Ask Us Anything: Episode 12

Rahul

Hello, everyone. I’m doing very well. I had an amazing weekend.

Rahul

It feels like we kind of are regaining our social life of sorts. So this Friday evening, very dear friends of ours who have kids exactly the same age as ours, we decided that we would try catching up after we put the kids to bed. And was just so amazing. We stayed up till 1:00 am just chatting. It was really, really awesome. So awesome that we decided to do it again on Saturday. So, it feels like…and I can’t remember the last time we did something like this. So yeah, that and a bunch of interesting 3D printing home assistant set up, I set up Octo-Print for my 3D printer. So yeah, a bunch of interesting things I got to do all through the weekend.

Rahul

Correct.

Rahul

That’s exactly what we did. I mean, and the probability that two nights in a row lineup that way is, I mean has been impossible to this far. So [inaudible 00:02:05.634] these big game-changing events?

Rahul

You’ll get there soon enough.

Rahul

And yeah, the next time we are in the same city, I mean the kids do get along really well and have a great time together. So we should definitely do that as well.

Rahul

Absolutely. How was your weekend?

Rahul

Sequim.

Rahul

Quim. Okay.

Rahul

We have to draw some learnings from this.

Rahul

For our AWS Made Easy podcast, we need to figure out a way to be sarcastic about or sound sarcastic at least, about what we’re saying. How about, everything should move to the cloud.

Rahul

That is a really, really funny story.

Rahul

So, I think the intention is exactly what you just stated, which is to make sure that there isn’t rogue stuff in there. I think your Amazon kind of fell a little short. If you look at buying stuff on amazon.com, they actually have reviews and stuff for that particular item, not just the vendor. And I think that’s what is missing over here, you can have a certified vendor, but it says nothing really about the content that they have actually put out. So, for example, if there’s an AMI, that somebody created, let’s say Red Hat creator, or someone else created, there’s nothing to say that that particular AMI does not have all libraries or you know, security vulnerabilities that I don’t know of.

So I think there are two things that are kinda really important. One is, the verification has to happen at the AMI level, not just at the vendor level. And the second one is that there has to be an expiry to that verification, right? Because there are always new security vulnerabilities that are coming up. There are always new, you know, tricks that show up against old systems that yeah, for that particular point in time, they were all valid. But yeah, new insights from new threats could invalidate an existing AMI in particular, it doesn’t invalidate the vendor, the vendor is still a good vendor. But what you care really about is that specific AMI. And so I don’t think it’s really helped that much.

Rahul

Yeah.

Rahul

Correct. And the quality is point in time. And that quality, the value of that quality changes over a period of time. And if you just certify the vendor, someone might be fooled into thinking that they are actually picking the right AMI, which is from their perspective certified by AWS, but it really isn’t. It’s only the vendor that is verified by AWS and it says nothing really about the AMI content. So, yeah, I’m a little disappointed in this one, because it’s kind of a half-baked process for them.

Rahul

Correct. I mean, in my ideal world, this marketplace would look very much like the amazon.com marketplace where you have the characteristics of the AMI, it tells you, you know, the bill of materials in it, you know, just like you have the specifications on any object. Or anything that you buy on amazon.com. And then it has reviews, let people comment about what they found hard or easy or what is missing in there, or how to patch it up or like whatever instructions because reading those reviews really do help. Have the FAQ section like you have for your…for the stuff that you sell on amazon.com. Like, I think bringing that concept to the marketplace, because their experience over there with those with that selling is actually very similar to what you need over here. There is just such a massive selection right now of these AMIs nobody knows what the right one to pick is. So just by saying, “Here’s a vendor who’s validated,” says nothing about what you’re actually picking.

Rahul

Exactly. And I think that’s a dangerous thing. For customers to think that they are secure in picking a vendor-verified AMI, I think it would be a very dangerous thing, potentially.

Rahul

Okay, so last week we basically decided that on every announcement that we discuss on the show, we are going to either decide it complicates life, or it simplifies it. And I think in this case, given that it falls short of what it’s really trying to do, and it gives people a sense of false security, I would say just complicates things. So I would, yeah, I don’t know if it’s too complicated, but it just complicates things over here.

