Hey there, curious minds! Today, we’re delving into the intriguing realm of tensors — the unsung heroes of machine learning. But don’t worry if you’re new to this; we’re here to unravel the mystery and shed some light on these fascinating creatures.

Demystifying Tensors

Alright, let’s start with the basics. In the realm of machine learning, tensors are like the Swiss Army knives — versatile, powerful, and incredibly handy. Think of them as fancy containers that can hold a bunch of numbers arranged in various ways. From simple scalars to complex multidimensional arrays, tensors can handle it all with ease.

Now, why are tensors such a big deal? Well, they’re like the building blocks of machine learning models. Tensors are a fundamental data structure used to represent multi-dimensional arrays of numerical data. They are essentially generalizations of matrices to higher dimensions. Tensors can have arbitrary shapes, including scalars (0-dimensional tensors), vectors (1-dimensional tensors), matrices (2-dimensional tensors), and higher-dimensional arrays.

Whether it’s processing data, training models, or making predictions, tensors are everywhere, quietly doing the heavy lifting behind the scenes. But it’s very rare that higher than 5D tensors are used in machine learning.

Exploring the Dimensions

Now, here’s where things get interesting. Tensors come in different flavors, each with its own unique characteristics. Let’s break it down:

0-D Tensors (Scalars): These are like the solo travelers of the tensor world — single numbers without any fuss. Scalars are quantities that have only magnitude and no direction. Think of them as the simplest form of data, representing things like temperature, mass, or any other single value.

1-D Tensors (Vectors): Vectors add a bit of spice to the mix by introducing directionality. So, they have value and direction.They’re like arrows pointing in a specific direction, representing sequences of numbers like stock prices over time.

2-D Tensors (Matrices): Matrices take things up a notch by organizing data into rows and columns. They’re perfect for representing things like images, tables, or any other two-dimensional data.

N-D Tensors: And then we have the big guns — N-dimensional tensors. In mathematics and particularly in the context of tensor theory and linear algebra, an “n-dimensional tensor” refers to a multi-dimensional array of numbers. This means it’s a generalization of scalars, vectors, and matrices to higher dimensions.

An n-dimensional tensor can have an arbitrary number of dimensions, and each dimension can have an arbitrary size. For example:

- A scalar is a 0-dimensional tensor.

- A vector is a 1-dimensional tensor.

- A matrix is a 2-dimensional tensor.

- An n-dimensional tensor can be thought of as a generalization of these concepts to higher dimensions.

Collection of 1d=2D tensors

Collection of 2d=3D tensors

Collection of 3d=4D tensors

Collection of 4d=5D tensors and so on

In the space of ML, we do not usually use more than 5D tensors.

Tensors in Action

Now that we’ve got the basics down, let’s see how tensors come to life in the real world:

1. Sentiment Analysis: Imagine analyzing the sentiment of a sentence to figure out if it’s positive or negative. With the help of 1-D tensors, machine learning models can crunch through text data and make sense of it all.

2. Image Processing: Ever wondered how computers see the world? Well, with the magic of 2-D tensors, images are transformed into grids of numbers, allowing machines to recognize objects, enhance photos, and even create art.

3. Video Processing: Videos are like a series of images played in rapid succession. By using 3-D tensors, machines can process videos frame by frame, capturing every pixel’s color and movement along the way.

Practical Tips and Tricks

But wait, there’s more! Before you dive headfirst into the world of tensors, here are a few practical tips to keep in mind:

- Tensor Operations: Whether it’s adding, multiplying, or convoluting, tensors can handle a wide range of mathematical operations. Understanding these operations is key to building robust machine learning models.

- Memory Management: With great power comes great responsibility — and that includes managing memory efficiently. Techniques like tensor slicing and data compression can help optimize memory usage and improve overall performance.

• Hardware Acceleration: To turbocharge your tensor computations, consider harnessing the power of specialized hardware accelerators like GPUs and TPUs. These beasts are specifically designed to crunch through tensors at lightning speed, giving your models an extra edge.

