Hybrid cloud integrates public and private clouds, serving as an intermediate journey for enterprises moving to the cloud and representing a specific model and stage in the development of cloud computing. Due to factors such as information confidentiality, industry compliance, and market segmentation, some enterprises prefer to store data in local data centers or private clouds while simultaneously desiring access to the computational and storage resources of public clouds. In such cases, hybrid clouds are widely adopted during the initial stages of enterprise cloud adoption.
1 Key Technical Points for Building a Hybrid Cloud
1.1 Network Connectivity
The first point is that public clouds offer user-defined networking capabilities. Here, “user-defined network” generally refers to private networks within the cloud. Amazon VPC allows enterprise users on AWS to customize logically isolated dedicated networks, including the ability to define subnets, configure routing, and set up public internet gateways and VPN gateways.
The second point is diverse and stable network access capabilities. The most prominent feature of hybrid clouds is connectivity, which mainly involves two methods: public internet access and direct connect (leased line) access.
To protect user information security, traffic over the public internet typically requires IPsec VPN encryption. AWS provides managed VPN services and self-managed VPN options. If using a self-managed approach, small-scale VPN gateways (under 200 Mbps) can be implemented via virtual software-based VPN gateways, while medium or large-scale VPN gateways (300 Mbps and above) can be implemented using hardware VPN gateway devices. VPN deployment can generally be completed within half a day, quickly meeting enterprise user needs.
AWS Direct Connect (DX) provides leased line access capabilities for enterprise cloud adoption, ensuring full-time, comprehensive isolation and encryption of user data transmission while guaranteeing available network bandwidth. Users do not need to worry about issues related to capacity overload.
Figure 1: AWS DX Leased Line and VPN Hybrid Networking Diagram
1.2 Security and Monitoring
Hybrid clouds connect private and public clouds at the network level. In the event of network failures or attacks, it is crucial to ensure that faults do not propagate between networks, limiting attacks or failures to a certain scope. The cloud network environment must possess flexible and easily configurable network security access control capabilities. Amazon VPC provides stateful EC2 instance-level network firewall functionality (Security Groups) and stateless subnet-level network access control (Network ACLs).
Regarding monitoring, Amazon VPC offers Flow Logs, which allow users to capture incoming and outgoing network IP traffic information. Flow log data is stored using Amazon CloudWatch Logs. After creating flow logs, users can monitor and view the inbound and outbound status of their VPC network traffic in Amazon CloudWatch Logs and receive timely feedback on network anomalies through CloudWatch preset alert policies. VPC Flow Logs also help users troubleshoot network issues, such as determining why traffic did not reach an EC2 instance. Furthermore, analysis of VPC Flow Logs helps check network security settings on AWS, eliminating vulnerabilities.
1.3 Unified Services and Hybrid Cloud Management Platform
The definition of a Cloud Management Platform (CMP), proposed by Gartner, can be summarized into two aspects: first, management—managing public and private clouds to form a hybrid cloud; second, self-service—including image partitioning, metering and billing, and policy-based load optimization. The ultimate goal of a cloud management platform is to achieve optimal performance when applications run on the cloud platform.
After building a hybrid cloud platform, enterprise users first need to address the unification of service portals and resource status monitoring interfaces. A single platform should enable unified application, approval, monitoring, and billing for both local data center (or private cloud) and public cloud resources. This significantly reduces the complex operational workload caused by switching between platforms, making cross-platform resource usage and monitoring more convenient for users.
Figure 2: Example of Hybrid Cloud Management Platform (CMP) Functions
2 Common Hybrid Cloud Application Scenarios
2.1 Leveraging AWS Public Cloud to Handle Explosive Business Growth
Most internet businesses experience exponential growth, making it difficult to predict infrastructure reserve requirements. Generally, during the early stages of business growth, small-scale physical machine hosting can meet user needs. However, as marketing activities expand and business scales grow explosively, the limited deployable slots in original physical hosting rooms force a choice of public cloud as an elastic measure to rapidly deploy services and meet user demands.
Today, an increasing number of enterprise users are migrating their internet business systems, such as e-commerce systems, web websites, mobile products, and information subscription service systems, to AWS. To meet user demands driven by explosive business growth, AWS cloud services employ various methods to ensure the reliability and stability of application systems. As a foundational cloud service, Amazon EC2 provides scalable compute capacity, allowing users to fully control the compute resources they need based on actual requirements. Coupled with AWS Auto Scaling, users can automatically expand Amazon EC2 capacity according to pre-set conditions, ensuring seamless growth in the number of Amazon EC2 instances during peak demand periods to maintain performance, while automatically reducing the number of instances during low-demand periods to lower costs. Additionally, Elastic Load Balancing automatically distributes application access traffic across multiple Amazon EC2 instances and detects unhealthy instances, automatically rerouting traffic to healthy ones. Through the combination of different functional cloud services, the AWS cloud platform ensures high reliability and stability for application systems.
