe that EC2 is definitely a good idea for small/medium businesses. They are rarely encumbered by the above issues, and usually Amazon can offer better services than an SMB could achieve themselves. For large organizations EC2 can obviously raise some concerns and issues that are not easily dealt with.
Simon @ http://blog.LabSlice.com
主要的缺点是您对所有服务器管理负全部责任。如：安全补丁、防火墙、备份、服务器配置和优化。
亚马逊不会为您提供任何操作系统或更高级别的支持。
如果您完全可以轻松地运行自己的硬件，那么这可以节省大量成本。
The main negative is that you are fully responsible for ALL server administration. Such as : Security patches, Firewall, Backup, server configuration and optimization.
Amazon will not provide you with any OS or higher level support.
If you would be FULLY comfortable running your own hardware then it can be a great cost savings.
我在一家公司工作，我们使用亚马逊 EC2 进行托管，我们运行一个高 CPU 实例和两个小型实例。
我不会说亚马逊 EC2 是好还是坏，只是会给你一个时间体验列表
可靠性：不好。他们有很多停电。大多数情况下只是分段，但是是的...
成本：昂贵。它是云计算而不是服务器托管！一个朋友在一家公司工作，他们做复杂的计算，每天必须在某个时间点完成，计算时间取决于他们获得的数据量......他们自己运行一些服务器，如果数据稀缺，他们加入一堆ec2。
这是一个完美的用例，但如果您始终运行服务器 24/7，您最好使用专用的根服务器
专用根服务器也会为您提供更好的性能。例如，磁盘读取速度会更快，因为它有本地磁盘！
流量也贵
支持：又好又快又灵活，那肯定很好。
我们有一个产品的大型发布，并且有很多新闻报道，并且电子邮件发送的反向 DNS 存在问题。亚马逊的家伙很快就把它们设置好了，一切都成熟了，而且很好。
亚马逊 s3 托管服务也很好，如果您需要它
在欧洲需要它，我建议您选择德国托管提供商，他们也有很好的连接。
例如这里：
http://www.hetzner.de/de/hosting/produkte_rootserver/eq4/
http://www.ovh.de/produkte/superplan_mini.xml
http://www.server4you.de/root-server/server -details.php?products=0
http://www.hosteurope.de/produkt/Dedicated-Server-Linux-L
http://www.klein-edv.de/rootserver.php
我托管于他们所有人都取得了很好的经验。最好的肯定是hosteurope，但是价格贵一点。
我运行了一个 CDN，在那里有大约 40 台服务器两年了，其中任何一台都没有遇到过任何中断。
亚马逊在过去两个月中我们的部分发生了 3 次中断。
i work in a company and we are hosting with amazon ec2, we are running one high cpu instance and two small instances.
i won't say amazon ec2 is good or bad but just will give you a list of experiences of time
reliability: bad. they have a lot of outages. only segments mostly but yeah...
cost: expensive. its cloud computing and not server hosting! a friend works in a company and they do complex calculations that every day have to be finished at a certain time sharp and the calculation time depends on the amount of data they get... they run some servers themselves and if it gets scarce, they kick in a bunch of ec2's.
thats the perfect use case but if you run a server 24/7 anways, you are better of with a dedicated rootserver
a dedicated root server will give you as well better performance. e.g. disk reads will be faster as it has a local disk!
traffic is expensive too
support: good and fast and flexible, thats definately very ok.
we had a big launch of a product and had a lot of press stuff going on and there were problems with the reverse dns for email sending. the amazon guys got them set up all ripe conform and nice in not time.
amazon s3 hosting service is nice too, if you need it
in europe i would suggest going for a german hosting provider, they have very good connectivity as well.
for example here:
http://www.hetzner.de/de/hosting/produkte_rootserver/eq4/
http://www.ovh.de/produkte/superplan_mini.xml
http://www.server4you.de/root-server/server-details.php?products=0
http://www.hosteurope.de/produkt/Dedicated-Server-Linux-L
http://www.klein-edv.de/rootserver.php
i have hosted with all of them and made good experiences. the best was definately hosteurope, but they are a bit more expensive.
i ran a CDN and had like 40 servers for two years there and never experienced ANY outage on ANY of them.
amazon had 3 outages in the last two months on our segments.