In conclusion Tensors help us make sense of all kinds of data, from simple numbers to complex images and sounds.

Happy tinkering!

By Sabiha Ali, Solutions Architect, ScaleCapacity

Machine learning life cycle is a process to build an efficient machine learning project.

ML DLC- machine learning development life cycle.

There are many steps to the machine learning lifecycle.

Identify the problem:

The initial and foundational step in any machine learning endeavor is to identify and frame the problem accurately. This stage is paramount, as it sets the trajectory for the entire project. Given the significant costs associated with machine learning practices, there’s little room for aimless exploration.

Understanding the problem thoroughly ensures that resources are allocated efficiently and that efforts are directed towards addressing the core challenge at hand. It involves delineating the problem scope, defining objectives, and clarifying constraints and requirements.

This meticulous approach not only minimizes the risk of veering off course but also maximizes the likelihood of achieving meaningful and actionable results. Therefore, framing the problem meticulously serves as the cornerstone upon which the entire machine learning journey is built.

Data collection:

Once we’ve identified and clarified the problem at hand, the next crucial step is gathering data. As machine learning students, we have a plethora of resources available for data acquisition.

Often, data can be readily accessible in CSV format from various websites, simplifying the process significantly. Alternatively, we may need to utilize APIs to extract data, requiring coding to pull information in JSON format, which can later be transformed into the desired format for our analysis.

For more complex scenarios, such as obtaining data from websites where direct access isn’t available, we may resort to web scraping techniques.

However, accessing data directly from an organization’s production database isn’t always feasible, especially if it’s actively being used. In such cases, we establish data warehouses, where we extract, transform, and load the data, utilizing the warehouse as our primary data repository.

Additionally, data may be distributed across various clusters, necessitating the extraction of information from these disparate sources. Therefore, the process of gathering data involves navigating through these various avenues to pinpoint and collect the required data effectively.

Data preprocessing:

Data preprocessing is a critical phase in the machine learning pipeline, as it ensures that the collected data is clean, consistent, and conducive to accurate model training. Often, the data we gather is far from pristine; it may contain structural issues, outliers, missing values, noise, or discrepancies in formats due to disparate sources.

In this preprocessing stage, several tasks are undertaken to whip the data into shape. These include removing duplicates to streamline the dataset, handling missing values through imputation or deletion strategies, identifying, and addressing outliers that could skew model performance, and standardizing the scale of the data to ensure uniformity across features.

The overarching goal is to transform the raw data into a standardized format, which is readily interpretable by machine learning models. By undertaking these preprocessing tasks diligently, we pave the way for more accurate model training and ultimately enhance the robustness and reliability of our machine learning solutions.

Exploratory Data Analysis:

In the data analysis phase, we delve deep into understanding the relationships between the input features and the output variable. This involves thorough experimentation with our existing dataset to uncover patterns and correlations.

One key aspect of this stage is visualization, where we represent the data graphically to gain insights. Through techniques like univariate analysis, we explore individual columns, examining distributions, central tendencies, and variability. Bivariate analysis allows us to investigate the relationships between pairs of columns, identifying potential dependencies or associations. Furthermore, multivariate analysis expands this exploration to consider interactions among multiple variables simultaneously.

Detecting outliers is another crucial task during this phase, as these anomalies can significantly impact the performance and accuracy of our models. Additionally, we address challenges such as imbalanced or biased data, ensuring that our analyses are not skewed by disproportionate representation or inherent biases within the dataset.

By rigorously analyzing and understanding our data through various lenses, we equip ourselves with the insights necessary to make informed decisions and build robust machine learning models.

Feature engineering and selection:

Features, often referred to as inputs in machine learning, play a pivotal role in determining the output of a model. These input columns are essentially the characteristics or attributes of the data that are used to make predictions or classifications.

In the process of feature engineering, we manipulate or create new features based on existing ones to enhance the predictive power of our models. This could involve merging or transforming features to extract more meaningful information. For instance, combining the number of bedrooms and bathrooms to derive a single metric like total square footage can provide a more comprehensive representation of the property’s size.