Rahul

Correct. Yeah.

Rahul

Yeah, it’s about 35, 40 minutes old, I think it just came in as we were prepping to get online.

Rahul

So it’s actually rare for them to come up with something completely new and different. Which is not issued in re:Invent or they haven’t done a big show about it. But it looks like if you actually go to the AWS Wickr webpage, just go down at the end of that. Yeah. This I think gives you a much better idea of what Wickr really is. So basically, for your corporate communication, if, you know, the need for security, end-to-end encryption, making sure that all of your communications are archived for legal and compliance purposes, this tries to solve that particular pattern. So, you basically have client, you know, controlled keys that basically encrypt everything, where even AWS has no control over or no access to decrypt any of this stuff. And all of your data compliance requirements are kind of managed in one place. And, yeah, basically, encryption allows for communication, [crosstalk 00:14:27.969] knowing if it’s a new client like Chime or if it is embedded and built into Chime. I haven’t been able to figure that out yet. So I think we’re gonna get into previewing that [crosstalk 00:14:35]

Rahul

There isn’t one.

Rahul

I have a feeling that this is gonna be a layer in Chime because it makes sense over there because you’re talking about chats, you’re talking about communicate, you know, voice video, you’re talking about file sharing and screen sharing, which is all I mean, AWS’s tool, there is Chime and the Chime SDK. And I’m assuming that Wickr is going to be not only an independent service where you could have any streaming data or file data that gets encrypted. But Chime will probably incorporate this as the client of choice. But I don’t know how this plays with Slack or any of the other tools. Again, since this is just 30 minutes old, we’re gonna, you know, right after this call, I’m gonna have…I’m gonna see if I can get access, preview access to Wickr and play around with it. We’ll probably have an update next week on this.

Rahul

Correct. Though, I mean, with third-party tools, I really don’t know how this would work. Because if there are third-party tools that are end-to-end encrypted, then you need to figure out a way to kind of get access to all of that data for your corporate compliance and put it all out [crosstalk 00:16:53]

Rahul

No, I’m fine if everything is in the AWS ecosystem because everything will just plug right in. But if you were a corporation using something like Slack, or Jive, or you know, one of these, you know, products that are used internally for communication, or Skype for that matter, how do you get that data into the system for your compliance and how do you then layer in Wickr? That’s what I’m most curious about. So it’s pretty clear on the…on Active Directory, SSL, all of those signings, and stuff like that, I’m just very curious about how the end-to-end encryption happens and how do you then take that data and still preserve it and store it for compliance?

Rahul

Could potentially be exciting. But honestly, I have never seen a more wig product announcement than this, where you’re still trying to guess at what the product actually does. I was trying to Google for any video, any description by anybody about Wickr, and it’s literally just this announcement.

Rahul

I don’t know if it’s a stock photo or a screenshot. So it is a… but you can download Wickr on the Wickr page. That’d be an interesting exercise to just try that. If you just go up there’s a download Wickr so you can download it for Mac, I think it’s a new client looks like. It seems about as big as the Chime client I assume that they just packaged Chime into it.

Rahul

We probably need to screen share.

Rahul

Oh, looks like a completely different UI compared to Chime. And you just enter your email ID, or hide your email ID and just sign in?

Rahul

Let’s try that out. I’d love to see what it looks like. The fun of live streaming a live analysis of a new product.

Rahul

I think one of the big, big opportunities is to simplify how you get communication done.

Rahul

By the way, did you do Wickr Me or Wickr pro?

Rahul

That looks like a Chime on the left. That looks like a read and Chime UI. Hence, we have rooms pretty much like Chime

Rahul

Okay.

Rahul

At first look at…definitely looks like Chime. It looks like a reskinned Chime to me. But let’s play around with it to the week and we will get back to all of you on, you know with what we think about it.