Figure 3: Three-Tier System Architecture Diagram for E-commerce Platforms under Hybrid Cloud Architecture
Compared to early systems based on traditional data centers, new systems relying on the AWS cloud platform have seen significant improvements in stability, reliability, and response speed, while substantially reducing fixed asset investment (CAPEX) and operational costs (OPEX). Under the traditional data center model, assuming a server lifespan of approximately five years, purchasing a physical server corresponding to the configuration of an Amazon EC2 c3.4xlarge instance (16 vCPU, 30 GB RAM), plus network and hosting fees, results in a calculated total cost over five years. If this requirement is migrated to the AWS cloud platform, enterprise users can save approximately 20% on total costs.
Using AWS cloud services also significantly reduces operational costs. In the traditional data center model, enterprise IT operations teams face heavy workloads, performing many simple, repetitive tasks such as server rack mounting/dismounting, system reinstallation, and hardware maintenance. After adopting AWS cloud services, operations personnel can focus primarily on researching and deploying better technical architectures and solutions, improving work efficiency, reducing labor input, and saving roughly half of the manpower costs associated with operations.
2.2 Leveraging AWS Public Cloud for High-Availability Architecture Deployment with Multi-Site Disaster Recovery
Different from the previous category of users, many enterprise users already operate at a large scale, running numerous servers in local data centers or carrier facilities. Their core issue is no longer worrying that infrastructure deployment speed cannot keep up with business growth, but rather seeking development from single-center to multi-center models focusing on stability and reliability, eliminating single points of failure to mitigate business risks caused by single data center failures.
Depending on business reliability requirements, common multi-site disaster recovery approaches include intra-city disaster recovery, active-active sites, and three-site-two-center models. According to traditional construction models, users had to select new locations, lease data centers, initiate procurement of servers and network equipment, and deploy network environments, involving a series of commercial communications and infrastructure construction operations, with cycles ranging from six months to a year. Today, with the booming development of public clouds, users need not worry about such issues; they can simply register an account, purchase servers, establish a leased line, and have their basic infrastructure ready.
The AWS hybrid cloud disaster recovery architecture implements a “three-site-two-center” model within the AWS cloud environment, leveraging the elasticity of AWS cloud resources to significantly reduce resource costs and the complexity of construction and operations. AWS cloud resource pools, through software-defined methods, can create complex IT environments identical to those within the enterprise, achieving complete mirroring of enterprise-grade applications.
IGG, founded in 2005, is a global leading mobile game developer and operator, providing games and related services to players worldwide. To provide the best user experience, IGG needed to deploy servers in multiple regions globally. Before using AWS cloud services, IGG operated its own data centers and utilized hosting services from multiple companies. With rapid business development, the original service deployment model began facing challenges in three main areas: First, inconvenient server resource management, limited scalability and flexibility; long cycles for deploying new servers during access peaks, and waste of existing server resources when game traffic temporarily decreased. Second, difficulty controlling costs when developing and operating new games; since a game’s success depends on many factors, launching every new game requires significant IT resource investment, and failure leads to wasted server resources. Third, how to establish an active-active disaster recovery system to ensure continuous, reliable service for global players under any circumstances.
To address these challenges, IGG considered adopting public cloud services as a supplement to its own data center (hereinafter referred to as Own IDC). After investigation, analysis, and comparison, IGG decided to adopt AWS cloud services and began experimenting with AWS cloud services in availability zones such as Singapore, Frankfurt, Japan, and the US several years ago to deploy overseas game nodes. In August 2016, to enhance the stability and reliability of its entire game operation system, IGG decided to build an active-active disaster recovery system for its core business system located in Northern California. The greatest benefit AWS cloud services brought to IGG was establishing a remote active-active disaster recovery center at a lower cost, achieving real-time synchronous backup of core business data in different locations, and enabling rapid failover to the cloud in case of primary data center failure, ensuring service continuity. The entire disaster recovery system fully met IGG’s business needs: RTO no more than 30 minutes, RPO of 0, enhancing the stability and reliability of IGG’s game operation system. Additionally, using AWS cloud services saved disaster recovery system costs because establishing an active-active disaster recovery system via AWS does not require 1:1 resource configuration, offering significant cost-effectiveness advantages compared to traditional local disaster recovery.
Figure 4: IGG Active-Active Disaster Recovery Center Based on AWS Cloud Services
User Value of AWS Hybrid Cloud Disaster Recovery Architecture: From the perspective of TCO for disaster recovery systems, the AWS hybrid cloud disaster recovery solution has obvious advantages. There is no need for upfront procurement and installation of hardware and software, saving substantial preliminary investment costs. More importantly, in the disaster recovery solution, AWS cloud resources can be kept powered off or only small instances can be activated. Resources that are powered off incur no EC2 virtual machine resource charges, while still maintaining the state of EC2 virtual machines and incremental updates of background data. Our calculations show that for a typical disaster recovery system project, calculated over a five-year period, the TCO is only one-third of that of the original private cloud disaster recovery environment, and the investment in the first year is merely one-tenth of traditional projects.