Furthermore, feature selection is a crucial step in model development where we strategically choose the most relevant features from the pool of available inputs. This involves identifying and retaining only those features that have the most significant impact on the target variable, thus improving model performance and efficiency.

By carefully engineering and selecting features, we optimize the model’s ability to accurately capture relationships within the data and make informed predictions or decisions.

Model Training, Evaluation and Selection:

Once all the desired features have been collected, the next crucial step is model training. During this phase, we explore various algorithms to assess their performance on the data. It’s rare to rely solely on one algorithm; instead, we test multiple algorithms to determine which one best suit our specific dataset and problem.

After applying each algorithm, we collect the results and evaluate their performance using predefined metrics. These metrics provide insights into how well each model is performing in terms of accuracy, precision, recall, F1-score, or other relevant indicators. Based on these performance metrics, we can compare the effectiveness of different algorithms.

Once we’ve identified a promising algorithm, we proceed with parameter tuning. Every algorithm comes with its own set of parameters, akin to settings, which can significantly impact model performance. Through parameter tuning, we systematically adjust these settings to optimize the model’s performance on our data.

By iteratively testing and refining our models, we aim to identify the most effective algorithm and fine-tune its parameters to achieve the best possible performance for our specific problem and dataset. This meticulous process ensures that our machine learning model is robust, accurate, and well-suited to address the task at hand.

Model Deployment:

Once the model development process is complete, the next phase involves deploying the model into a software application. This application could take various forms, such as a mobile app, desktop app, or website, depending on the intended use case and target audience.

To deploy the model, we typically create a binary file using specialized tools, encapsulating the trained model’s functionality. This binary file is then integrated into an API (Application Programming Interface), which acts as an interface for interacting with the model. The API processes the input using the model, and returns the results in JSON format.

For example, if a user fills out a form in the application, the data is passed to the Python application, which in turn sends a request to the API. The API utilizes the binary file containing the trained model to process the input data and generate the desired output, which is then returned to the user through the application interface.

To host and deploy the model and API, various cloud platforms such as AWS (Amazon Web Services), GCP (Google Cloud Platform), Heroku, etc., are commonly utilized. These platforms offer scalable and reliable infrastructure for hosting applications, ensuring that the model is available and responsive to user requests.

Testing:

Testing the deployed model is a crucial phase in the development cycle to ascertain its performance in real-world scenarios. A common method employed for this purpose is A/B testing. In A/B testing, users are randomly divided into two groups: one group interacts with the current version of the model (control group), while the other interacts with an updated version (experimental group). By comparing the outcomes of both groups, we can assess the effectiveness of the updated model.

Should the results of A/B testing fail to meet the desired benchmarks, it becomes imperative to revisit earlier stages of the development process to rectify any shortcomings. This iterative approach ensures that the model is refined and optimized to meet the required standards.

Upon successful completion of testing and achieving satisfactory results, the focus shifts towards optimizing the process. Optimization involves fine-tuning various aspects of the model, such as enhancing its efficiency, scalability, or user experience, to further improve its performance and usability.

Through rigorous testing and optimization, the model can maintain its efficacy and relevance, meeting the needs and expectations of users in diverse real-world scenarios. This iterative cycle of testing and optimization is fundamental to the continuous improvement and evolution of the model.

Optimize:

Optimization in the context of machine learning involves several critical steps to ensure the continued efficacy and relevance of the model over time.

Firstly, it’s essential to take a backup of both the model and the data at regular intervals. This ensures that in case of any unexpected issues or failures, we have a fallback option to restore the system to a previous state, minimizing downtime and data loss.

Additionally, setting up a model rollback mechanism is crucial. This mechanism allows us to revert to a previous version of the model if any updates or changes lead to undesirable outcomes or performance degradation. By implementing model rollback procedures, we can mitigate risks and maintain the integrity of the model throughout its lifecycle.

