Architecture Pattern - Hybrid Cloud Connectivity¶

Overview¶

Hybrid cloud connectivity patterns enable organizations to extend their on-premises data centers into one or more cloud providers, creating a unified network that supports workload portability, data residency, and gradual migration. This guide covers connectivity options, security models, and architectural patterns across AWS, Azure, and Google Cloud.

Pattern Description¶

Problem¶

• Workloads need to span on-premises and cloud environments
• Sensitive data must remain on-premises while leveraging cloud services
• Applications require low-latency communication between on-prem and cloud
• Compliance requirements mandate specific data residency controls
• Migration to cloud needs to be gradual without disrupting existing operations

Solution¶

Establish secure, reliable network connectivity between on-premises infrastructure and cloud environments using: - Dedicated private connections (Direct Connect, ExpressRoute, Cloud Interconnect) - VPN tunnels (IPSec, site-to-site, client VPN) - DNS integration across environments - Identity federation for seamless authentication - Consistent network addressing and routing

flowchart LR
  subgraph ONP[On-prem datacenter]
    APP[Apps + DBs]
    DC[Domain controller / IdP]
    CGW[Customer gateway / router]
  end
  subgraph CONN[Connectivity options]
    DX[Direct Connect /<br/>ExpressRoute /<br/>Cloud Interconnect<br/>dedicated, low-latency]
    VPN[Site-to-site VPN<br/>IPsec over internet<br/>fast to set up]
  end
  subgraph CLD[Cloud]
    TGW[Transit gateway<br/>or hub VPC]
    V1[(VPC / VNet 1)]
    V2[(VPC / VNet 2)]
    V3[(VPC / VNet 3)]
    TGW --> V1
    TGW --> V2
    TGW --> V3
  end
  CGW --> DX --> TGW
  CGW --> VPN --> TGW
  DC -. federation .- CLD

Connectivity Options¶

Dedicated Private Connections¶

VPN Connections¶

Comparison - When to Use What¶

Network Architecture Patterns¶

Hub-and-Spoke¶

                    ┌──────────────┐
                    │  Transit Hub  │
                    │  (TGW/vWAN/  │
                    │   NCC)        │
                    └──────┬───────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
   ┌──────▼──────┐  ┌─────▼───────┐  ┌────▼────────┐
   │ Spoke VPC-1  │  │ Spoke VPC-2  │  │ On-Premises  │
   │ (Production) │  │ (Staging)    │  │ Data Center  │
   └─────────────┘  └──────────────┘  └─────────────┘

Multi-Cloud Transit¶

   On-Prem ─── DX ──── AWS Transit Gateway
      │                        │
      │── ExpressRoute ── Azure vWAN Hub
      │                        │
      └── Interconnect ── GCP NCC Hub

DNS in Hybrid Environments¶

DNS Resolution Patterns¶

Cloud DNS Integration¶

Security in Hybrid Networks¶

Network Security Layers¶

Zero Trust in Hybrid¶

Identity Federation¶

Hybrid Identity Models¶

Data Replication and Sync¶

Hybrid Data Patterns¶

Monitoring Hybrid Environments¶

Unified Observability¶

Cost Optimization¶

Hybrid Connectivity Costs¶

Cost Reduction Strategies¶

Certification Exam Focus Areas¶

AWS¶

• Direct Connect LAG, virtual interfaces (private, public, transit)
• Transit Gateway route tables and multi-account connectivity
• Route 53 Resolver for hybrid DNS
• AWS Storage Gateway modes (file, volume, tape)
• VPN over Direct Connect for encryption

Azure¶

• ExpressRoute Global Reach for site-to-site via Microsoft backbone
• Virtual WAN architecture and hub routing
• Azure Arc for hybrid management (servers, Kubernetes, data)
• Azure DNS Private Resolver architecture
• ExpressRoute FastPath for high-performance scenarios

Google Cloud¶

• Cloud Interconnect VLAN attachments and partner provisioning
• Network Connectivity Center for multi-cloud hub
• Cloud Router and BGP best practices
• Cloud VPN HA for 99.99% availability
• Hybrid DNS with Cloud DNS forwarding zones

Documentation Links¶

• AWS Direct Connect: https://docs.aws.amazon.com/directconnect/latest/UserGuide/
• AWS Transit Gateway: https://docs.aws.amazon.com/vpc/latest/tgw/
• AWS Site-to-Site VPN: https://docs.aws.amazon.com/vpn/latest/s2svpn/
• Azure ExpressRoute: https://learn.microsoft.com/en-us/azure/expressroute/
• Azure Virtual WAN: https://learn.microsoft.com/en-us/azure/virtual-wan/
• Azure VPN Gateway: https://learn.microsoft.com/en-us/azure/vpn-gateway/
• Google Cloud Interconnect: https://cloud.google.com/network-connectivity/docs/interconnect
• Google Cloud VPN: https://cloud.google.com/network-connectivity/docs/vpn
• Google Network Connectivity Center: https://cloud.google.com/network-connectivity/docs/network-connectivity-center

Key Takeaways¶

1. Dedicated connections (Direct Connect, ExpressRoute, Interconnect) are essential for production hybrid workloads
2. Always design for redundancy - dual connections across diverse paths
3. VPN provides a quick, encrypted fallback - use it alongside dedicated connections
4. Hybrid DNS is often the most complex part - plan it early in the architecture
5. Data transfer costs can be significant - optimize egress and use private connections
6. Identity federation is critical - avoid separate credentials for on-prem and cloud
7. Monitoring must span both environments with a unified view
8. Consider third-party SD-WAN solutions (Megaport, Equinix Fabric) for multi-cloud connectivity