devopsy.kinsta.cloud

Tag: cost optimization

  • Why Multi-Cloud Cost Optimization is Harder Than it Looks

    Why Multi-Cloud Cost Optimization is Harder Than it Looks

    If your business is like most businesses that use the cloud today, you’ve gone multi-cloud. Nine out of 10 large companies have already adopted multiple clouds, and IT analysts expect that even more businesses will embrace multi-cloud architectures over the next several years. Now, the challenge facing those companies is how to optimize spending across multiple clouds. Many will find that, despite common narratives suggesting that cost savings are an inherent benefit of multi-cloud architectures, reducing spending when using multiple clouds can be a lot harder than it looks.

    This is, fortunately, a challenge that can be conquered easily enough. Keep reading for tips on updating your cloud cost optimization strategy to support multiple clouds.

    Multiple Clouds Don’t Guarantee Reduced Cloud Cost

    Before diving into strategies for reducing spending when using multiple clouds, let me dispel a common myth about the relationship between multi-cloud architectures and spending.

    Contrary to popular belief, using multiple clouds doesn’t guarantee that your business will spend less overall in the cloud, or even make it very easy to do so. Although advocates of multi-cloud strategies often promote the idea that using multiple clouds makes it simpler to find the most cost-effective cloud services because you have a larger menu of offerings to choose from, the reality is that cost-saving is not a common outcome of going multi-cloud.

    Sure, in theory, having multiple clouds does give you more opportunities to reduce costs. But in actuality, migrating workloads between clouds typically takes significant time and effort. Given that most mainstream cloud services–like VM hosting and object storage–have been commoditized to the point that there are rarely major pricing differences between them, few businesses are actually going to migrate workloads back and forth between clouds on a frequent basis in order to save a few dollars.

    To Reduce Multi-Cloud Spending, Focus on Cloud Provider Relationships, not Workloads

    That said, adopting a multi-cloud strategy does place you in a position to reduce overall spending–but it’s not because you can migrate workloads between clouds. It’s because you can leverage relationships with multiple cloud providers to negotiate pricing reductions.

    If your teams are actively using multiple clouds, you have a strong ability to negotiate enterprise pricing deals with the providers of each of those clouds. Each provider that you work with will be eager to earn as much of your business as possible, and if they know that your company is already also using a competitor’s platform, they’ll probably be more forthcoming with discounts in exchange for a commitment on your part to run more of your workloads on their cloud.

    How to Keep Multi-Cloud Cost-Efficient – but Also Flexible

    The caveat is that if you want to retain the flexibility that a multi-cloud architecture nominally provides, it’s important not to over-commit to any single cloud provider. If you do, you may find yourself locked into one cloud for certain workloads due to pricing discounts that you’ve negotiated for those workloads with that cloud provider.

    An effective approach for finding the right balance between pricing discounts and flexibility is to decide which percentage of your overall cloud spending you want to avoid tying to a particular cloud. For example, you might decide that it makes sense to commit 30% of your spending to one cloud provider and 30% to another in exchange for pricing discounts that negotiate with each provider. But the remaining 40% of your cloud spending won’t be linked to enterprise agreements with cloud providers, so you’ll be free to spend it in whichever cloud you like.

    Maintain Workload Portability to Minimize Multi-Cloud Spending

    As you work to optimize multi-cloud spending, strive to adopt portable workload technologies, like containers in place of ones that are harder to migrate between clouds, like VMs.

    This is important not just because portable technologies help to maximize the flexibility of your multi-cloud strategy, but also because they give you more leverage when negotiating with cloud providers. The providers realize that some types of workloads are harder to migrate than others, and they’re less likely to offer serious pricing discounts if they know it’s going to be very difficult for you to move your workloads to a competitor.

    But if you can say, “70% of what we deploy runs in Kubernetes and can migrate from your managed Kubernetes environment to your competitor’s offering next week,” you’re in a much stronger negotiating position.

    Conclusion

    In short, don’t assume that simply adopting a multi-cloud architecture will yield enormous cost savings just because you can easily move workloads from one cloud to another to take advantage of pricing differences. In most cases, you can’t.

    What you can do, however, is leverage your relationships with competing cloud providers to negotiate discounted enterprise pricing agreements. And the more portable your workloads are, the better able you’ll be to obtain serious cost savings while simultaneously enjoying the flexibility and agility that multi-cloud architectures stand to offer.