Another aspect of optimization involves determining the frequency of retraining the model. Over time, the underlying data distribution may change, rendering the model’s predictions less accurate or reliable — a phenomenon often referred to as “model rot.” To prevent this, it’s essential to establish a retraining schedule based on factors such as data drift, seasonality, or changes in user behavior. By retraining the model at regular intervals, we can adapt it to evolving data patterns and ensure its continued effectiveness in making accurate predictions.

Overall, optimization in machine learning entails proactive measures such as backups, rollback mechanisms, and regular retraining to safeguard against potential issues and maintain the model’s performance and relevance over time.

In conclusion, the lifecycle of a machine learning (ML) project is a dynamic and iterative process that involves several key stages, each crucial for developing robust and effective models.

By Sabiha Ali , Solutions Architect, ScaleCapacity

Machine learning lifecycle was originally published in ScaleCapacity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Machine learning algorithms can be classified based on the level of supervision required into 4 main categories as Supervised, Unsupervised, Semi supervised and Reinforcement learning.

Supervised

When discussing supervised learning, we typically categorize it into two main types: Regression and Classification. In supervised learning, we have input data along with corresponding output labels. The goal is to establish the relationship between this input and output through the use of algorithms. Once the model is trained on this data, it can provide predictions for new inputs based on the learned patterns.

For instance, consider a dataset containing information about individuals and their job placements, including factors like age, IQ score, and whether they secured a job or not. The task of a machine learning algorithm in this scenario is to identify a mathematical relationship between the input variables (such as IQ and age) and the output variable (job placement). Subsequently, when provided with details of a new candidate, like an IQ of 67 and age 25, the algorithm can predict the likelihood of job placement.

Regression and Classification

The choice between using a regression or classification model wothin supervised learning depends on the nature of the desired output. In regression models, the goal is to predict a continuous value within a certain range. This is suitable when predicting quantities like salary based on input variables. On the other hand, classification models are used when the output falls into distinct categories. For example, determining whether a candidate will get a job (yes or no) based on their attributes.

To illustrate further, if the algorithm is tasked with analyzing images to count the number of traffic lights present, it would utilize a regression model since the output is a numeric value representing the count. Conversely, if the objective is to detect the presence or absence of a traffic light in an image, a classification model would be employed to categorize images as containing a traffic light or not.

In summary, supervised learning involves training algorithms to make predictions based on labeled data, with regression models used for predicting continuous values and classification models for categorizing data into distinct classes or categories.

Unsupervised

Unsupervised machine learning involves extracting insights from data without labeled outcomes. Consider a scenario with a dataset of 10,000 individuals, their IQ scores, and ages, yet lacking information on their job placements. In such cases, predicting outcomes is unfeasible due to the absence of the variable to be predicted. However, unsupervised learning methods like clustering, dimensionality reduction, anomaly detection, and association rule learning can still yield meaningful insights from the data.

Clustering

Clustering endeavors to group similar data points together, enabling the segregation of data into distinct clusters. This process aids in identifying patterns or behavioral trends within the dataset, facilitating subsequent labeling or deeper understanding of the data’s structure. Moreover, clustering is not limited to two-dimensional data and can effectively handle multi-dimensional datasets, enhancing its versatility and applicability.

Dimensionality reduction

Dimensionality reduction techniques aim to streamline datasets by reducing the number of features while preserving essential relationships. By eliminating redundant or irrelevant features, dimensionality reduction simplifies analysis and visualization, particularly beneficial when dealing with complex datasets with numerous input variables. For instance, merging features like the number of bedrooms and bathrooms into a single metric like square footage can streamline the dataset without sacrificing predictive accuracy.

Anomaly detection

Anomaly detection, as its name suggests, identifies unusual patterns or outliers within data. This capability is invaluable in various domains, such as detecting fraudulent transactions in credit card data or identifying defects in manufacturing processes. By flagging anomalies, this technique helps maintain data integrity and enables timely intervention to address potential issues.

