| name | multi-cloud-architecture |
| description | Guide complet d'architecture multi-cloud — patterns de déploiement, networking cross-cloud, fédération d'identité, DR/BCP, data sovereignty, vendor lock-in avoidance, service mesh, observabilité unifiée |
| category | cybersecurite |
Multi-Cloud Architecture & Security
1. Multi-Cloud Patterns
Architecture Patterns
┌─────────────────────────────────────────────────────────────────┐
│ MULTI-CLOUD ARCHITECTURES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. Active-Passive (DR) │
│ ┌─────┐ ┌─────┐ │
│ │AWS │ ← │GCP │ (standby / cold / warm) │
│ └─────┘ └─────┘ │
│ │
│ 2. Active-Active (Load Sharing) │
│ ┌──────┐ ┌──────┐ │
│ │AWS ├────┤Azure │ (round-robin, geo-routing) │
│ └──────┘ └──────┘ │
│ │
│ 3. Distributed (Microservices) │
│ ┌───────────────────────────────┐ │
│ │ Service A (AWS) │ │
│ │ Service B (GCP) │ │
│ │ Service C (Azure) │ │
│ │ DB / Cache (shared) │ │
│ └───────────────────────────────┘ │
│ │
│ 4. Data Sovereignty (Regions) │
│ ┌──────┐ ┌──────┐ ┌──────┐ │
│ │AWS-US│ │GCP-EU│ │Azure-Asia│ (GDPR, local laws) │
│ └──────┘ └──────┘ └──────┘ │
│ │
│ 5. Vendor-Specific Best Fit │
│ ┌────────────────────────────┐ │
│ │AWS: AI/ML (SageMaker) │ │
│ │GCP: Big Data (BigQuery) │ │
│ │Azure: Enterprise (AD/O365) │ │
│ └────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
Decision Matrix
| Critère | AWS | GCP | Azure |
|---|
| AI/ML | SageMaker, Bedrock | Vertex AI | Azure ML |
| Data/Analytics | EMR, Athena, Redshift | BigQuery, Dataflow | Synapse, Data Lake |
| Serverless | Lambda | Cloud Functions | Functions |
| Kubernetes | EKS | GKE (best) | AKS |
| Enterprise AD | IAM + SSO | Workforce Identity | Azure AD (best) |
| Hybrid Cloud | Outposts | Anthos | Azure Arc |
| CDN | CloudFront | Cloud CDN | Front Door |
| Global Reach | 33 regions | 40+ regions | 60+ regions |
2. Multi-Cloud Networking
Cross-Cloud Connectivity
AWS → GCP via Private Connectivity
aws vpn-connection create \
--customer-gateway-id <cgw> \
--type ipsec.1 \
--vpn-gateway-id <vgw>
gcloud compute vpn-tunnels create aws-tunnel-1 \
--region us-central1 \
--peer-address <aws-vpn-endpoint> \
--shared-secret <secret> \
--ike-version 2 \
--local-traffic-selector 10.0.0.0/8 \
--remote-traffic-selector 172.16.0.0/12
AWS → Azure via Private Connectivity
Multi-Cloud Service Mesh
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
name: gcp-service
spec:
hosts:
- svc.gcp.cluster.local
addresses:
- 10.200.0.0/16
ports:
- number: 8080
name: http
protocol: HTTP
resolution: DNS
endpoints:
- address: gcp-cluster.internal.example.com
ports:
http: 80
DNS Multi-Cloud
aws route53 create-health-check --caller-reference hc-app --health-check-config Type=HTTP,FullyQualifiedDomainName=app.aws.com,Port=443,ResourcePath=/health
gcloud dns managed-zones create multi-cloud --description "Multi-cloud routing" --dns-name "app.example.com."
CDN Multi-Cloud
aws cloudfront create-origin-group \
--origin-group-config '{"OriginGroupMembers":{"Items":[{"Id":"aws-origin"},{"Id":"gcp-origin"}],"Quantity":2},"FailoverCriteriaSpec":{"StatusCodeFailures":{"Items":[502,503,504],"Quantity":3}}}'
3. Multi-Cloud Identity Federation
Federation Patterns
User → IdP (Azure AD)
├── AWS IAM Identity Center (SSO)
├── GCP Workforce Identity Federation
└── Azure AD itself (native)
Azure AD as Central IdP
gcloud iam workforce-pools create azure-pool --location global
gcloud iam workforce-pools providers create-saml azure-provider \
--location global \
--workforce-pool azure-pool \
--identity-provider-arn "arn:aws:iam::<account>:saml-provider/AzureAD" \
--attribute-mapping "google.subject=assertion.sub"
Cross-Cloud IAM Mapping
AWS: arn:aws:iam::<account>:role/Admin
GCP: user:admin@domain.com (via federation)
Azure: user:admin@domain.com (native Azure AD)
4. Multi-Cloud DR / BCP
DR Strategies
| Strategy | RPO | RTO | Cost |
|---|
| Backup & Restore | 24h | 24-48h | Low |
| Pilot Lite | 15min | 1-4h | Medium |
| Warm Standby | 5min | 15-60min | Medium-High |
| Active-Active | 0s | 0-30s | High |
| Multi-Site Active | 0s | 0s | Very High |
DR Automation
aws dms create-replication-task ...
