Deployment models: public, private, hybrid, multi-cloud

1. Four NIST models #

The criterion: who owns and who uses the infrastructure?

Overview #

2. Choosing your model #

A pragmatic decision tree.

Criteria #

• Data sensitivity: regulated data (healthcare, finance) → private or qualified cloud (SecNumCloud, HDS).
• Load variability: large peaks → public (elasticity); stable, predictable load → private is often cheaper.
• Latency and location: proximity to users, edge computing.
• Skills: running a private cloud requires a platform team.
• Reversibility: avoid lock-in with open standards (Kubernetes, Terraform, OpenTelemetry).

3. Connecting private and public (hybrid) #

Connectivity and identity.

The technical building blocks #

# VPN site à site vers AWS (exemple Terraform)
resource "aws_vpn_gateway" "vgw" { vpc_id = aws_vpc.main.id }
resource "aws_customer_gateway" "onprem" {
  bgp_asn    = 65000
  ip_address = "203.0.113.10"
  type       = "ipsec.1"
}
resource "aws_vpn_connection" "site2site" {
  vpn_gateway_id      = aws_vpn_gateway.vgw.id
  customer_gateway_id = aws_customer_gateway.onprem.id
  type                = "ipsec.1"
  static_routes_only  = true
}

4. Multi-cloud: promises and pitfalls #

Using several providers.

Putting it into practice #

# Un même code Terraform, deux fournisseurs
terraform init
terraform workspace new aws && terraform apply -var provider=aws
terraform workspace new azure && terraform apply -var provider=azure

# Un même cluster Kubernetes, plusieurs contextes
kubectl config get-contexts
kubectl --context aks-prod get nodes
kubectl --context eks-prod get nodes

Common mistake: Multi-cloud is not a guarantee of availability: it multiplies skills, data transfer costs and the security surface. Justify it with a real need (regulation, resilience, negotiation).

Good practice: Focus on portability (containers, IaC, open standards) rather than systematically duplicating every service.