Set up a PI System on an AWS Outposts rack on-premises, communicating back to AWS Region based resources. AWS Region Amazon Simple Storage Service Amazon Redshift Amazon VPC A Amazon Kinesis 12 Availability Zone A AWS Outposts Service Anchor Amazon Managed Streaming for Apache Kafka 11 AWS Outposts Intra VPC data path Internet Gateway VPC Endpoints Region Public Subnet PI Vision Region Private Subnet PI Integrator for Business Analytics Availability Zone B PI Data Archive PI AF Domain Controller SQL Server Availability Zone C © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Internet or 8 AWS Direct Connect (Public Virtual Interface) Customer Edge Router VPC A extended from the Region to the AWS Outposts Intra-VPC traffic follows the service link path Customer On-premises Local network traffic AWS Region traffic AWS Outposts network device 1 7 AWS Outposts network device AWS Outposts Service link LGW traffic path Local Gateway (LGW) PI Interfaces PLC 9 AWS Outposts Subnet 10 5 PI Vision AWS Outposts Subnet PI System 2 6 PI Integrator for Business Analytics PI AF PI Data Archive 3 Domain Controller SQL Server 4 Amazon VPC A AWS Reference Architecture 2 3 4 5 6 7 8 9 10 11 12 PI Interfaces/Connectors collect data from sensors, PLCs, Scada, and HMIs into PI System running on Amazon EC2 in AWS Outposts. PI System receives the timeseries and context data and stores data in PI Asset Framework and PI Data Archive. Microsoft Active Directory provides Windows Integrated Security access between PI System components and is used for user authentication and authorization. SQL Servers running on Amazon EC2 instances store the metadata used by PI Vision and PI AF. PI Vision is a visualization tool that allows users to securely access PI System data. PI Integrator for Business Analytics exports asset and event view data from PI System into AWS managed services, namely, Amazon S3, Amazon Redshift, Amazon Kinesis, and Amazon Managed Streaming for Apache Kafka through AWS Region traffic. AWS Outposts network devices connect to the customers on-premises network equipment to provide the AWS Outposts connectivity to the customers local network and the AWS Region. The local network and AWS Region traffic are logically isolated onto separate VLANs (blue and orange) AWS Outposts establishes a secure connection to its AWS Outposts Anchor endpoint in the AWS Region over an AWS Direct Connect public virtual interface or the public internet. This connection creates the AWS Outposts service-link which carries traffic for the AWS control plane, AWS services, and VPC data plane traffic to and from AWS Outposts and the AWS Region. Traffic between PI System components on AWS Outposts and PI Interfaces on the local network is routed through the AWS Outposts local gateway. Traffic between the PI System components on the AWS Outposts VPC subnets is routed locally within the AWS Outposts. Traffic between the PI System components on AWS Outposts subnets and AWS Region subnets follows the AWS Outposts service link. Traffic between the PI System components on AWS Outposts and AWS services in the Region use the customers local internet via local gateway, service-link via internet gateway, or a VPC endpo