Association rule

Association rule learning focuses on uncovering relationships between variables within large datasets. For instance, in a retail setting, this method might reveal patterns in the arrangement of items on shelves, highlighting associations between products that inform strategic merchandising decisions. By elucidating these relationships, association rule learning offers valuable insights into consumer behavior and preferences.

In summary, unsupervised machine learning techniques provide valuable tools for extracting insights and uncovering patterns within data, even in the absence of labeled outcomes. Whether through clustering, dimensionality reduction, anomaly detection, or association rule learning, these methods empower analysts to derive meaningful conclusions and drive informed decision-making processes.

Semi supervised learning

Semi-supervised learning occupies a unique space between supervised and unsupervised learning paradigms. In semi-supervised learning, only a fraction of the data is labeled, while the majority remains unlabeled. This approach harnesses both labeled and unlabeled data to train models, enabling them to make predictions or identify patterns more effectively.

The fundamental premise driving semi-supervised learning is the scarcity and expense of labeled data. Annotated data often necessitates significant human effort and time, contrasting with the abundance and accessibility of unlabeled data. By leveraging both labeled and unlabeled samples, semi-supervised learning optimizes the utility of available resources, enhancing model performance.

Consider a practical example: imagine organizing a collection of family photos on a computer. Initially, these images are unlabeled. As you identify individuals in the pictures — let’s say, recognizing your dad — the system starts to categorize them accordingly. By iteratively assigning labels based on user input, the system refines its clustering algorithm, grouping similar images together. This iterative process embodies the essence of semi-supervised learning, as it utilizes both labeled (identified individuals) and unlabeled (unidentified individuals) data to improve the organization and categorization of the photo collection.

In summary, semi-supervised learning represents a strategic compromise between the resource-intensive nature of supervised learning and the exploratory potential of unsupervised learning. By capitalizing on the combination of labeled and unlabeled data, this approach maximizes the efficiency and effectiveness of machine learning models, enabling them to uncover meaningful insights and make accurate predictions in various applications.

Reinforcement Learning

Reinforcement learning represents a paradigm shift in machine learning where traditional input-output datasets are replaced by an interactive framework where an agent learns to make decisions through direct interaction with an environment. In this setup, the agent is analogous to an individual navigating a new city without prior knowledge of its workings. Just as a newcomer to a city learns through trial and error, the agent learns by experimenting with different actions and observing the outcomes.

The crux of reinforcement learning lies in the feedback mechanism provided to the agent. Instead of labeled data, the agent receives feedback in the form of rewards or penalties based on the outcomes of its actions. Much like how an individual in a new city gauges the success of their actions through the responses they receive from the environment, the agent adjusts its behavior to maximize cumulative rewards over time.

This process mirrors the adaptive nature of human learning, where mistakes are opportunities for growth. Through repeated interactions with the environment, the agent refines its decision-making strategies, gradually uncovering optimal policies to achieve its goals. Just as a newcomer to a city gradually learns the nuances of its streets and social dynamics, the agent acquires a deeper understanding of the environment it operates in.

Ultimately, reinforcement learning empowers machines to autonomously learn and adapt to complex environments without explicit guidance. By leveraging trial and error alongside feedback mechanisms, agents can navigate uncertain terrains, optimize resource allocation, and achieve predefined objectives. Much like the journey of exploration and discovery undertaken by a newcomer to a city, reinforcement learning embodies the essence of learning through experience and interaction.

Stay tuned for more on Machine Learning and Cloud

Sabiha Ali, Solutions Architect, ScaleCapacity.

Machine Learning Classification was originally published in ScaleCapacity on Medium, where people are continuing the conversation by highlighting and responding to this story.

We want to make our databases fast so that the queries we run should return the results fast.

By changing how we store the data in our database we can make the database respond to the queries and optimize our database to either serve the analytical workload or the transactional workload which we call OLAP and OLTP.

Computers in general, even databases, read the data from disks, and hard disks. We are not talking about the RAM data which gets deleted once the computer is shut down but we are talking about the hard disks where the data is stored permanently.

