Cloud migration is the process of shifting from an on-premises IT infrastructure program to a cloud-based solution. The modern movement to shift resources into the cloud was spurred on by the dramatic cost savings companies experienced with such migrations.
But, no one wants to do the whole “hindsight is 20/20” thing when realizing that – after a migration to cloud operations – they could have been way more efficient and netted out closer to the outcomes they actually set out to achieve. Gartner estimated that organizations that rush into cloud operations hoping to experience an immediate cost-savings windfall will likely overspend on cloud services by up to 70% – without deriving the expected value from it.
Technical leaders could do well to create a thorough plan, including an inventory of legacy assets that simply won’t function as a cloud-based service. After a successful cloud migration, continual optimization of corporate and operational workflows will likely be the best way to see significant cost savings for the business. And let’s not forget about all of the security implications that come with a move to the cloud. Fortunately, the cloud security sector is very mature.
There isn’t one perfect cloud migration strategy for technical and operational workflows – it’s something unique to the needs of each DevOps organization. They may even find their operations aren’t best suited for the cloud. Let’s take a look at a mix of well-known strategies that Gartner identified more than a decade ago:
This strategy involves an organization simply – relatively speaking – transposing into the cloud their exact environment at that moment. This might be the most cost-effective way for a company new to cloud operations to get the migration job done. However, there are challenges that come with rehosting. These can include being unaware of the finer points of performance optimization in the cloud versus on-prem hardware. Keep in mind, security is much more ephemeral in the cloud, and this “lift and shift” strategy might not take that into account as well as it should.
This strategy involves addressing those finer points of optimization. It takes into account the differences between on-prem and cloud and sees organizations tailoring an application or infrastructure to fit a specific cloud environment. This might be obvious, but it can be worth the time it takes to fine-tune an environment to the cloud, as it not only considers performance but will be inherently more secure. Cost savings might not be realized until later, but they will come, adding to the existing benefits of a well-architected framework and more hardened cloud security.
This strategy involves tailoring an application to a cloud platform in order to take full advantage of its capabilities. The primary advantage with this strategy is the upgrade in performance and flexibility, and reduction in overall costs. This is a more cost-effective and lighter-life option than refactoring, which is considered a complete overhaul option for an application migrating into a cloud environment.
As opposed to the tinkering of existing applications migrating to the cloud, this strategy involves a complete rebuild of infrastructure in the cloud in order to take even better advantage of the platform’s capabilities. It’s great for performance over time and can involve some of those longer-term cost savings mentioned earlier. However, this option is very labor-intensive and can have significant upfront costs – as any rebuild would incur.
This strategy involves using a software-as-a-service (SaaS) solution to replace infrastructure onto a cloud platform. This can have the benefit of leveraging a SaaS provider’s existing code to more quickly develop a cloud-optimized replacement for the original application. A cost-benefit analysis of this strategy may find that many businesses need not deploy an entire DevOps team to rebuild applications from the ground up.
This strategy assumes an organization has “been there, done that,” and determined that – for any number of reasons – it’s best to reverse course and migrate operations from the cloud back to its own on-prem infrastructure. This might be for security reasons and an organization’s desire to remove their applications from public clouds more vulnerable to attack; or it may have been determined by a company’s technical leaders that it is, in fact, more cost-effective to repatriate applications onto local infrastructure.
There’s a lot for one organization to consider here, with many of these strategies overlapping in multiple aspects. This is why it’s critical for leadership and stakeholders to agree on outcomes, take an exhaustive inventory of assets to be migrated, and find the best way for its unique environment to move forward.
After an organization has determined the right migration strategy that best suits their operations, it's time to turn attention away from caveats and actually think about the many benefits of moving infrastructure to the cloud.
On-premises systems can be laborious to set up, configure, and maintain. In the cloud, you can provision servers in minutes, then put them into use immediately. This allows for a large number of deployments in a small amount of time. It’s a good idea to create a plan for how SecOps will actually automate the security of these rapidly provisioned servers and keep pace with DevOps.
Less capacity needed, fewer resources consumed, and less time spent on configuring, maintaining, and replacing physical equipment – it all adds up to a fairly tangible ROI, depending on the organization, offsetting the initial investment. Earmarking a continued investment in the optimization of business and IT operational processes, post-migration, will help organizations continue to realize that financial benefit.
Security can be a benefit of cloud migration, if done in the right way and according to an organization’s specific needs. It may very well be that, post-migration, an organization finds their cloud operations to be more costly and less secure than they’d hoped. However, it is possible to institute secure processes that, while not necessarily 100% effective, are workable solutions that can contribute to a SecOps organization's part of the shared responsibility model with their cloud provider.
The potential for speed and scalability of cloud operations can indeed accelerate stakeholder adoption of a cloud-migration plan. However, a key step in the process is aligning those stakeholders across affected business units and ensuring everyone understands not only the promise of migrating to the cloud, but also the potential drawbacks. It’s something we’ve covered, but needs to be underscored as far as getting actual humans to buy into the plan. Once that happens, adoption will accelerate and time to results could drastically decrease.
Improved business agility and flexibility is one of the more undervalued benefits of cloud migration and adoption. It’s something that is exemplified particularly well by the current work-from-home or hybrid methodologies that were forced into global work culture as a result of the pandemic. Leveraging SaaS and IaaS services helps companies to thrive with a dispersed workforce. Of note here: Ensuring compliance with regulatory standards applicable to an organization’s industry will help maintain flexibility.
Learn more about the CSA CCM Compliance
Cloud migration isn't an easy task. After buy-in from stakeholders, the migration team must create a plan for adoption - one that includes responses to certain challenges that may come up.
This can be a heavy and time-consuming process. Key considerations include avoiding migration of everything to the cloud at once and ensuring your migration team has the necessary skills to successfully complete the migration. Likely, this process will include backing up and offloading the large database from physical storage and using one of the strategies mentioned above to recreate it in the cloud.
A migration team will need to conduct an analysis and inventory of the legacy applications to be migrated. Of note here is identifying which application processes are dependent on physical systems, and the cloud migration tools needed to ensure those applications operate effectively in the cloud.
Depending on the industry, an organization must ensure migrated applications and all pertinent data are secure pre-transit, in transit, and post-transit, according to the standards set forth by regulations such as HIPAA, PCI DSS, and GDPR.
Cloud migration is an opportunity for a business to reassess and modernize how its applications function, and get the most out of that functionality by leveraging cost- and time-saving technologies native to the cloud provider. It can be a time-consuming process, but the long-term upside is that business benefits from the flexibility, scale, and speed that modern, cloud-native applications provide.
Learn about Rapid7's Cloud Migration Solution with Unlimited Risk Management
2022 Cloud Misconfigurations Report: Latest Cloud Security Breaches and Attack Trends