Beware of the Private Cloud

Thursday, November 25, 2010

Rahul Neel Mani

F520f65cba281c31e29c857faa651872

Dr. Werner Vogels, Chief Technology Officer at Amazon.com, in an interview with Ashwani Mishra, shares his views on the architecture behind Amazon Web Services, the adoption of cloud computing and key issues and trends around it.

Q:How did Amazon Web Services come into being and what is the nature of the IT architecture used to offer services to enterprise users?

A: The emergence of Amazon Web Services came out of our own need at Amazon.com to build a scalable and reliable platform that helped our engineers to be more innovative and effective.

For many years Amazon Web Services has been working on various scalable and reliable IT solutions and techniques. We supported Amazon.com’s business in several countries and built an e-commerce enterprise services platform. On this platform we have customers such as Marks and Spencer, Target.com and Timex running their e-commerce applications. The technologies needed for such companies were on a much larger scale than even Amazon.com.

We organised our IT structure internally by using a Service Oriented Architecture (SOA). The model was built on an agile development methodology. So if we wanted to add innovation within our environment we created a small team that was given the task of developing a new service. We have around 300 to 400 such services right now.

Q:So was this platform the precursor to becoming a new business model for the company to offer services in the cloud?

A: Yes. It was not only the architecture but the manner in which it was organised internally. Each of these services had a dedicated team associated with it. The developers were themselves responsible for the operations and innovation. These teams had an assignment to improve the services continuously.

During this time, we realised that we could do better. We did a deep dive and felt that all of these teams were working on similar issues, especially on the infrastructure front. Seventy percent of their time was being spent on managing infrastructure including storage, allocating and managing resources, managing databases, carrying out data replication, built fault-tolerance for multiple data centres, and managing networks.

We realised that we were allowing duplication of work to happen purely because of speed of execution. We decided to place this in a shared services platform so that the teams could become more effective. By dropping the infrastructure pieces into the shared services model, our engineers became more effective. With shared services our people focused 70 percent of their time on innovation. This was a turnaround for us.

This was the time when we decided to open this as a service for enterprises who wanted to innovate and focus on business, rather than worry on capex and opex costs.

Q:How do you envision enterprises making a transition to the cloud?

A: There is some skepticism as of today but as more education happens around the cloud computing model, enterprises will become comfortable with it. However, we do see many enterprises across the globe being aggressive in deployment.

If I look at a very-large-enterprise CIO, who is responsible for more than a thousand applications; it is obvious that he will not move all his applications overnight onto the cloud. According to me such CIOs would have an immediate strategy and a long term strategy for cloud transition.

The immediate strategy would focus on anything that has to do with scale and where they need to control the costs. This would involve moving applications such as marketing, and campaigning to the cloud. These will be the obvious choices.

In parallel, they will be starting proof-of-concepts to learn more about the cloud. They might then move their test and development environment and this will be a pre-cursor to moving their production environment.

Disaster Recovery (DR) in a cloud model is another area that is becoming quite popular for many enterprises. The cloud is getting these enterprises to change the way they conduct their DR in terms of rigour and continuity and ensuring that business goes on as usual.

In the long term, CIOs will look at their internal IT systems to be cloud ready and build features such as automation. They will also have to look at the IT dependencies of various applications and what would be the cost of bringing such applications onto the cloud. For example, if the CRM license of a company expires next year, they can either renew the license or place it on the cloud or go for SaaS.  So there is a range of options available to CIOs today.

Q:Many technology service providers have hyped up the private cloud. You term it a "false cloud." What are the issues surrounding the private cloud?

A: Enterprises are not asking for private clouds, it is the service providers who are telling them what they should do. Take the analogy between the electricity grid and cloud model. In the beginning of the last century many enterprises ran their businesses using generators. When public electricity was introduced, these businesses couldn’t just dump their generators and go on the public network.

They took their time to realise that it was secure, reliable and their business could run on it and that’s when they started the transition.In this story there was one set of people who were unhappy and they were the generator manufacturers. They wanted their generators to be sold. So they kept telling enterprises that they should not only keep the generators they owned but also buy more and become independent public utility companies.

Coming back to the cloud model, I think the cloud is defined by benefits, and the three important benefits are lowering costs, making IT agile and removing undifferentiated heavy lifting by off-loading data centre operations.

In the case of a private cloud, it has none of these benefits. It doesn’t lower costs as one still needs to pay for resources; it will scale over again as demands need to be met, which means that there is no reduction in operational costs.

It doesn’t improve your agility as the resources are not infinite and there are constraints. So a CIO will end up having the same burden that he carried before -- managing reliability, maintenance and so on. I think that private cloud doesn’t have the right to be called a cloud model.

Q:Would you agree that interoperability and well-defined standards hold the key to broad adoption of cloud computing?

A: The way things are going, I do not think standards are an obstacle for the cloud adoption. Previously software applications were complex as many customers found themselves locked-in with a particular service provider. The only way they could achieve freedom from such complexities was through the presence of standards.

We believe that one should not lock customers into any particular technology. Enterprises should have the choice of using any services that they want to use. So if an enterprise is using our compute services, they are not obliged to use our storage service. They have the freedom to use it from another service provider. Also having simple application interfaces, it becomes easy for enterprises to move from one provider to another.

Q:Will there be standards in the future? Maybe. What is Amazon Web Services doing to address the big worries around management and security in cloud computing?

A: Automation is an important concept in the cloud for management of services. Here services are not just big software packets but come equipped with APIs that give the power of control. We have various partners such as CA, BMC Software and more that work with us for our cloud offerings.

Security has been one of the concerns and on a global level it is hard just to say ‘trust me.’ At Amazon Web Services, we sit down with CIOs and the CISOs of companies and look at their current practices. We then look at the security properties that the cloud can offer and whether we can match them. The cloud has isolation models, access control mechanisms similar to what many enterprises have on-premise.

To be honest, I have yet to witness a situation where after such a conversation, the CIO or the CISO said that the security was insufficient in the cloud. The Federal government in the U.S. decided to move to the cloud as they wanted to deliver better services for the citizens. They launched one of their sites called recovery.org that tracks stimulus spending on the Amazon cloud. The government put out a release stating that our security in the cloud model was better than what they could achieve themselves.

Q:How do you see the adoption of the cloud model in the next one year?

A: It is hard to predict where it will go in the next one year. Each year has been a surprise for us in the cloud space. There will be a change in enterprise licensing models. IT service providers are starting to realise that if they do not start listening to their customers, they will lose out.

Licenses come for five to ten years if users want a discount. The whole discount business is murky. Everybody knows the huge price tags that come with the ERP systems and they also know that nobody is paying that amount. So does one want to commit for ten years to get the best deal? In the cloud, you pay for what you use. It is clear and transparent.

I see the cloud model becoming consumer driven. Just like we have no brand loyalty in the consumer world of technology gadgets and applications, the same will be true for the cloud as well. CIOs want control of their IT infrastructure and meet business expectations. So we will see a move towards richer applications, integration with more consumer style IT applications; and all of these will be driven by cloud services.

Cross-posted from CTO Forum

Possibly Related Articles:
10115
Cloud Security
Cloud Security Amazon Cloud Computing Vendor Management Managed Services
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.