What Cloud Computing Actually Means in Practice
Cloud computing is the delivery of computing resources — servers, storage, databases, networking, software, and analytics — over the internet on a pay-per-use basis, from large data centres operated by third-party providers. The business that uses cloud computing does not own the physical hardware that runs its applications; it rents access to that hardware by the hour, the minute, or even the second, scaling capacity up when demand increases and releasing it when demand decreases. This rental model is the fundamental economic transformation that cloud computing produces: it converts capital expenditure (buying and owning servers) into operational expenditure (paying for what is used when it is used).
The three primary cloud service models that most organisations encounter: Infrastructure as a Service (IaaS), which provides the raw computing, storage, and networking resources that the organisation’s IT team configures and manages (the cloud equivalent of renting data centre space and hardware); Platform as a Service (PaaS), which provides a managed development environment where developers can build and deploy applications without managing the underlying infrastructure; and Software as a Service (SaaS), which provides complete, ready-to-use software applications delivered over the internet — the category that most end users experience directly in the form of email services, collaboration tools, CRM systems, and productivity software.
The Major Cloud Providers and What Differentiates Them
The three hyperscale cloud providers that dominate enterprise cloud infrastructure: Amazon Web Services (the market leader by revenue and the most comprehensive service portfolio, with over 200 distinct services spanning compute, storage, databases, machine learning, analytics, and more), Microsoft Azure (the second-largest provider by revenue, distinguished by its deep integration with Microsoft’s existing enterprise software ecosystem and its strength in hybrid cloud scenarios that connect on-premises infrastructure to cloud services), and Google Cloud Platform (the third-largest provider, distinguished by its data analytics and machine learning capabilities that reflect Google’s internal expertise in these areas).
The cloud provider selection criteria that most practitioners consider most important: the specific services required for the organisation’s workloads (most organisations use at least some services available only from specific providers), the integration with existing software investments (Azure is often the natural choice for organisations heavily invested in Microsoft’s enterprise software stack), the geographic availability of data centres in the regions where the organisation’s operations and customers are located (which affects both latency and data sovereignty compliance), and the pricing model for the specific resource types the organisation will consume most heavily (which varies significantly across providers and must be evaluated against the specific consumption profile rather than at the generic level).
Cloud Migration: Moving Existing Workloads
The cloud migration strategies that organisations most commonly apply to their existing on-premises applications: the rehost (also called lift-and-shift, which moves the application to cloud infrastructure without modification — the fastest migration path that achieves the operational benefits of cloud without the engineering investment of redesigning the application), the refactor (which modifies the application to take advantage of cloud-native services without fundamentally changing its architecture — a middle path that captures more cloud benefit than rehosting at moderate engineering cost), and the rebuild (which redevelops the application from scratch using cloud-native architecture and services — the highest engineering investment that produces the most cloud-optimised result but that is only justified for applications whose strategic importance warrants the cost).
The cloud migration assessment that most efficiently determines the right strategy for each application in a portfolio: the application portfolio analysis that evaluates each application on two dimensions — the technical feasibility and cost of migration (which workloads are most and least suitable for cloud deployment given their architecture, dependencies, and licensing) and the business value of migration (which workloads would benefit most from the scalability, availability, and service improvements that cloud migration enables). The applications in the high-feasibility, high-value quadrant are the migration priorities; those in the low-feasibility, low-value quadrant may be better candidates for decommission than migration.
Cloud Cost Management: Preventing Bill Shock
The cloud cost management challenge that most organisations discover after their first significant cloud deployment: the pay-per-use model that eliminates upfront capital expenditure can produce unexpectedly large operational expenditure when resources are provisioned without adequate cost governance. The cloud environment where developers can provision new resources with a few clicks, without cost approval workflows or automatic deprovisioning, rapidly accumulates the idle resources, oversized instances, and forgotten test environments that generate the cloud bill that arrives at month-end and is larger than anyone expected.
The cloud cost optimisation practices that most consistently reduce cloud spending without reducing capability: the right-sizing analysis that identifies instances and services provisioned at sizes larger than their actual utilisation requires (the most common source of cloud waste, typically representing 20 to 40% of cloud spending in organisations that have not actively right-sized their deployments), the reserved instance and savings plan commitments that provide 30 to 70% discounts on predictable workloads in exchange for one or three-year usage commitments, and the automatic shutdown policies for development and test environments that do not need to run continuously and whose running cost outside business hours is pure waste.
Cloud Security and Compliance
The cloud security model that most commonly confuses organisations new to cloud infrastructure: the shared responsibility model, in which the cloud provider is responsible for the security of the cloud infrastructure itself (the physical facilities, the hypervisors, the networking infrastructure) while the customer is responsible for the security of what they deploy in the cloud (the operating systems, the applications, the data, the access controls). The customer who assumes that using a reputable cloud provider means their data and applications are automatically secure has misunderstood the shared responsibility model — the provider’s security protects against attacks on the infrastructure, not against the misconfigurations, vulnerable applications, and weak access controls that most cloud security incidents actually exploit.
The cloud security controls that most effectively prevent the most common cloud security failures: the multi-factor authentication requirement for all privileged access (the most basic control that prevents the credential theft that enables the majority of cloud account compromises), the least-privilege access policy that provides each identity with only the permissions required for their specific role (which limits the damage from compromised credentials), and the cloud security posture management tool that continuously scans the cloud environment for misconfigurations such as publicly accessible storage buckets, overly permissive security groups, and unencrypted data at rest (which are the most common causes of cloud data exposure incidents).