On these storage disks data is stored in the form of blocks. it is evident that if the computer has to read fewer blocks, it is going to take less time and if the computer is going to read data from more blocks, it is going to take more time.

If the data we query are on fewer blocks, then the response of the database would be faster.

Let us understand this with an example

This is a sample sales table

Let us see how this data will be stored in a row-based data store.

In the row-based format, the entire record is stored in one block meaning as you can see in the figure, the record of the first customer — — -the customer name, item ID, and sales amount is stored in the first block.

Therefore, if we are looking for the first customer's details you can find all that in one single block. This type of data store will be great for transactional databases where we need the details of a single entity.

If I have to take the average of all the sales then I would have to scan through all five blocks of data, resulting in more IO and more cost.

Let us see how this data will be stored in a column-based data store.

Data in the column stores are stored differently. Here entire columns are written down inside one block so here we have all the customer names in one block all the item IDS in the next block and all the sales amounts in the third block.

So, instead of having each customer’s data together, we have the whole column of data together.

If I want to access the sum or the average of all the sales amount this database would be fast because everything would be saved in one single block.

I will use this type of database for analytical queries like sum or averages etc

Columnar database is also very suitable for compression because each block will have the same type of data either numbers or strings etc. so it would be very easy to compress the data in the block efficiently.

How would queries work with these different storage methods

Transactional style query

Eg:

SELECT Customer_name , Sales

FROM data

WHERE Item_ID=3000

This is a transactional style query where we need all details of one person.

In the row database, we need to scan the data from just one block whereas, in the columnar database, we would have to scan through a lot of blocks.

Analytical style query

Eg:

SELECT Item_ID, count(1)

FROM data

GROUP BY Item_ID

Here we want to count how many observations we have from each Item_ID, which could be done by reading a single block in the Columnar database, whereas in the row database, we would have to scan through all the blocks

Happy Databasing !!!!

By, Sabiha Ali, Solutions Architect, ScaleCapacity Inc.

Columnar database and Row database — how are they different? was originally published in ScaleCapacity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Let us assume you have an organization, which is receiving data from many sources giving you some examples let’s say you are getting some data from on premises you’re also getting some data from your website clicks you are also getting some CSV files to analyze, and you also want to do some machine learning analysis on some of this data.

All this data is essential to be stored for analysis, some of this data could be purged after some time and some must be retained for longer period of time.

Data lakes can be called as a centralized repository that will allow you to store all your structured data and your unstructured data at any scale.

Now can we say that this is the same as data warehouse. that would be a good question, but a data warehouse is a database which is optimized to analyze relational data which is coming in the line of business applications. It already has a data structure which is optimized for fast SQL queries whereas a data lake not only stores relational data but also non-relational data, the schema is never defined when the data is captured.

AWS uses S3 as your data lake foundation. This will also eliminate server management.

When we build a data lake on Amazon S3 we can pair it up or integrate it with other native AWS services to run

· big data analytics

· artificial intelligence

· machine learning

· high performance computing

· media processing applications etc…

To gain the insights from the unstructured data we can couple it with services like

AWS lake formation and AWS glue to simplify the creation of the data lake itself and also to simplify the analysis of the curated data in the data lake

Also services like Amazon Glue, Amazon EMR, Amazon Athena also makes it very easy to query your data lake directly.

Happy Learning!!!!!!

By

Sabiha Ali, Solutions Architect, ScaleCapacity

Listed below are some features of NLB and ALB which can help us choose the right load balancer in the right scenarios.

Layers and Protocols

Application load balancer is a layer seven load balancer and it listens on HTTP & HTTPS that means it understands the information carried by HTTP or HTTPS protocol, but it will not understand any other layer seven protocols like SMTP, SSH or other custom protocols .

Network load balances function at layer 4 so they are a layer 4 device. This means that they can interpret the TCP,UDP but they cannot understand HTTP or HTTPS

Session Stickiness

Application load balancer is a layer 7 load balancer and it can listen to layer 7 content like custom headers, user location and application behavior, hence Application load balancer can inspect the layer 7 content and make the decisions based on this information. It supports cookies and session stickiness.

