Cloud (AWS/Azure/GCP): what to consider before design

Cloud is not just hosting. It is operating model and a set of rules (governance) that determine security, both availability and cost. Clarify standards, access, changes, and renewal before design.

Cloud brings speed, but also new risks if there is a lack of governance. Most incidents and unnecessary costs arise from unclear access, "clicking" changes without auditing and the missing landing zone. The minimum standard is: clear ownership, IAM + MFA, network boundaries, centralized logs and monitoring, IaC and tested recovery.

Key questions

1) Governance and access

  • Who is the owner of accounts/subscriptions and who approves changes?
  • How is admin/root access handled (break-glass, MFA, audit, rotation)?
  • Is the role model (RBAC/IAM) and the principle of least necessary authorizations clear?
  • How do we handle onboarding, offboarding and temporary authorizations (JIT access)?

2) Standards and "landing zone"

  • Do we have a minimum standard for naming, tagging, accounting, logging, encryption and baseline policies?
  • Is the division of environments (prod/non-prod) and boundaries between teams and projects clear?
  • Is it defined what is allowed as "self-service" and what goes through a controlled change?

3) Changes and automation

  • How are the changes made: IaC (Terraform/Bicep/CloudFormation) or push-ups?
  • How do we deal with review, audit, approval and rollback (versioning + pipeline)?
  • How do we minimize configuration drift and undocumented interventions?

4) Network model and integration with on-prem

  • What does segmentation (VPC/VNet), routing and trust boundaries look like?
  • How do we solve on-prem connection (VPN/ExpressRoute/Direct Connect), DNS and egress?
  • Is it defined what is published publicly and what goes through private endpoints?

5) Operation (monitoring, logs, incidents)

  • Do we monitor end-to-end (SLO) services or just infrastructure metrics?
  • Where do the logs end (centralization), what is the retention and who owns the pipeline?
  • Who responds to alerts, what is the escalation, and are there runbooks for top incidents?

6) Resilience, backups and recovery

  • Do we have defined RTOs/RPOs for critical services and can we meet them?
  • Is recovery regularly tested (not just "backup running")?
  • How do we solve region outage scenarios and recovery of identity, configurations and IaC state?

7) Costs and control (FinOps)

  • Do we have tagging for cost allocation and cost ownership rules?
  • Do we have budgets, alerts and basic guardrails (e.g. limits, policy, reserved/commitment plan)?

Practical first steps

Set up first minimum landing zone (access rights, logging, basic policies, network boundaries), then install IaC and change mode. Expand services and automation only afterwards. This will reduce risk, cost and operational chaos.

Related