Description

This curriculum spans the technical and operational rigor of a multi-workshop cloud migration advisory engagement, addressing real-world complexities in hybrid architecture, compliance alignment, and vendor management across enterprise-scale environments.

Module 1: Assessing Cloud Provider Capabilities and Service Parity

Evaluate regional availability of compute instances to determine alignment with data sovereignty requirements for regulated workloads.
Compare GPU instance types across AWS, Azure, and GCP for machine learning workloads, factoring in driver compatibility and cluster scaling limits.
Analyze service SLAs for managed databases, including failover timing and backup retention, to meet RTO and RPO commitments.
Map existing on-premises middleware dependencies (e.g., IBM MQ, Oracle Tuxedo) to available PaaS equivalents or containerization requirements.
Assess provider-specific managed Kubernetes offerings (EKS, AKS, GKE) for control plane management, node auto-provisioning, and integration with existing CI/CD tooling.
Validate support for legacy protocols (e.g., FTP, SMB 2.1) in object storage gateways when migrating file-based integration patterns.

Module 2: Multi-Cloud and Hybrid Architecture Design

Design interconnectivity between on-premises data centers and multiple cloud providers using dedicated connections (e.g., AWS Direct Connect, Azure ExpressRoute) with BGP routing policies.
Implement consistent identity federation across AWS IAM, Azure AD, and GCP IAM using SAML 2.0 with attribute-based access control rules.
Select a consistent storage abstraction layer (e.g., CSI drivers, cloud-agnostic APIs) to enable workload portability between providers.
Architect disaster recovery across providers using asynchronous replication of databases and stateful services with conflict resolution strategies.
Balance egress cost and latency by routing traffic through provider-specific CDN and edge caching services based on end-user geography.
Standardize monitoring telemetry collection using open formats (OpenTelemetry) to avoid lock-in to proprietary agents and dashboards.

Module 3: Cloud Provider Security and Compliance Alignment

Map provider-native encryption controls (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) to organizational key management policies and separation of duties.
Configure network security groups and firewall rules to enforce least-privilege access between workloads, considering provider-specific rule evaluation order.
Implement audit trail aggregation from cloud-native logging services (CloudTrail, Azure Monitor, Cloud Audit Logs) into a centralized SIEM with normalization rules.
Negotiate Business Associate Agreements (BAAs) or Data Processing Agreements (DPAs) with providers for HIPAA or GDPR compliance.
Enforce configuration compliance using provider-native tools (AWS Config, Azure Policy, Security Command Center) with custom rules for resource tagging and encryption.
Isolate regulated workloads into dedicated subscriptions or projects with restricted service principal permissions and break-glass access procedures.

Module 4: Migration Execution and Cutover Planning

Choose between agent-based (e.g., AWS Server Migration Service) and agentless replication tools based on guest OS support and network throughput constraints.
Stage database migration using logical dumps versus physical replication, weighing downtime duration against transaction consistency needs.
Coordinate DNS cutover timing with TTL adjustments and validate failback procedures before decommissioning source systems.
Execute application smoke tests in the target environment using synthetic transactions that validate integration endpoints and authentication flows.
Manage stateful service migration (e.g., message queues, session stores) using dual-write patterns during transition with reconciliation scripts.
Document rollback triggers and execute pre-defined scripts to re-attach on-premises storage or reverse DNS changes in case of failure.

Module 5: Cost Modeling and Financial Governance

Compare three-year TCO between reserved instances, savings plans, and sustained use discounts across providers using historical utilization data.

Implement tagging policies for cost allocation and validate enforcement through automated resource creation pipelines.

Negotiate enterprise discount agreements (e.g., AWS EDP, Azure EA, GCP Enterprise) with volume commitments and exit clauses.

Monitor and alert on anomalous spending using budget tools with thresholds tied to project lifecycle stages (dev, test, prod).

Right-size underutilized VMs using performance telemetry, balancing cost savings against application performance risk during peak loads.

Optimize storage costs by automating tiering policies (e.g., S3 Intelligent-Tiering, Azure Blob Access Tiers) based on access patterns.

Module 6: Operational Readiness and Cloud-Native Management

Adapt incident response playbooks to include cloud-specific failure modes such as zone outages and IAM misconfigurations.
Integrate provider health APIs into NOC dashboards to correlate service degradation with internal application performance metrics.
Standardize VM image creation using Packer with provider-specific builders and vulnerability scanning in the pipeline.
Configure autoscaling policies using custom metrics (e.g., queue depth, request latency) instead of CPU-only triggers.
Manage provider API rate limits in automation scripts using exponential backoff and circuit breaker patterns.
Enforce immutable infrastructure practices by blocking manual changes to production resources via provider configuration guardrails.

Module 7: Vendor Lock-In Mitigation and Exit Strategies

Abstract cloud storage access behind a service layer to enable switching between S3, Blob Storage, and Cloud Storage with minimal code changes.
Use container orchestration platforms with multi-cloud CNI and CSI plugins to reduce dependency on provider-specific networking.
Document data egress procedures, including export formats and transfer mechanisms, to validate exit feasibility during contract renewal.
Avoid proprietary serverless functions (e.g., AWS Lambda, Azure Functions) in core business logic by isolating them behind API gateways.
Maintain portable database schemas by avoiding provider-specific extensions (e.g., PostgreSQL on RDS with custom parameters).
Conduct annual exit drills for non-production environments to test data extraction, schema migration, and reconfiguration on alternative platforms.

Module 8: Continuous Optimization and Innovation Adoption

Evaluate new provider services (e.g., serverless databases, AI APIs) against technical debt reduction potential and team skill readiness.
Implement FinOps feedback loops by sharing cost reports with development teams and incorporating efficiency into sprint retrospectives.
Automate cleanup of orphaned resources (e.g., unattached disks, idle load balancers) using scheduled functions and tagging policies.
Adopt provider-specific observability enhancements (e.g., AWS CloudWatch Contributor Insights, Azure Workbooks) without replacing core tooling.
Integrate infrastructure as code (IaC) scanning tools to detect non-compliant patterns before deployment to production.
Track provider roadmap announcements to plan migration off deprecated services (e.g., VM skus, networking models) with minimal disruption.