NLB cannot understand headers or cookies and they do not have any sessions stickiness because these are a layer 7 entities and NLB works with layer 4.

Unbroken SSL Passthrough

The one thing which we have to take care with ALB is the connection is always always terminated on the ALB, so you cannot have an unbroken SSL from your customers to the application instead every connection will be terminated in the load balancer and then a new connection is made to the application in the back. So an SSL certificate is mandatory for the ALB if you are expecting HTTPS traffic. An unbroken SSL could be very important to security teams and due to this they sometimes tend to leave out the ALB.

Whereas Network load balances can forward the TCP straight to the backend instances which means an unbroken encryption can be done without the load balancer terminating the connection and creating a new one.

Speed

Application load balances are slower than the network load balancers. Why? This is because Network load balancers work in the layer 4 whereas Application load balancers work in layer 7, so more layers or more levels of networks to process for the Application load balancer. So more the processing slower the results. So if you are very keen on the performance then you will have to think about going for Network load balancers. The wonderful thing about Network load balancers is, they are really fast and they can go up to millions of request per second.

Health Checks

Network load balancer and Application load balancer can both do a health check but Network load balancers can merely check the connection health. It will only check the ICMP ping, TCP handshake and it is not application aware, it cannot check the application health. Whereas application load balancer can also evaluate the application health, so in addition to just checking for a successful network connection, it also evaluates the application health.

Static IP Support

Another advantage of network load balancer is it can have a static IP configured which is useful for white listing if you have any corporate client firewalls.

Private link Support

Another important thing about the network load balancer is it can be used with private link to provide services to other VPC

Happy Learning Guys !!!!

Sabiha Ali, Solutions architect, Scalecapacity

In AWS, when you create a VPC, its a private space. All AWS resources are not automatically given a public IPV4 address. The resources in the private subnets cannot communicate with the public internet directly, so we use a process called NAT- Network Address Translation. To understand NAT better look into (NAT Gateway).

With IPV6 the poverty of IP addresses have come to an end. There is no realistic challenge of running out of IPV6, so there is no concept of Public and Private IP addresses. No need of NAT. The number of IPV6 addresses are so huge that even if you pin one IPV6 address to every single thing in the world it wont be exhausted. So its no surprise that all IPV6 addresses within AWS are publicly routable.

How do we enable IPV6 in a VPC in AWS?

Step1: We have to enable IPV6 on a VPC. We can either bring our own IPV6 or use the range from AWS( more common approach). AWS allocates a unique /56 range of IPV6. What makes it unique in the range is the hex pair which is used at the end of the IP. The hex pair can range from 00 to ff accounting for 256 separate /64 networks in a VPC.

Step 2: We enable the IPV6 range for the subnets as well.

Step 3: Add proper route entries in the route tables.

Routing of IPV6 is handled separately than IPV4, so we have the same Route tables and same internet gateway but different routes-IPV4 routes and IPV6 routes. So now the IGW( internet gateway of the vpc) can route the traffic both incoming and outgoing.

We had the gift of a NAT gateway while using our IPV4 addresses which would protect our instances from traffic generated outside the VPC. But now we know that IPV6 does not support NAT. But there is an equivalent to the NAT here- Egress only Internet Gateway. This allows the traffic out but not in. You need to make minor changes in the route tables for this.

And yes a single VPC can have both IGW and Egress Only IGW.

Another important point about the Egress only IGW is it is stateful and you cannot associate a security group with it.

Step 4: Configure the IPV6 on the services wherever you want. Also remember not all AWS services support IPV6.

Happy Learning Guys !!!!

Sabiha Ali, Solutions Architect, ScaleCapacity

Large enterprises have an established network structure and firewalls, intrusion detection and prevention systems, and deep packet inspection systems. They use tools from various vendors they trust. These tools were great for the customers but on-prem architecture forces us to overprovision and the whole design process is different.

