How to Manage Multi-Cloud Architecture

Multi-cloud is a reality for 89% of enterprises. Most didn’t choose it — it happened through acquisitions, team preferences, and vendor mandates. The goal isn’t to make multi-cloud perfect; it’s to make it manageable.

---

Service Mapping Across Clouds

Capability	AWS	Azure	GCP
Compute (VMs)	EC2	Virtual Machines	Compute Engine
Containers	ECS / EKS	AKS	GKE
Serverless	Lambda	Azure Functions	Cloud Functions
Object Storage	S3	Blob Storage	Cloud Storage
Relational DB	RDS	Azure SQL	Cloud SQL
NoSQL	DynamoDB	Cosmos DB	Firestore / Bigtable
Data Warehouse	Redshift	Synapse	BigQuery
AI/ML	SageMaker	Azure AI	Vertex AI
CDN	CloudFront	Azure CDN / Front Door	Cloud CDN
DNS	Route 53	Azure DNS	Cloud DNS
IAM	IAM	Entra ID (Azure AD)	Cloud IAM
Monitoring	CloudWatch	Monitor	Cloud Monitoring

---

Step 1: Unified Identity

# Federate identity across clouds using a single IdP

# Azure AD (Entra ID) as the identity provider
# AWS — configure SAML/OIDC federation
aws iam create-saml-provider \
  --saml-metadata-document file://azure-ad-metadata.xml \
  --name AzureAD

# GCP — configure workload identity federation
gcloud iam workload-identity-pools create azure-pool \
  --location="global" \
  --display-name="Azure AD Pool"

gcloud iam workload-identity-pools providers create-oidc azure-provider \
  --workload-identity-pool="azure-pool" \
  --location="global" \
  --issuer-uri="https://login.microsoftonline.com/{tenant-id}/v2.0" \
  --allowed-audiences="api://gcp-federation"

---

Step 2: Cross-Cloud Networking

┌─────────────┐     VPN/Interconnect     ┌─────────────┐
│    AWS      │◄────────────────────────►│   Azure     │
│  VPC        │                          │  VNet       │
│  10.1.0.0/16│                          │  10.2.0.0/16│
└──────┬──────┘                          └──────┬──────┘
       │                                        │
       │         VPN/Interconnect               │
       │    ┌───────────────────────────┐       │
       └───►│        GCP              │◄──────┘
            │  VPC 10.3.0.0/16        │
            └─────────────────────────┘

Network Design Rules

Rule	Why
Non-overlapping CIDR ranges	Routes must be unambiguous
Consistent security groups/NSGs	Same policy everywhere
Centralized DNS	Single namespace resolution
Encrypted transit (IPSec/WireGuard)	Data protection in motion
Bandwidth monitoring	Egress charges are the hidden cost

---

Step 3: Multi-Cloud Cost Management

# Unified cost view across clouds
def monthly_cost_report():
    aws_cost = get_aws_cost_explorer()    # boto3
    azure_cost = get_azure_cost_mgmt()    # azure.mgmt.costmanagement
    gcp_cost = get_gcp_billing()          # google.cloud.billing

    total = {
        "AWS": aws_cost["total"],
        "Azure": azure_cost["total"],
        "GCP": gcp_cost["total"],
    }

    total["Grand Total"] = sum(total.values())

    # Top cost drivers across all clouds
    by_service = sorted(
        aws_cost["by_service"] + azure_cost["by_service"] + gcp_cost["by_service"],
        key=lambda x: x["cost"],
        reverse=True
    )[:20]

    return {"totals": total, "top_services": by_service}

---

Step 4: Workload Placement Strategy

Workload	Best Cloud	Reason
.NET / D365 workloads	Azure	Native ecosystem
Data analytics (BigQuery)	GCP	Price-performance
ML training (spot GPUs)	AWS/GCP	GPU availability
Kubernetes (managed)	GCP (GKE)	Best K8s service
Serverless (event-driven)	AWS (Lambda)	Most mature
Microsoft 365 integration	Azure	Native SSO/Graph
General compute	Any	Compare pricing

---

Multi-Cloud Checklist

• Identity federated through single IdP
• Cross-cloud networking established (VPN/Interconnect)
• Non-overlapping CIDR ranges across all VPCs
• Unified cost dashboard deployed
• Workload placement strategy documented
• Infrastructure-as-Code (Terraform) for all clouds
• Centralized logging and monitoring
• Security policies consistent across providers
• Egress costs monitored and optimized
• DR strategy tested across cloud boundaries

---

:::note[Source] This guide is derived from operational intelligence at Garnet Grid Consulting. For cloud architecture consulting, visit garnetgrid.com. :::