4.4Cloud and edge

When migrating a business system to the cloud, a network designer faces a chain of decisions: not just "which service model to use," but "how to connect on-premises and the cloud (dedicated connection or VPN)," "how to partition the cloud's virtual network," and "where to run latency-sensitive processing (in the cloud or at the edge)." This section teaches the perspective needed to design on-premises/cloud connectivity based on requirements such as latency tolerance, security, and cost.

4.4.1IaaS/PaaS/SaaS and cloud connectivity

• IaaS (Infrastructure as a Service) provides infrastructure—virtual servers, storage, networking—as a service, with the user managing everything from the OS up. PaaS (Platform as a Service) additionally provides the OS and middleware, letting the user focus solely on implementing the application. SaaS (Software as a Service) provides the application itself as a service, with the user only configuring and using it. The scope the user must manage narrows in the order IaaS -> PaaS -> SaaS.
• Connections between on-premises and the cloud fall broadly into dedicated connections (a physical leased line, wide-area Ethernet, or similar link directly into the cloud provider's data center, bypassing the public Internet) and VPN connections (an IPsec tunnel over an Internet VPN). A dedicated connection offers bandwidth guarantees, low latency, and high security but costs more and takes longer to provision, while a VPN connection is quick and cheap but has a weaker SLA over the public network—the same shape of tradeoff as WAN selection in Section 1.