skopeo copy docker://<ecr>/app:latest docker://<gcr>/app:latest
Cloud SQL DR Replication
aws rds create-db-instance-read-replica --source-db-instance-identifier <source> --db-instance-identifier dr-replica
gcloud sql instances create dr-replica --master-instance-name <source> --region europe-west1
5. Data Sovereignty & Compliance
Regional Data Residency
aws s3api put-object-legal-hold --bucket <bucket> --key <key> --legal-hold Status=ON
gcloud resource-manager org-policies set-policy --organization=<org> file://location-policy.yaml
cat > location-policy.yaml << 'EOF'
constraint: constraints/gcp.resourceLocations
listPolicy:
allowedValues:
- europe-west1
- europe-west2
- europe-west3
deniedValues: []
EOF
az policy definition create --name allowed-locations --rules '{"if":{"field":"location","notIn":["europewest","francecentral"]},"then":{"effect":"deny"}}'
Multi-Cloud Encryption Key Hierarchy
6. Multi-Cloud Observability
Unified Logging Architecture
┌─────────────────────────────────────────────────────────────────┐
│ SIEM / Observability │
│ Splunk / ELK / Sentinel / Datadog / Grafana Cloud │
├────────┬────────┬────────┬────────┬────────┬────────┬───────────┤
│ AWS │ GCP │ Azure │ K8s │ App │ Sec │ Cost │
│GuardDuty│SCC │Defender│kube- │APM │Hub │Anomaly │
│CloudTr.│Logging│Activity│bench │logs │Findings│Budgets │
│VPC Flw│Metrics│Monitor │Events │Metrics │Alerts │Reserved │
└────────┴────────┴────────┴────────┴────────┴────────┴───────────┘
Centralized Alerting
- name: Multi-Cloud CPU
rules:
- alert: HighCPU
expr: |
avg(aws_ec2_cpu{instance=~"prod-.*"}) > 90
or avg(gcp_gce_cpu{instance=~"prod-.*"}) > 90
or avg(azure_vm_cpu{vm=~"prod-.*"}) > 90
for: 5m
Multi-Cloud Cost Dashboard
SELECT
cloud_provider,
service,
SUM(cost) as total_cost,
SUM(usage_amount) as total_usage
FROM (
SELECT 'AWS' as cloud_provider, line_item_type as service, cost, usage_amount
FROM aws_cur.cost_and_usage
UNION ALL
SELECT 'GCP' as cloud_provider, service.description as service, cost, usage.amount as usage_amount
FROM gcp_billing_export.gcp_billing_export_v1_*
UNION ALL
SELECT 'Azure' as cloud_provider, MeterCategory as service, CostInBillingCurrency as cost, Quantity as usage_amount
FROM azure_consumption.details
)
GROUP BY cloud_provider, service
ORDER BY total_cost DESC
7. Vendor Lock-in Mitigation
Provider-Agnostic Tooling
apiVersion: devopstoolkit.labs/v1alpha1
kind: SQL
metadata:
name: my-db
spec:
compositionSelector:
matchLabels:
provider: aws
parameters:
size: small
dbName: myapp-db
Kubernetes — Workload Portability
apiVersion: apps/v1
kind: Deployment
metadata:
name: app
spec:
replicas: 3
selector:
matchLabels:
app: app
template:
metadata:
labels:
app: app
spec:
containers:
- name: app
image: myregistry/app:latest
resources:
requests:
cpu: 500m
memory: 256Mi
env:
- name: DB_URL
valueFrom:
secretKeyRef:
name: db-config
key: url
API Compatibility Layer
objects:
list:
- AWS: aws s3 ls s3://bucket/
- GCP: gsutil ls gs://bucket/
- Azure: az storage blob list --container-name bucket
upload:
- AWS: aws s3 cp file s3://bucket/
- GCP: gsutil cp file gs://bucket/
- Azure: az storage blob upload -f file -c bucket
8. Security Considerations
Multi-Cloud Security Risks
┌─────────────────────────────────────────────┐
│ Multi-Cloud Risks │
├─────────────────────────────────────────────┤
│ 1. Inconsistent IAM policies │
│ 2. Complex key management (KMS ≠ Key Vault) │
│ 3. Network latency / bandwidth costs │
│ 4. Compliance fragmentation │
│ 5. Monitoring gaps (alerts lost between) │
│ 6. Skill asymmetry (team can't cover all) │
│ 7. Data egress costs (cross-cloud transfer) │
│ 8. Incident response complexity │
└─────────────────────────────────────────────┘
Security Best Practices
9. Tools & Frameworks
| Outil | Usage | Lien |
|---|
| Terraform | Multi-cloud IaC | terraform.io |
| Crossplane | Control plane multi-cloud | crossplane.io |
| Terragrunt | DRY Terraform | terragrunt.gruntwork.io |
| Pulumi | IaC avec langages prog | pulumi.com |
| Istio | Service mesh multi-cloud | istio.io |
| Consul | Service mesh + DNS | consul.io |
| Kubefed | K8s federation | github.com/kubernetes-sigs/kubefed |
| Grafana | Multi-cloud observability | grafana.com |
| OpenCost | K8s cost multi-cloud | opencost.io |
| CloudHealth | Multi-cloud cost | bmc.com |
| CloudCheckr | Multi-cloud security | cloudcheckr.com |
Ressources