Rahul

I don’t think we can yet till we understand exactly what it does. So let’s reserve judgment on this one till next week. And we’ll bring it back next week. So while we are on this subject, let me just talk about what I have. And I really hope that this is nothing like Chime. The thing that I hate about Chime is that it feels like an external product that’s kind of, you know, somehow hammered into the AWS console with a very, very shoddy integration. So, for example, in Chime, if you have to provision a user, you have to go into your AWS console, go into the Chime app, and then provision folks over there. And then there’s a separate set of credentials to log into Chime, which is not your AWS console credentials. It’s not a, you know…it’s not those identities or keys. It’s something completely different.

Rahul

Correct. And, unfortunately, Chime is still that way. Chime doesn’t feel integrated at all into the AWS ecosystem. So I really hope that they have not made the same mistakes with this. So, that’s going to be my hope. I’m gonna try this out. If I’ve already downloaded the client. We’ll see how easy or difficult this becomes.

Rahul

Skype me, or can you Wickr me? I think someday there’s going to be a word that’s just gonna sound awful in a sentence.

Rahul

And as a verb.

Rahul

Yeah.

Rahul

Yep. Yeah. So, AWS Macie is actually a really neat service with a bunch of different tools that identify things like PII, PHI, and so on in your data. And this is a very, very fundamental problem for anyone that is bringing in data into their systems, making sure that it is scraped off all of this data upfront is something that you want to do. And tools are, you know, few and far between, especially tools that work well are few and far between. Well, Macie has been remarkably good at doing these kinds of detections and fixing your problem. And it can be part of your data ingestion workflow itself. And it just comes in really…it kind of operates really smoothly. Once you have stuff in S3, you can basically have the S3 event trigger, you know, a job to go figure out whether there’s anything that is non-compliant. And then you can automatically you know, pull in a glue job if you need to, to clean stuff up. So really, really useful tool and looks like they’ve got a bunch of new checks or reviews that you can validate.

Rahul

I think so. I think that’s exactly what they’re trying to do with the GitHub stuff. But sure, I mean, if you’ve checked a bunch of stuff where something is tagged, you know, like a key-value pair is tagged with a password somewhere, and you see free text, then this would end up flagging it, which is pretty neat. So you want to make sure that in whatever you’re dumping into S3, you don’t have, you know, clear text passwords and stuff like that stored. Incredibly valuable.

Rahul

This is cheap, depending on how much data you’re pulling in to make sure that you don’t have PII, PHI like the liability associated with pulling those in and potentially not handling the right way are severe. So just having this one simple check in place, I think makes a big difference.

Rahul

Absolutely…

Rahul

Yeah, by the way, I also saw GDPR in there. I am no GDPR expert or specialist so if anyone in the audience is, please feel free to comment and enlighten us. But in whatever little experience I have had dealing with GDPR I find that A, it is an interpretation, depending on the country or the region or wherever it’s applicable. And it’s also a function of the kind of data you have. So I’d be curious to see what specific checks come out of the box, or are available out of the box for GDPR.

Rahul

Yeah. Can we just zoom in a little bit over here?

Rahul

Awesome.

Rahul

Yeah, so we’ve used a bunch of Macie stuff for a bunch of the customer data that we pull in. So we’ve been using Macie quite extensively. But do they say which ones are new? So credit card stuff has been there for a while. I think the JSON tokens I hadn’t seen earlier. HIPAA-compliant stuff might also be new.

Rahul

Very true. So, yeah, I mean, that’s the easiest way to kind of filter out all of the potential dangerous PII, PHI, kind of, and GDPR data. So I would give it the stamp of it simplifies life. For sure. I wouldn’t want to build a system that does this from scratch.

Rahul

You’re absolutely right. I think just data would be so scarce that we’d never build a decent system if we were to do it ourselves. So the fact that this is available as a super cheap service, in the context of you know, what not having it means. Yeah, this absolutely falls in the simplifies bucket.

Rahul

Yeah, I just realized, as I was looking at the comments that you posted, we are on YouTube. So, last week, we talked about getting onto Youtube as well. So now we what, moved on to five channels?

