Multi-Cloud Architecture
Service Comparison
Compute
| AWS |
Azure |
GCP |
Use Case |
| EC2 |
Virtual Machines |
Compute Engine |
IaaS VMs |
| ECS |
Container Instances |
Cloud Run |
Containers |
| EKS |
AKS |
GKE |
Kubernetes |
| Lambda |
Functions |
Cloud Functions |
Serverless |
Storage
| AWS |
Azure |
GCP |
Use Case |
| S3 |
Blob Storage |
Cloud Storage |
Object |
| EBS |
Managed Disks |
Persistent Disk |
Block |
| EFS |
Azure Files |
Filestore |
File |
Database
| AWS |
Azure |
GCP |
Use Case |
| RDS |
SQL Database |
Cloud SQL |
Managed SQL |
| DynamoDB |
Cosmos DB |
Firestore |
NoSQL |
| Aurora |
PostgreSQL/MySQL |
Cloud Spanner |
Distributed SQL |
| ElastiCache |
Cache for Redis |
Memorystore |
Caching |
Architecture Patterns
Single Provider with DR -- Primary workload in one cloud, DR in another. Database replication + automated failover.
Best-of-Breed -- AI/ML on GCP, Enterprise apps on Azure, General compute on AWS. Pick strengths per provider.
Geographic Distribution -- Serve from nearest region, data sovereignty compliance, global load balancing.
Cloud-Agnostic Abstraction -- Portable stack to reduce lock-in:
| Layer |
Portable Choice |
| Compute |
Kubernetes (EKS/AKS/GKE) |
| Database |
PostgreSQL/MySQL |
| Messaging |
Apache Kafka |
| Cache |
Redis |
| Object Storage |
S3-compatible API (MinIO) |
| Monitoring |
Prometheus/Grafana |
| Service Mesh |
Istio/Linkerd |
| IaC |
Terraform/OpenTofu |
Networking
Connection Options
| Provider |
VPN |
Dedicated |
| AWS |
Site-to-Site VPN (1.25 Gbps/tunnel) |
Direct Connect (1-100 Gbps) |
| Azure |
VPN Gateway (varies by SKU) |
ExpressRoute (up to 100 Gbps) |
| GCP |
Cloud VPN HA (3 Gbps/tunnel, 99.99% SLA) |
Cloud Interconnect (10-100 Gbps) |
VPN vs Dedicated Connection Decision
| Factor |
VPN |
Dedicated (DC/ER/Interconnect) |
| Bandwidth need |
< 1.25 Gbps |
> 1 Gbps or consistent throughput |
| Latency tolerance |
Variable OK |
Predictable required |
| Setup time |
Hours |
Weeks-months |
| Cost |
Low (pay per hour) |
Higher (port + data) |
| Encryption |
Built-in IPsec |
Must add if needed (MACsec or overlay) |
Default: Start with VPN, upgrade to dedicated when bandwidth or latency demands it.
Hub-and-Spoke Topology
On-Premises Datacenter
|
VPN / Direct Connect
|
Transit Gateway (AWS) / vWAN (Azure) / Cloud Router (GCP)
+-- Production VPC/VNet
+-- Staging VPC/VNet
+-- Development VPC/VNet
BGP Essentials
- On-prem router advertises internal CIDRs (e.g., 10.0.0.0/8) with private ASN (64512-65534)
- Cloud-side ASNs: AWS default 64512, Azure fixed 65515, GCP configurable
- Always run dual tunnels for HA -- active/active with ECMP or active/passive
- Monitor: tunnel status, BGP session state, packet loss, latency, bytes in/out
Cost Optimization
Pricing Models
| Model |
AWS |
Azure |
GCP |
| Reserved |
RI + Savings Plans (30-72%) |
Reserved VMs (up to 72%) |
Committed Use (up to 57%) |
| Spot/Preemptible |
Spot (up to 90% off, 2-min notice) |
Spot VMs |
Preemptible (80% off, 24h max) |
| Auto-discount |
None |
Hybrid Benefit (existing licenses) |
Sustained Use (auto 30%) |
Tagging Strategy (Required Tags)
| Tag |
Purpose |
Example |
| Environment |
Env separation |
production, staging, dev |
| Project |
Cost allocation |
my-project |
| CostCenter |
Chargeback |
engineering |
| Owner |
Accountability |
team@example.com |
| ManagedBy |
Drift detection |
terraform |
Cost Optimization Checklist
Cost Tools
- AWS: Cost Explorer, Compute Optimizer, Cost Anomaly Detection
- Azure: Cost Management, Advisor
- GCP: Cost Management, Recommender
- Multi-cloud: CloudHealth, Cloudability, Kubecost
Migration Strategy
- Assessment -- Inventory workloads, map dependencies, estimate costs, identify compliance constraints
- Pilot -- Select low-risk workload, implement, validate, document lessons
- Migration -- Incremental moves, dual-run period, automated testing, rollback plan per workload
