This curriculum spans the equivalent of a multi-phase cloud migration program, covering the technical, governance, and operational workflows performed during enterprise-scale migrations to Google Cloud, from initial assessment and landing zone design to live cutover, security hardening, and production optimization.
Module 1: Strategic Assessment and Readiness Evaluation
- Conduct a workload categorization exercise to classify applications by migration suitability (rehost, refactor, rearchitect, retire, retain) based on technical debt and business criticality.
- Perform a TCO analysis comparing on-premises operational costs with projected Google Cloud Platform (GCP) spend, including data egress, network, and sustained use discounts.
- Define migration scope by aligning application portfolios with business unit ownership and securing stakeholder sign-off on migration priorities.
- Evaluate existing security and compliance frameworks against GCP’s shared responsibility model to identify control ownership gaps.
- Assess network topology constraints, including hybrid connectivity requirements and DNS dependencies, to determine interconnect or Carrier Peering needs.
- Establish a cloud center of excellence (CCoE) governance model with cross-functional representation from infrastructure, security, and application teams.
Module 2: GCP Environment Design and Landing Zone Configuration
- Implement a hierarchical resource organization using GCP folders and projects to align with enterprise IT cost centers and operational domains.
- Configure Identity and Access Management (IAM) policies with least-privilege principles, integrating with existing SAML or Cloud Identity for centralized user management.
- Deploy a foundational landing zone using Terraform or Deployment Manager to automate VPCs, Shared VPC attachments, and firewall rule baselines.
- Define and enforce organizational policies (e.g., disallowing external IPs, enforcing tags) using GCP Organization Policies and Policy Intelligence.
- Integrate Cloud Audit Logs with SIEM platforms (e.g., Splunk, Chronicle) for real-time monitoring of configuration changes and access events.
- Design multi-region DNS and Cloud Load Balancing strategies to support global application availability and failover requirements.
Module 3: Application and Data Migration Planning
- Select migration tools (e.g., Migrate for Compute Engine, Database Migration Service, Transfer Service) based on source platform, data size, and downtime tolerance.
- Develop cutover plans for stateful applications, including pre-migration snapshots, DNS TTL adjustments, and rollback procedures.
- Conduct schema compatibility assessments when migrating Oracle or SQL Server databases to Cloud SQL or AlloyDB.
- Plan data transfer methods for large datasets (e.g., using Transfer Appliance for offline migration when bandwidth is constrained).
- Coordinate application dependency mapping with network teams to ensure connectivity between migrated and on-premises components during hybrid phases.
- Define data consistency and validation checkpoints during replication phases to verify integrity before cutover.
Module 4: Execution of Compute and Storage Migrations
- Execute lift-and-shift migrations using Migrate for Compute Engine, converting VMware VMs to Compute Engine instances with minimal configuration changes.
- Configure persistent disk types (SSD vs. HDD) and regional vs. zonal placement based on application IOPS and availability requirements.
- Implement custom startup scripts and cloud-init configurations to automate post-migration application initialization.
- Reconfigure storage mount points and file system permissions to align with Linux or Windows instances in GCP.
- Validate VM performance post-migration using Cloud Monitoring and diagnose bottlenecks related to CPU, memory, or disk.
- Optimize VM sizing using Machine Series recommendations and rightsizing reports from the Migrate dashboard.
Module 5: Database and Data Service Migration
- Configure Database Migration Service jobs for continuous replication from on-premises MySQL or PostgreSQL to Cloud SQL with minimal downtime.
- Migrate Oracle workloads to AlloyDB with compatibility mode, adjusting JDBC connection strings and validating PL/pgSQL logic.
- Implement change data capture (CDC) using Striim or Datastream for real-time replication to BigQuery or Cloud Spanner.
- Design backup and point-in-time recovery (PITR) strategies for Cloud SQL instances aligned with RPO and RTO objectives.
- Partition and compress large datasets during transfer to BigQuery to reduce load times and query costs.
- Enforce encryption at rest and in transit for database instances, integrating with Cloud KMS for key management.
Module 6: Networking and Hybrid Connectivity Implementation
- Deploy Cloud Interconnect (Dedicated or Partner) to establish high-throughput, low-latency connections between on-premises and GCP.
- Configure Cloud Router and BGP peering to advertise on-premises routes into VPC networks and enable dynamic routing.
- Implement VPC Service Controls to mitigate data exfiltration risks across multi-project environments.
- Set up DNS forwarding rules using Cloud DNS to resolve on-premises domain names from GCP workloads.
- Design hybrid service mesh using Anthos Service Mesh for secure communication between on-premises and cloud services.
- Validate network performance using Packet Mirroring and VPC Flow Logs to troubleshoot latency or packet loss.
Module 7: Security, Compliance, and Operational Governance
- Integrate Security Command Center with vulnerability scanners and asset inventory tools to detect misconfigurations and exposed services.
- Apply VPC firewall rules with granular ingress and egress controls, avoiding over-permissive 0.0.0.0/0 rules.
- Enforce data classification policies using DLP API scans on Cloud Storage buckets and BigQuery datasets.
- Implement workload identity federation to grant AWS or on-premises workloads access to GCP resources without service account keys.
- Define incident response procedures for compromised instances, including automated quarantine via Eventarc and Cloud Functions.
- Conduct regular audit reviews of IAM policy changes and access logs to detect privilege creep or unauthorized access.
Module 8: Optimization, Monitoring, and Continuous Improvement
- Use Recommender and Cost Management tools to identify underutilized VMs, commit to sustained use discounts, and implement preemptible instances for batch workloads.
- Configure Cloud Monitoring dashboards and alerts for critical metrics (CPU, memory, disk I/O) with notification channels to PagerDuty or Slack.
- Implement log-based metrics to track application-specific KPIs, such as HTTP 5xx error rates or database query latency.
- Establish backup and disaster recovery runbooks using Cloud Storage lifecycle policies and cross-region replication.
- Conduct post-migration performance benchmarking to validate SLA adherence and identify tuning opportunities.
- Rotate service account keys and audit key usage patterns to minimize long-term credential exposure risks.