迫使我放弃 Amazon EC2 的一个缺点是：
这意味着使用 spamhaus.org 的所有邮件服务器将在您的 < 中报告“使用 zen.dnsbl 被阻止”发送电子邮件时的代码>/var/log/mail.info。
我运行的服务器使用电子邮件为用户注册和重置密码；这不再起作用了。
在 Spamhaus 了解更多相关信息：http://www.spamhaus.org/pbl/query/PBL361340
摘要：需要发送电子邮件吗？不要使用 Amazon EC2。
One minus that forced me to move away from Amazon EC2:
This means that all mail servers using spamhaus.org will report "blocked using zen.dnsbl" in your
/var/log/mail.infowhen sending email.The server I run uses email to register and reset passwords for users; this does not work any more.
Read more about it at Spamhaus: http://www.spamhaus.org/pbl/query/PBL361340
Summary: Need to send email? Do not use Amazon EC2.
另一个没有人提到的缺点是：
对于现有的 EC2 服务器，如果一个实例出现故障，它就会“消失”。本地磁盘上的任何信息都消失了，而且永远消失了。您还有额外的责任，确保您希望在服务器重新启动后保留下来的任何信息都保留在 EC2 实例之外（保存到 S3、RDS、EBS 或其他一些服务器外服务中）。
The other con no one has mentioned:
With a stock EC2 server, if an instance goes down, it "goes away." Any information on the local disk is gone, and gone forever. You have the added responsibility of ensuring that any information you want to survive a server restart is persisted off of the EC2 instance (into S3, RDS, EBS, or some other off-server service).
我尚未在生产中尝试过 Amazon EC2，但我了解它的吸引力。我对 EC2 的主要问题是，虽然它确实提供了一种出色且经济实惠的方式来将服务器机房中的所有闪烁灯移至云端，但它们并没有为您提供更高级别的架构来随着需求的增加来扩展您的应用程序。这一切都留给你自己去弄清楚。
对于经验丰富的商店来说，这不是问题，因为他们可以自己维护所有所需的基础设施，但我认为较小的商店更适合使用 Microsoft Azure 或 Google AppEngine 之类的东西：对架构实施约束以换取回报的平台。当您需要时，一键式可扩展性。
我认为质量支持的重要性不能被低估。请查看 BitBucket 博客。似乎有一段时间所有其他帖子 是关于他们的停机时间以及亚马逊花了很长时间才回复他们并解决他们的问题。
与使用 Rackspace 云托管服务的 Github 相比。我不使用 Github，但我知道他们也有停机时间。然而，这些停机时间似乎并不是由 Rackspace 缓慢的客户支持造成的。
I haven't tried Amazon EC2 in production, but I understand the appeal of it. My main issue with EC2 is that while it does provide a great and affordable way to move all the blinking lights in your server room to the cloud, they don't provide you with a higher level architecture to scale your application as demand increases. That is all left to you to figure out on your own.
This is not an issue for more experienced shops that can maintain all the needed infrastructure by themselves, but I think smaller shops are better served by something more along the lines of Microsoft's Azure or Google's AppEngine: Platforms that enforce constraints on your architecture in return for one-click scalability when you need it.
And I think the importance of quality support cannot be underestimated. Look at the BitBucket blog. It seems that for a while there every other post was about the downtime they had and the long hours it took for Amazon to get back to them with a resolution to their issues.
Compare that to Github, which uses the Rackspace cloud hosting service. I don't use Github, but I understand that they also have their share of downtime. Yet it doesn't seem that any of that downtime is attributed to Rackspace's slow customer support.
我想到了两大优点：
1) 成本 - 使用 Amazon EC2，您只需按使用量付费，而且价格无与伦比。能够快速扩展以满足需求，然后缩小规模并“返回”不需要的容量，这是一个巨大的胜利，具体取决于您的需求/用例。
2) 与其他亚马逊网络服务集成——这一优势经常被忽视。与 Amazon SimpleDB 或 Amazon Relational Data Store 集成意味着您的数据可以独立于 EC2 提供的计算能力而存在。这是一个巨大的胜利，使 EC2 与众不同。
Two big pluses come to mind:
1) Cost - With Amazon EC2 you only pay for what you use and the prices are hard to beat. Being able to scale up quickly to meet demands and then later scale down and "return" the unneeded capacity is a huge win depending on your needs / use case.
2) Integration with other Amazon web services - this advantage is often overlooked. Having integration with Amazon SimpleDB or Amazon Relational Data Store means that your data can live separate from the computing power that EC2 provides. This is a huge win that sets EC2 apart from others.
亚马逊云监控服务和支持是额外收费的 - 第一个非常有用，您应该考虑这一点，如果您的应用程序是关键任务，则也应该考虑第二个。
Amazon cloud monitoring service and support is charged extra - the first one is quite useful and you should consider that and the second one too if your app is mission critical.