Now with the cloud migration in place many of these awesome vendors are AWS partners and we find in AWS marketplace highly sophisticated, virtualized versions of these software. These partners have tremendous value, decades worth of experience and deep domain expertise. In cloud we have the facility of elasticity, pay as you go and resiliency.

A Gateway Load Balancer acts as an entry point here.

Gateway Load Balancers enable you to deploy, scale, and manage virtual appliances, such as firewalls, intrusion detection and prevention systems, and deep packet inspection systems.

It combines a transparent network gateway (that is, a single entry and exit point for all traffic) and distributes traffic while scaling your virtual appliances with the demand.

Gateway Load Balancers use Gateway Load Balancer endpoints to securely exchange traffic across VPC boundaries.

A Gateway Load Balancer endpoint is a VPC endpoint that provides private connectivity between virtual appliances in the service provider VPC and application servers in the service consumer VPC.

You deploy the Gateway Load Balancer in the same VPC as the virtual appliances. You register the virtual appliances with a target group for the Gateway Load Balancer.

So we can put the security applications in a separate VPC and offer it as a SAAS to other accounts too!!!

Gateway Load Balancer is a transparent layer 3 load balancer and doesn’t produce access logs. Access logging can be done on Gateway Load Balancer target appliances such as firewalls, IDS/IPS, and authentication appliances must be enabled in order to collect access logs.

Cloudwatch,VPC flowlogs and Cloudtrail :)

Some key points to remember in Gateway Load Balancer

1. Enables you to intercept traffic and route it to a service that you’ve configured using Gateway Load Balancers.
2. Security groups and endpoint policies are not supported
3. Endpoints support IPv4 traffic only.

Traffic coming to your applications from the Internet (blue arrows):

1. Traffic enters the service application VPC through the internet gateway.
2. Traffic is sent to the Gateway Load Balancer endpoint, as a result of ingress routing.
3. Traffic is sent to the Gateway Load Balancer for inspection through the security appliance.
4. Traffic is sent back to the Gateway Load Balancer endpoint after inspection.
5. Traffic is sent to the application servers (destination subnet).

Traffic from the application to the internet (orange arrows):

1. Traffic is sent to the Gateway Load Balancer endpoint as a result of the default route configured on the application server subnet.
2. Traffic is sent to the Gateway Load Balancer for inspection through the security appliance.
3. Traffic is sent back to the Gateway Load Balancer endpoint after inspection.
4. Traffic is sent to the internet gateway based on the route table configuration.
5. Traffic is routed back to the internet.

Happy Learning Guys!!!!

By Sabiha Ali, Solutions Architect, ScaleCapacity

AWS WAF- Web Application Firewall

Yes, we do have NACLs, which is a network firewall, but to protect us from the exploits of application layer attack we use WAF. A traffic which seems harmless to the NACL, can be built in with an attack motive like SQL-injection, HTTP flood, Cross site scripting or many many more.

The ultimate motive of any web application is to serve the clients but not all clients are ideal, some are attackers or bots designed to attack the web application.

WAF lets us configure rules that allow, block, or monitor (count) web requests based on conditions that you define.

These conditions can include IP addresses, HTTP headers and body, or custom URIs.

You can set up rules like Rate Based Blocking to automatically block bad traffic, or respond immediately to incidents. Here the WAF keeps a count of how many requests can be allowed for a particular type of client. If they exceed the limit ,they are blocked.

We also have WAF Managed Rules which helps us to deploy pre-configured rules to protect your applications common threats like application vulnerabilities. All Managed Rules are automatically updated by AWS Marketplace security Sellers.

After configuring all the rules, we put them together in a WACL(Web Access Control List)

With WAF we can also configure the response body which the user gets when traffic is blocked for them.

Happy learning guys !!!

For more such titbits on

Envelope Encryption

NACLs Vs SGs

Availability Vs Durability

NAT Gateway

Pre-Signed-URL

By Sabiha Ali, Solutions Architect, ScaleCapacity