Rahul

Awesome. So we got one more channel in, and hopefully, we can get someone from StreamYard, you know, coming in and talking about how they do all of this amazing stuff. Looking forward to that episode.

Rahul

I wish we had a banner that said, finally, you know, like, you’ve heard me rant about AWS not being opinionated about anything. And for the first time, I’m seeing it. There you go. For the first time, I’m seeing AWS actually put out a tool that helps you with making decisions. You know, I’d asked them to create a simple decision tree for, how you choose the right data source or a data store. You know, the distinction between Aurora and just RDS, and Neptune, and Dynamo DB, and document DB, and, you know, all the others. They just refuse to do it. Like they refuse to have a simple decision tree that would help people decide which kind of datastore is right for them, for their use case. But I’m really glad that the AI team thinks differently within AWS. Again, benefits of the federated setup that they have.

So I’m really glad they built this tool because this is a real challenge. Finding the right models for the right industries, for the right outcomes, with the right trade-offs being made available, is incredibly hard. And it is the main reason why everyone goes about building their own architectures, their own neural networks, their own models from scratch every single time. If they could search through it, filter through it, and figure out which models are most relevant for their use cases, they can get a really, really neat starting platform without having to go through an entire you know, machine learning, workflow definition, and execution, which can take months at times.

And plus, without all the data, you may not even be able to get that kind of accuracy. We’re just talking about Macie, right? If you wanted to build something like that, you just wouldn’t know where to go look for something like this. And the fact that this is now available in the Explorer really tells you, okay, I know exactly how to go leverage this particular model, or this particular service to deliver these outcomes.

Rahul

Personalization. AWS Personalized is an amazing service, which we’ve talked about before. In fact, our very first episode was with the GM of AWS Personalized Ankur Mehrotra. And he was talking about how everyone should be able to leverage this right out of the box with really, really simple pieces of data.

Rahul

To be very honest, deploying an entire workflow for, you know, bringing the data, cleaning the data, doing feature engineering, then training the model based on it. Once you figure out the model deploy, the model for inferencing, and then keeping the inference service up is nothing short of that nightmare you’re talking about with AI. You know, the Terminator kind of nightmare. This comes close. This is…it’s torturous. You know, working through all those notebooks and those experiments and figuring out what is the right model for you. That’s all extremely painful work. So, the fact that you can actually leverage other people’s use cases, other people’s work, and services from AWS is as a big, big win for sure.

By the way, I’m very curious. I saw one category called cost optimizer. Can we go?… Let’s look at the filters again, let’s search. I think it’s a software, one of the categories, yeah, great. Let’s look at operations, software operations. And then let’s look at cost savings.

Rahul

Reduce costs, let’s see. So fraud detection. Great. Yes, operationally, you wanna be able to detect anomalies, and there are some really neat anomaly detection tools, so look out for metrics, look out for vision, look out for metrics, in particular, helps with fraud, chatbots, and virtual assistants. Yep, all of your Lex Polly comprehend recognition. Things that, you know, comprehend recognition can do it for you for not safer work and those kind of thing. They’re all operationally hard things to get right. And you can just start leveraging a bunch of these services to do that effectively, right out of the box. What are the other options at the bottom?

Rahul

Cybersecurity. So, they have security hub now which is pretty awesome. Bunch of Process Automation, this is probably change manager as well as actually, I’m just interested in seeing what is in process automation.

Rahul

Oh, this is Kendra.

Rahul

Right. And very pleasantly out of character for AWS to do something like this. So, again, this gets a big thumbs up from me. It simplifies customers lives dramatically. So, yeah, definitely a big thumbs up. And I wish they had more of this across the different product or service categories.

Rahul

Yeah, there are. Yeah, I mean, wouldn’t that be super neat?

Rahul

Like just no SQL databases, what should I use, should I use MongoDB hosted on AWS, which again, is a big collaboration and a service from AWS, or should you use DynamoDB? Or should you use document DB? When do you use which like, no, there’s no opinion from AWS on any of that.

