Stop 13 · Cloud Migration & Multi-CloudTopics · 5/8

Hybrid Cloud Connectivity

In short

Migrations don't happen overnight. For months, your cloud app may still need the database sitting in the old office. Hybrid connectivity is the private road between the two.

Connecting on-premise infrastructure to the cloud during (or permanently after) a migration — using VPNs or dedicated connections from Phase 2 to enable a gradual, lower-risk transition.

The blob character drives a lavender shuttle van between two college buildings and waves.

Think of it like this

Two campuses, one college

A college opens a new campus across town. Classes run in both, so a shuttle bus with locked doors runs between them on public roads. Later, the college buys land and builds its own private road. Faster, steadier, and pricier to set up.

Watch it happen

A cloud app reads the on-premises database over a VPN

Office router

VPN gateway

Cloud VPC

Office DB

IPsec tunnel up

1/5The office router and the cloud's VPN gateway agree on keys. Traffic between them is now encrypted over the internet.

The big ideas

What you need to know

Site-to-site VPN

An encrypted tunnel over the public internet. Quick and cheap to set up, but speed and latency vary.

Dedicated connection

AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect give a private line through a partner. Steadier, costlier, and takes weeks to set up.

No overlapping IPs

If the office and the VPC both use 10.0.0.0/16, routing breaks. Plan address ranges before connecting.

Have a backup path

Teams often keep a VPN as a fallback for the dedicated line, so one failure doesn't cut the link.

See it in code

Walk through the code

hcl

1resource "aws_customer_gateway" "office" {2  bgp_asn    = 650003  ip_address = "203.0.113.10" # office router's public IP4  type       = "ipsec.1"5}6 7resource "aws_vpn_gateway" "vgw" {8  vpc_id = aws_vpc.main.id9}10 11resource "aws_vpn_connection" "office" {12  customer_gateway_id = aws_customer_gateway.office.id13  vpn_gateway_id      = aws_vpn_gateway.vgw.id14  type                = "ipsec.1"15}

1/3The customer gateway describes the office side: its public IP and BGP number.

Terraform for an AWS site-to-site VPN. AWS then gives you a config file to load into the office router.

Save yourself the pain

Common mistakes

Oops

Using 10.0.0.0/16 for the VPC because it's the default, when the office uses it too.

Do this instead

Check the office ranges first and pick a different block for the cloud.

Oops

Running chatty database calls over a VPN and blaming the cloud for slowness.

Do this instead

Every round trip adds latency. Move tightly linked apps and data in the same wave.

Your mission

Draw your hybrid network

~20 min

Quick check

The office network and the new VPC both use 10.0.0.0/16. What goes wrong when you connect them?

Go deeper

1Diagram a hybrid connectivity setup linking an on-premise network to a cloud VPC.
2Learn why hybrid connectivity is often a transitional state during migration, not always permanent.
3Understand the latency and reliability trade-offs of hybrid setups compared to a fully cloud-native one.