On-premise, cloud or hybrid: choosing an infrastructure model based on constraints
A situation where the hasty migration of a monolithic transactional system to a public cloud leads to a critical increase in data transfer latency and an avalanche-like rise in operating costs forces CIOs to urgently plan reverse repatriation to their own hardware.
The choice between on-premise servers, public cloud and a hybrid model is often driven by fashion rather than architectural analysis. For organisations in finance and public administration, a mistake in this choice means not just a budget overrun, but also a risk of compliance violation. To build a resilient infrastructure, digitalisation leaders must rely on clear criteria for assessing application dependencies and security requirements.
Basic coordinates of infrastructure: NIST classification as a design foundation
To build a rational architecture, it is necessary to return to fundamental definitions. The US National Institute of Standards and Technology (NIST) in document SP 800-145 defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.
The NIST model encompasses five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service) and three service models: Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). The word "cloud" on its own does not define a single architecture, so comparison must begin with a clear distinction between four deployment models.
- On-premise infrastructure Complete control over physical and virtual layers, high initial capital investments, but predictable cost of ownership under stable workloads.
- Private Cloud Implementation of cloud characteristics on dedicated resources of the institution, ensuring a high level of security and compliance with strict internal regulations.
- Public Cloud Maximum scalability and elasticity without capital expenditures, where resources are dynamically allocated among many independent tenants.
- Hybrid Cloud Combining two or more deployment models that remain unique entities but are bound together by data and application portability technologies.
Strategic planning with Microsoft Cloud Adoption Framework
Transitioning to any deployment model is not a purely technological decision. According to the Microsoft Cloud Adoption Framework (CAF) methodology, an adoption strategy must align business goals with measurable outcomes and standards by which workload teams operate.
Architectural choice must be based on a comprehensive analysis that includes explicit considerations of cost efficiency, resilience, security and sustainability. Instead of reducing the decision to a single technological preference, CAF recommends evaluating each business workload individually, determining its criticality to the organisation, availability requirements and impact on operational processes.
Portfolio analysis using AWS methodology and system rationalisation
To structure migration processes and avoid chaotic system transfers, the AWS approach to portfolio analysis and migration planning is used. The main goal of this phase is to establish a reliable baseline of applications and infrastructure, including dependency assessment, a rationalisation model and a migration wave plan.
The expected outcome of the assessment is a distinct strategy for each application, a detailed business case and a high-confidence migration plan. This allows the system portfolio to be divided into phases, minimising risks to the institution's critical business processes. A common mistake when comparing the cost of on-premise and cloud infrastructures is comparing only the price of renting virtual resources with the cost of purchasing physical servers. An objective assessment requires using the Total Cost of Ownership (TCO) formula, which accounts for capital (CapEx) and operational (OpEx) expenses throughout the entire lifecycle of the systems.
| Cost category | On-premise model | Cloud model |
|---|---|---|
| Capital expenditure (CapEx) | Purchase of servers, SAN/storage, network equipment, software licences, server room upgrades. | Usually absent or minimal (e.g. specialised local network equipment). |
| Operating expenditure (OpEx) | Electricity, cooling, space rental, hardware technical support, administration, physical security. | Monthly fee for consumed resources, traffic transfer costs, provider support, cloud administration. |
| Hidden variables | Equipment depreciation, disposal costs, risk of downtime due to spare parts delivery delays. | Egress traffic fees, API request costs, backup and geo-redundancy expenses. |
Designing a hybrid environment: Google Cloud patterns
When portfolio analysis results indicate that a complete migration of systems to the cloud is impossible or impractical, architects apply a hybrid approach. According to the Google Cloud Architecture Center classification, hybrid and multi-cloud architectures are implemented through repeatable design patterns tailored to specific constraints.
Google divides these patterns into two main categories: distributed and redundant. In distributed patterns, system components run in environments best suited for them (for example, the database core remains on-premise, while analytical modules function in the cloud). In redundant patterns, identical components are deployed in multiple environments to scale capacity or increase resilience. To describe any pattern, an architect must clearly define the components, their functions and how they interact through standardised interfaces or APIs.
For the successful implementation of distributed patterns, it is critically important to use a flexible technological core. For example, the UnityBase platform, on which IQusion solutions are built, is developed as a cross-platform low-code tool. Thanks to support for industrial DBMS and built-in security features, systems on UnityBase operate effectively both in closed local environments of government institutions and in scalable hybrid architectures, ensuring reliable interaction of components via APIs.
Economics and regulatory filters in the public and financial sectors
For organisations operating in regulated industries, the technical and financial benefits of cloud solutions must pass through a sieve of regulatory constraints. Analysis of the regulatory framework must take into account the specifics of information protection, database residency requirements and rules for the use of cloud services by government institutions.
In particular, architects must rely on the requirements of the Law of Ukraine "On Information Protection in Information and Communication Systems" and Resolution of the Cabinet of Ministers of Ukraine No. 85, which define the procedure for processing state resources. These regulatory acts form a rigid framework that often dictates the choice of on-premise or private infrastructure instead of public clouds for critical systems.
- Technical protection of information (TPI) Requirements for creating comprehensive information protection systems (CIPS) with an appropriate level of assurance for state information resources.
- Personal data protection Restrictions on cross-border transfer and storage of personal data of Ukrainian citizens outside the national jurisdictional boundary.
- Banking secrecy Strict requirements of the National Bank of Ukraine regarding access control to data constituting banking secrecy when using cloud services.
- Critical infrastructure Special regulations for critical infrastructure facilities that restrict the use of public cloud services for managing technological processes.
A rational choice between on-premise, cloud and hybrid is always the result of a compromise between data transfer latency requirements, the level of control over infrastructure, total cost of ownership and regulatory constraints. Only a detailed application portfolio analysis and clear design of hybrid patterns allow for building a resilient IT infrastructure that meets the strategic goals of the organisation.
Frequently Asked Questions
How to avoid unpredictable costs when calculating TCO for cloud infrastructure?
To calculate TCO accurately, it is necessary to include hidden variables in the model: egress traffic fees, API request costs, backup, geo-redundancy and cloud environment administration expenses, rather than just the basic cost of renting computing power.
In which cases is it advisable to apply a distributed hybrid pattern?
A distributed pattern is optimal when different components of a single system have incompatible environment requirements. For example, when a database core must remain on-premise due to strict regulatory requirements for information protection, while analytical modules require elastic cloud resources.
Which regulatory acts define the boundaries of cloud service usage in the public sector of Ukraine?
The key documents are the Law of Ukraine "On Information Protection in Information and Communication Systems" and Resolution of the Cabinet of Ministers of Ukraine No. 85. They require the creation of a comprehensive information protection system with an appropriate level of assurance for state resources, which often dictates the choice of on-premise or private infrastructure instead of public clouds.