Rahul

No, I think we covered this one. Yeah, I think we’ve covered all aspects of it.

Rahul

Correct. So I think there’s a need to bring more and more workloads to support Arm. And there is still a little bit of a gap. A, I think development environments, not being Arm-based, or not being specifically Graviton, is a challenge for sure. You wanna make sure that stuff that works locally on your machine works when you deploy it. And that’s why I think we need a paradigm shift on that front of it on dev…on the development side. And then on the CICD side of things, which is kind of what CodeBuilders helps you, you know, build up all your stuff, create the artifacts, put them into repositories, and then leverage it for deployments. The fact that those are now available on Arm more widely.

They did announce, you know, US-East-1, if I remember correctly, what, six months ago or so. So now that it’s available more widely, I hope that there’s gonna be more adoption. But there are still large parts of the developer workflow that are still not covered by support for Arm. So you know, I’d encourage the audience to take a look at you know, tools like their spaces which allow you to do this on Arm.

Rahul

I would agree. And I think it needs to, it needs to move really, really fast. I don’t know whether you saw that announcement. But AWS is already at a run rate of, Arm constituting about $5 billion a year in revenue, which is a big deal. I mean, given you know, how recent Arm is, and we’ve barely scratched the surface in terms of adoption. The fact that Arm contributes to an annual run rate of roughly 5 billion at this point is quite a significant achievement. So it looks like you know, it’s gaining tons of traction, more and more people are kind of moving on to it, even though there’s still a lot of folks who have not even considered it or moved to it. But this is the bet you wanna make. Graviton is the bet you wanna make.

And so if you’re not already leveraging these tools that allow you to manage your entire end-to-end workflow on Arm, then at some point of time, it’s gonna prevent you from leveraging the cost-benefit analysis that the Graviton…or cost benefits that Graviton brings to you. What did we discuss the last time, if I remember correctly? The Graviton processors are producing anywhere from 35% to 50% price performance improvement over the X86 depending on which Graviton processor and type you’re on. But I think the C7Gs are what 50 if we were showing a bunch of cases with 50, 55% price performance improvement? Which is significant.

Rahul

I think it was 40% over Graviton2 and in total, about 50 odd percent, or near 60 over the X86s. So yeah, there’s a…and this is not the end of it, right? We are…they’re constantly coming up with new versions of the Graviton. And there’s tons more performance to be gained out of it.

Rahul

As you read it, we move to that GitHub still has the issue that you don’t have Arm-based runners. So for all of our GitHub actions that we run, we’ve got a cluster of Graviton instances that act as our runners to process all the Arm workloads that we have.

Rahul

But I wish it was less painful to do that. I just wish it was available out of the box.

Rahul

I think we’d give it a simplifies because the more the tooling gets filled out, the simpler it gets for people. Right now for anyone who is motivated enough to get the price performance improvements that Graviton has, you have to jump through a whole lot of hoops to make that happen. And every bit of tooling helps, you know, reduce that burden. So, definitely a simplifies.

Rahul

So this is almost like the query planner that you always wanted for Athena. And we’re just so used to writing out the queries that make intuitive sense. And then starting to observe the performance of our queries before we can start optimizing them. And we’ve come to rely on these career analysis engines, you know, to help us fine-tune and refine our queries so much. Because when you have parameterized queries, in particular, you really don’t know how people are using it, you don’t know how it’s affecting the performance of your queries. The fact that these tools are now available makes a big difference to the cycle time of creating these Athena queries and making them available to all the other tools that leverage them, whether it be Quicksand dashboards or any other, you know, downstream system like Glue or whatever other job you might be doing. So a huge win for sure.