Furthermore, as application disaster recovery systems migrate to the AWS cloud, existing enterprise disaster recovery centers can be transformed into production centers, thereby expanding the carrying capacity of customer-built data centers or significantly reducing IT resource operational costs, enjoying more benefits brought by AWS cloud. The following figure illustrates the progressive evolution from AWS hybrid cloud disaster recovery to disaster recovery switchover, and finally to the smooth migration of production systems to the cloud:
Figure 5: Progressive Evolution Diagram from AWS Hybrid Cloud Disaster Recovery to Disaster Recovery Switchover to Smooth Migration of Production Systems to the Cloud
2.3 Leveraging AWS Public Cloud for Hybrid Cloud Backup
The benefits of backing up data to the cloud are obvious: management and operation become more convenient, there is no need to build IT backup system architectures, one-time large payments change to monthly or annual pay-as-you-go models, thereby reducing enterprise investment in IT resources, etc. Increasingly, enterprise customers prefer to extend their existing backup system architectures to the cloud through their existing backup software or cloud gateways. The benefit of this approach is replacing offline tapes with cloud backups, significantly reducing local storage resource overhead, and completing backup work in the cloud, which is more cost-effective.
AWS Storage Gateway (also known as “AWS Storage Gateway”, architecture diagram see Figure 6) is a hybrid cloud storage service provided by AWS. Internal applications in enterprise local data centers can seamlessly use AWS cloud storage resources (such as S3, Glacier, etc.) with its help. AWS Storage Gateway helps enterprise users implement backup, archiving, disaster recovery, cloud bursting, tiered storage, and migration from local data centers to the AWS cloud. It possesses seamless integration capabilities; enterprise applications or backup tools can connect to this storage gateway in the AWS cloud via standard storage protocols like NFS or iSCSI through local storage gateway appliances. Meanwhile, the storage gateway connects to AWS storage services such as Amazon S3, Amazon Glacier, and Amazon EBS, enabling file, volume, and virtual tape storage or backup.
Figure 6: AWS Storage Gateway Service Architecture Diagram (Gateway-Cached Volume)
AWS Storage Gateway features a highly optimized data transfer mechanism capable of bandwidth management, automatic network elasticity, efficient data transmission, and providing low-latency local access for active data through local caching.
Of course, from the perspective of enterprise user hybrid cloud backup needs, the following considerations are usually necessary:
- How to achieve unified management for virtual machines and physical machines?
- How to shorten backup time?
- How to restore quickly? Can restoration occur to any environment (e.g., physical machines, virtual machines, virtual machines in the cloud)?
- Can the integrity and security of backup and restored data be ensured?
- How to implement tiered storage for hot and cold data to reduce cloud storage costs?
- How to avoid redundant backup data?
Currently, many domestic and international backup service providers have built integrated AWS hybrid cloud backup solutions based on AWS Storage Gateway, leveraging the low cost of AWS cloud storage resources to help enterprise users implement AWS cloud backups. These solutions well meet the aforementioned user requirements for hybrid cloud backups. The following figure shows a hybrid cloud backup solution based on AWS Storage Gateway provided by a domestic backup service provider.
Figure 7: Hybrid Cloud Backup Solution Based on AWS Storage Gateway by a Domestic Backup Service Provider
This backup service provider’s AWS hybrid cloud backup solution has the following advantages and technical features:
- Simple Operation: Provides a rich-featured, easy-to-use user interface supporting manual backup, scheduled tasks, multi-task/multi-schedule management, backup status monitoring, version management, restore operations, and one-click failover switching functions.
- Block-Level Global Deduplication: Based on source-side deduplication technology, identical data blocks are sent and stored only once, reducing backup time by over 80%. This not only improves efficiency and saves bandwidth and storage space but also ensures large-data cross-site disaster recovery under narrow bandwidth conditions.
- Instant Restore: Through Snapshot technology, ensures applications do not need to be closed during backup. Changed data blocks are marked and migrated in real-time (minimum support of one minute). At the next backup point, only marked data blocks are retrieved, saving disk IO and enabling instant data restoration.
- Hot/Cold Data Tiered Storage Function: Fully utilizes the lifecycle management strategy features provided by Amazon S3. Users can automate hot/cold data tiered storage through simple policy formulation. Cold data is automatically archived to the cheaper Amazon Glacier, meeting long-term archiving needs while significantly reducing cloud storage costs.
- Supports centralized network backup for multiple environments including Windows/Linux/Unix, and supports various application service types, such as common application servers, databases (e.g., MySQL, SQL Server, Oracle, Sybase, DB2), Domino, AD, Exchange, File Servers, etc.
- Triple Data Security:
- Hard Drive Lock: Data is bound to the device; data can only be restored to the original hardware.
- Random Placement: Data is stored in random blocks to prevent insider theft.
- Communication and Data Encryption: Private communication protocol, optional AES data encryption.
- Cross-Site Disaster Recovery and Restoration: Backs up to a remote cloud computing center, supporting restoration to local physical machines, virtual machines, AWS cloud virtual machines, and other different platforms. When physical failures occur in the local data center, this cross-site restoration mechanism meets enterprise users’ cross-site disaster recovery restoration needs and realizes the business value of cross-site data usage.
- Transmission Optimization: Optimized disaster recovery and replication return to online status within minutes.