- Optimization -- Right-size, adopt cloud-native services, implement cost governance
Gotchas and Anti-Patterns
- Lift-and-shift everything -- Re-platform or re-architect where ROI justifies it
- Ignoring egress costs -- Data transfer between clouds/regions adds up fast; design data gravity around primary provider
- Multi-cloud for the sake of it -- Real multi-cloud adds operational complexity; have a concrete reason (DR, best-of-breed, compliance)
- No abstraction layer -- Without Terraform/K8s, multi-cloud becomes multi-headache
- Skipping tagging -- Impossible to optimize costs or enforce governance without consistent tags
- Single tunnel -- Always deploy redundant VPN tunnels; single tunnel = single point of failure
- Overlapping CIDRs -- Plan IP address space across all environments upfront; retrofitting is painful
- No network monitoring -- Hybrid connectivity issues are invisible without proactive tunnel/BGP monitoring
1---2name: multi-cloud-architecture-23description: Design multi-cloud and hybrid architectures across AWS, Azure, and GCP — covering service selection, networking, cost optimization, and migration strategy. Use when building multi-cloud systems, planning hybrid connectivity, optimizing cloud spend, or avoiding vendor lock-in.4---5
6# Multi-Cloud Architecture
7
8## Service Comparison
9
10### Compute
11| AWS | Azure | GCP | Use Case |
12|-----|-------|-----|----------|
13| EC2 | Virtual Machines | Compute Engine | IaaS VMs |
14| ECS | Container Instances | Cloud Run | Containers |
15| EKS | AKS | GKE | Kubernetes |
16| Lambda | Functions | Cloud Functions | Serverless |
17
18### Storage
19| AWS | Azure | GCP | Use Case |
20|-----|-------|-----|----------|
21| S3 | Blob Storage | Cloud Storage | Object |
22| EBS | Managed Disks | Persistent Disk | Block |
23| EFS | Azure Files | Filestore | File |
24
25### Database
26| AWS | Azure | GCP | Use Case |
27|-----|-------|-----|----------|
28| RDS | SQL Database | Cloud SQL | Managed SQL |
29| DynamoDB | Cosmos DB | Firestore | NoSQL |
30| Aurora | PostgreSQL/MySQL | Cloud Spanner | Distributed SQL |
31| ElastiCache | Cache for Redis | Memorystore | Caching |
32
33## Architecture Patterns
34
35**Single Provider with DR** -- Primary workload in one cloud, DR in another. Database replication + automated failover.
36
37**Best-of-Breed** -- AI/ML on GCP, Enterprise apps on Azure, General compute on AWS. Pick strengths per provider.
38
39**Geographic Distribution** -- Serve from nearest region, data sovereignty compliance, global load balancing.
40
41**Cloud-Agnostic Abstraction** -- Portable stack to reduce lock-in:
42| Layer | Portable Choice |
43|-------|----------------|
44| Compute | Kubernetes (EKS/AKS/GKE) |
45| Database | PostgreSQL/MySQL |
46| Messaging | Apache Kafka |
47| Cache | Redis |
48| Object Storage | S3-compatible API (MinIO) |
49| Monitoring | Prometheus/Grafana |
50| Service Mesh | Istio/Linkerd |
51| IaC | Terraform/OpenTofu |
52
53## Networking
54
55### Connection Options
56| Provider | VPN | Dedicated |
57|----------|-----|-----------|
58| AWS | Site-to-Site VPN (1.25 Gbps/tunnel) | Direct Connect (1-100 Gbps) |
59| Azure | VPN Gateway (varies by SKU) | ExpressRoute (up to 100 Gbps) |
60| GCP | Cloud VPN HA (3 Gbps/tunnel, 99.99% SLA) | Cloud Interconnect (10-100 Gbps) |
61
62### VPN vs Dedicated Connection Decision
63| Factor | VPN | Dedicated (DC/ER/Interconnect) |
64|--------|-----|-------------------------------|
65| Bandwidth need | < 1.25 Gbps | > 1 Gbps or consistent throughput |
66| Latency tolerance | Variable OK | Predictable required |
67| Setup time | Hours | Weeks-months |
68| Cost | Low (pay per hour) | Higher (port + data) |
69| Encryption | Built-in IPsec | Must add if needed (MACsec or overlay) |
70
71**Default:** Start with VPN, upgrade to dedicated when bandwidth or latency demands it.