Rahul

Actually, sometimes Athena is fast enough that you don’t realize it, but it does massive scans at times and then it shows up in your bill a month later. And it seems really, really scary when something like that happens. And you don’t…it’s really hard to interpret how a certain SQL is going to be hard. I’m using the word interpret twice. But it’s really hard to figure out how the database engine is going to, or the Athena query engine is gonna interpret the query, the SQL query you right, in terms of how it executes it under the hood until you see the query plans, until you see these, you know, these debugging markers. Till you see them, you’re not gonna be able to figure out what the problem is, you wouldn’t know why you got a massive bill, you wouldn’t know why your queries are slow, because you just don’t understand enough about how the SQL that you wrote is getting interpreted by the engine. So having this data now is incredibly valuable in simplifying and better indexing the data or better organizing the data so that it gets indexed and queried effectively by Athena.

Rahul

Yeah. And I think in the case of Athena, this actually gets a lot more complicated. Given that Athena can actually operate on large number of different kinds of data stores. The interpretation of what a SQL means for that…for a different data store might actually be different. So what comes in territory in your head as you’re writing a SQL may be interpreted differently if you are using Athena to talk to Aurora versus Redshift versus S3 versus DynamoDB.

Rahul

Exactly. And does it change if you’re picking up a Parquet file versus say, just a CSV or a JSON file, like how does it deal with all of that complexity? And how does it interpret SQL? So unless you have that query plan, unless you have those query statistics, it’s gonna be really hard to get to the root cause of either a slow query, or excess costs or, you know, yeah, any of those kinds of symptoms.

Rahul

Not yet. No, I think this might be relatively new.

Rahul

Yeah, for the new Query Statistics API. So what else does it tell you? Let’s look at some of the stats that it shows us. And let’s try to see if these are valuable. So you have runtime statistics, which is execution time, which is great. Input bytes, input bytes is neat, because it…actually, I’m curious, is input bytes the number of bytes that you actually had in the query itself? If it is a parameterized query that could change. Or is it the number of bytes? No, it’s probably that. Output bytes is the resulting dataset. Query stage plan, this one is your query plan, basically. And it looks like a list. So that’s pretty neat. That’s gonna be very, very valuable. And then let’s look at the rows. So you have inputs and outputs total, and how many rows got returned? Great. Then I was just wondering whether you get numbers per stage.

Rahul

Unless the query stage plan node.

Rahul

Yeah, do they have the definition of the query stage plan node? Let’s see. On the left-hand side, you might see data types here, query stage plan, type. Yeah. No, it was right there.

Rahul

Yep. So remote source, just go up?

Rahul

Yeah. So, it could be a DynamoDB, it could be Redshift, it could be S3, it could be any of those sources.

Rahul

Great. And actually, the mental model that you just described, where is it a filter for… Is it a scan of a big chunk of data, and then a filter and then, you know, picking the data elements that you want? Or is it a filter first, and then scan that’s happening? Like that mental model that you have for SQL may not actually apply the same way when you’re talking about Document DB or DynamoDB or, you know, any other data source that is available as part of the adapters. Like that interpretation of what it means, what the where clause will do, and what the Select will do, and in what order it will execute those things. You will not know what until you actually see the query plan.

Rahul

Correct. Yeah. And, you know, the SQL query engine is also gonna have optimizations in there, where, if it knows enough about the schema, it could actually make a bunch of decisions. We don’t even know what decisions it makes. Like if you look at the Redshift query planner, there are a ton of optimizations and stuff that it does under the hood, to make sure that it can partition those queries across different datasets effectively. It pulls out all…pulls in all the data from all the different computes, aggregates it, and brings it back to you. That, you know, you wouldn’t even know about if you did not know that there was a query plan like that under the hood.

Rahul

That’s one way to do it. Keep it simple, do it fast, get more data into it, start analyzing the results, look at anomalies, fix them.

Rahul

Absolutely.

Rahul

I think so, I think instead of guessing at your credit plans, or what Athena is gonna do, the fact that you now have the query plans, and the stats makes life a lot simpler in terms of how you organize your queries. So yes, definitely a simplifies.

Rahul

Absolutely. Look forward to next week, and I know that there was a barrage of announcement that just happened very, very shortly before this particular live stream. We’ve not been able to analyze it and go through it, but we gonna do that next week.

Rahul

Thanks, everyone. See you soon. Bye.