Target architecture and placement
A target environment is decided per workload: some are rehosted, some are refactored, some stay where they are. The decision follows how the application holds state, its data class and how tightly it is integrated.
- Stateful components are handled separately
- Staying put is also a decision, not a default
- Tiers of one application may live in different environments
- The reasoning goes into the architecture record
Network, identity and boundaries
In a hybrid architecture, connectivity and identity are built before applications. Without an addressing plan, private connectivity, DNS resolution and a central identity source, every migrated workload stands on a workaround that is hard to remove later.
- Addressing conflicts are resolved before any migration
- One identity source, least-privilege authorization
- Cross-environment traffic is explicitly permitted
- Management plane access runs on a separate path
Cost visibility and FinOps
Cloud cost is controlled by a management discipline, not by an invoice. Tagging standards, cost ownership and budget alerts are set up on day one; otherwise the source of spend is investigated at month end.
- Tagging is enforced before resources can be created
- Every line of spend has an owner
- Reservation and commitment calls are made on measurement
- Idle resources are flagged automatically
Operating model and automation
Infrastructure built by hand breaks by hand. Resources are defined as code, changes pass review, and environments are produced from the same definition. That buys reversibility as much as speed.
- Resource definitions live under version control
- Environment differences come from parameters, not forks
- Every change leaves a review record
- Rollback means applying the previous definition