Getting Started with VMware Cloud on AWS SDDC

This chapter will help you navigate through the process of deploying a new VMware Cloud on AWS SDDC.

We will cover the following topics:

• Creating a VMware Cloud Organization
• The VMware Cloud on AWS SDDC provisioning wizard
• Enabling access to vCenter
• RBAC and identity management on vCenter and Cloud Services Platform (CSP)
• Application deployment example

The first step organizations take to start using VMware Cloud on AWS services and get onboarded is to create an Organization. Let’s have a quick recap of the concept of Organizations.

VMware Cloud on AWS service accounts are created within an Organization.

Organizations are the common construct used in all VMware Cloud service offerings. They act as an Identity and Access Management (IAM) tools within the Cloud Services Console.

To get initial access to the platform, users must create a new My VMware account or use an existing one. They should...

Creating a VMware Organization

The organization’s administrator will receive an invite via email to create an Organization. This is done either after a purchase order has been processed through VMware or AWS, or once a self-service flow with a credit card has been completed.

Note

The link for the creation of an Organization is unique and can be used only one time.

Once the link has been clicked on, a My VMware login prompt will appear, as shown in the following screenshot:

Figure 4.1 – Organization creation initial login with a My VMware account

Once the user credentials are entered, the Organization creation process will start.

First, provide the Organization’s name, agree to the terms of service, and click on CREATE ORGANIZATION AND COMPLETE SIGN-UP, as shown in the following screenshot:

Figure 4.2 – Set up an Organization

After that, administrators will have access to CSP and, from...

VMware Cloud on AWS SDDC provisioning wizard

To initiate the SDDC provisioning wizard, on the left-hand side, select Inventory and click on CREATE SDDC, as seen in the following screenshot:

Figure 4.12 – Create SDDC

Information

When selecting the host type and the region, it’s important to match the subscription. The SDDC wizard does not validate the selection with the subscription option. If the subscription does not cover the selected region and host type, on-demand rates will be applied.

The SDDC name is the logical name of the SDDC. You can change the name afterward.

A single-host deployment option is available for Proof-of-Concepts (PoCs) and limited to 60 days. The single-host SDDC has no SLA.

The Stretched Cluster option will create a cluster stretched between two Availability Zones (AZs) in the same region, providing higher redundancy and an uptime SLA of up to 99.99%. Stretched Cluster is a unique option of VMware Cloud...

Enabling access to vCenter Server

To be able to successfully manage the SDDC, you need to enable access to vCenter Server. vCenter Server can be accessed from the internet or a private address accessible from the VPN, DX, or AWS VPC connected to the SDDC. By default, the NSX firewalls block access to the vCenter Server from the internet. In the upper-right corner of the VMware Cloud SDDC console, click on OPEN VCENTER and a pop-up message with the following options will appear. Let’s click on FIREWALL RULE, as seen in the following screenshot:

Figure 4.29 – Open vCenter with access credentials

Now let’s enable access to vCenter from remote public IPs. By default, internet access to vCenter is blocked by the Management Gateway firewall. Navigate to the Networking & Security tab, and open the Gateway Firewall section, as seen in the following screenshot:

Figure 4.30 – Networking & Security &...

RBAC and identity management on vCenter and CSP

VMware Cloud on AWS service access has two authentication domains: the CSP authentication domain and the vCenter authentication domain. With the new version 1.22 release, it is possible to configure federated SSO between CSP and vCenter: when this feature is enabled, a user authenticated through CSP will get access to vCenter Server without additional authentication. Before a user will be able to log in, an appropriate vCenter role must be assigned using the cloudadmin account.

VMware Cloud on AWS uses a restricted operation model to manage access to vCenter Server. The default administrator user – [e-mail] – does not have full administrator rights compared to the [e-mail] account. This is expected for a managed service and prevents users from accidentally changing the settings having an impact on SLA or environment stability. The permission set available to the cloudadmin account and the...

Application deployment example

The following section describes how to deploy VM templates in vCenter and enable network connectivity. First, to deploy an application on vCenter, we’ll need to upload templates and images to vCenter. In our example, we’ll use the content library mechanism:

1. Log in to vCenter, navigate to the left-hand menu, and click on CREATE, as seen in the following screenshot:

Figure 4.48 – Content Libraries

2. Create a content library and specify the name:

Figure 4.49 – Create a content library

3. In our example, we’ll choose Subscribed content library instead of hosting a local content library to sync an existing content library uploaded to S3. Using a master content library helps to manage the subscribed content library with corporate templates and quickly enables the distribution of required sources to start the deployment:

...

Summary

In this chapter, you got familiar with the steps required to start consuming VMware Cloud on AWS, including onboarding to the CSP portal, provisioning your first SDDC, providing access to the SDDC management components, and deploying your first application.

In the next chapter, you will learn how to manage a Software Defined Data Center (SDDC), VM storage policies, compute policies, and the Elastic Distributed Resource Scheduler (EDRS) mechanism for automatically scaling the cluster based on resource usage through the VMware Cloud Services Console.

You will also learn about the essential management of workloads, vSAN storage, and hosts and clusters required for day-to-day operations.