72
73### Hub-and-Spoke Topology
74```
75On-Premises Datacenter
76 |
77 VPN / Direct Connect
78 |
79 Transit Gateway (AWS) / vWAN (Azure) / Cloud Router (GCP)
80 +-- Production VPC/VNet
81 +-- Staging VPC/VNet
82 +-- Development VPC/VNet
83```
84
85### BGP Essentials
86- On-prem router advertises internal CIDRs (e.g., 10.0.0.0/8) with private ASN (64512-65534)
87- Cloud-side ASNs: AWS default 64512, Azure fixed 65515, GCP configurable
88- Always run dual tunnels for HA -- active/active with ECMP or active/passive
89- Monitor: tunnel status, BGP session state, packet loss, latency, bytes in/out
90
91## Cost Optimization
92
93### Pricing Models
94| Model | AWS | Azure | GCP |
95|-------|-----|-------|-----|
96| Reserved | RI + Savings Plans (30-72%) | Reserved VMs (up to 72%) | Committed Use (up to 57%) |
97| Spot/Preemptible | Spot (up to 90% off, 2-min notice) | Spot VMs | Preemptible (80% off, 24h max) |
98| Auto-discount | None | Hybrid Benefit (existing licenses) | Sustained Use (auto 30%) |
99
100### Tagging Strategy (Required Tags)
101| Tag | Purpose | Example |
102|-----|---------|---------|
103| Environment | Env separation | production, staging, dev |
104| Project | Cost allocation | my-project |
105| CostCenter | Chargeback | engineering |
106| Owner | Accountability | team@example.com |
107| ManagedBy | Drift detection | terraform |
108
109### Cost Optimization Checklist
110- [ ] Tag all resources with required tags above
111- [ ] Delete unused resources (unattached disks, idle LBs, old snapshots, unassociated EIPs)
112- [ ] Right-size instances based on utilization (use provider advisors/recommenders)
113- [ ] Reserved capacity for steady-state workloads; spot/preemptible for fault-tolerant
114- [ ] Implement auto-scaling with appropriate cooldowns
115- [ ] Storage lifecycle policies: hot -> warm -> cold -> archive
116- [ ] Set budget alerts at 50%, 80%, 100% thresholds
117- [ ] Enable cost anomaly detection
118- [ ] Optimize data transfer (same-AZ where possible, VPC endpoints, CDN)
119- [ ] Add caching layers to reduce compute/DB load
120
121### Cost Tools
122- **AWS:** Cost Explorer, Compute Optimizer, Cost Anomaly Detection
123- **Azure:** Cost Management, Advisor
124- **GCP:** Cost Management, Recommender
125- **Multi-cloud:** CloudHealth, Cloudability, Kubecost
126
127## Migration Strategy
128
1291. **Assessment** -- Inventory workloads, map dependencies, estimate costs, identify compliance constraints
1302. **Pilot** -- Select low-risk workload, implement, validate, document lessons
1313. **Migration** -- Incremental moves, dual-run period, automated testing, rollback plan per workload
1324. **Optimization** -- Right-size, adopt cloud-native services, implement cost governance
133
134## Gotchas and Anti-Patterns
135
136- **Lift-and-shift everything** -- Re-platform or re-architect where ROI justifies it
137- **Ignoring egress costs** -- Data transfer between clouds/regions adds up fast; design data gravity around primary provider
138- **Multi-cloud for the sake of it** -- Real multi-cloud adds operational complexity; have a concrete reason (DR, best-of-breed, compliance)
139- **No abstraction layer** -- Without Terraform/K8s, multi-cloud becomes multi-headache
140- **Skipping tagging** -- Impossible to optimize costs or enforce governance without consistent tags
141- **Single tunnel** -- Always deploy redundant VPN tunnels; single tunnel = single point of failure
142- **Overlapping CIDRs** -- Plan IP address space across all environments upfront; retrofitting is painful
143- **No network monitoring** -- Hybrid connectivity issues are invisible without proactive tunnel/BGP monitoring
majiayu000