  • Optimizing Cloud Costs for DevOps With AI-Assisted Kubernetes

    Optimizing Cloud Costs for DevOps With AI-Assisted Kubernetes

    As indicated in my prior blog, Optimizing Cloud Costs for DevOps With AI-Assisted Orchestration, an AI-assisted Kubernetes orchestrator is needed to optimize cloud costs for DevOps, DevSecOps and SRE. This blog describes the landscape for cloud-native optimization approaches and a features requirement blueprint for an AI-assisted Kubernetes orchestrator. The blog also describes a roadmap for implementing an AI-assisted Kubernetes orchestrator and the benefits of a solution using an AI-assisted Kubernetes orchestrator.

    Cloud-Native Optimization Approaches Landscape

    As indicated in the article Tricks for Cloud Cost Optimization, “Cloud cost optimization (CCO) is a technique of running cloud-native applications effectively, at minimal possible cost, without affecting the health of the services.” The most typical approaches are variants of the following:

    • Rightsizing pre-paid, fixed and reserved instances: Cloud service pricing models are intended to fit your application and business needs with the hundreds of choices available from cloud service providers. This approach can be cost-efficient when application and business needs are constant over time. However, this approach is not sufficiently cost-efficient for many applications and business needs that are constantly changing, such as use cases for DevOps, DevSecOps and SRE.

    • Spot instances can offer low cost-per-instance, but reliability is not guaranteed because the cloud provider can interrupt these services anytime. Unless the use of spot instances is limited to workloads that do not require a high level of reliability, this approach is limited. This approach does have the potential to have a broader application if a smart management layer is implemented to orchestrate the use of the spot instances.

    • Pay-as-you-go offerings by cloud service providers, used together with infrastructure-as-code (IaC) and auto-scaling, can help save on cloud costs. This approach facilitates the automatic spin-up of resources when needed and automatic shutdown when not needed. However, to realize the benefits of this approach requires constant supervision of cloud usage and manual adjustments to realize the benefits. Businesses may not even be aware of the resource scaling until the monthly bill arrives.

    • Cloud auto-stopping of entire applications and clusters can help to manage cloud resources automatically to ensure that they run only when needed, never when idle. This approach is not granular enough to sufficiently reduce costs for rapidly fluctuating resource needs for DevOps, DevSecOps and SRE use cases.

    • Manual cloud costs management, in which team members are taught to understand their own cloud spend and cloud cost management practices, can help reduce costs. However, this approach is subject to human involvement, is slow and generally does not provide granular controls needed to sufficiently deliver cloud cost savings 24/7.

    None of the traditional cloud cost optimization approaches described above have the requisite smarts, speed or granularity to sufficiently optimize the highly dynamic requirements for DevOps, DevSecOps and SRE use cases. An AI-assisted orchestration approach, when supported with the right features, can make up for the deficiencies of the typical optimization approaches.

    Features for AI-assisted Kubernetes Orchestrator

    As indicated by CAST AI an AI-Assisted Kubernetes orchestrator needs the following features:

    • Easy to start – It should take less than five minutes to fully onboard a cluster.
    • Easy to use – The orchestrator should abstract layers of complexity, so little knowledge is needed to use it other than a basic knowledge of running Kubernetes clusters in a public cloud. For example, a working knowledge of the kubectl command line utility for creating and managing Kubernetes clusters.
    • SaaS configuration – Avoids the need to host and manage the orchestrator itself.
    • Autoscaler policies – Define threshold values and upper bounds so instances are automatically added or removed as per the policy.
    • Cloud Support for AWS EKS, GCS GKS, Azure AKS and kOps clusters
    • Reports to monitor and track cost savings for each cluster.
    • Features to optimize each cluster.
    • High availability to ensure the orchestrator itself is not a failure point.
    • Collect and analyze each cluster configuration to provide the most optimal setup along with a savings estimation for the current cloud environment.
    • Security – Detect and monitor K8s vulnerabilities and configuration issues.

    Roadmap for Implementing AI-Assisted Kubernetes Orchestrator

    According to the article Roadmap To Cloud Cost Optimization, organizations need to understand that they need to deploy cloud computing the right way. This not only paves way for the actual digital transformation but is even instrumental to cloud cost management.”

    The article Top 3 Issues in Kubernetes Cost Management indicates, “Teams cannot manage and monitor Kubernetes’ costs without having the right tools in hand. No doubt, you can collect all the data yourself and create the right solutions. It wouldn’t be easy to modify these solutions if changes are required.” The speed of change with DevOps, DevSecOps and SRE is not compatible with the typical tools.

    A good example AI tool, CAST AI, indicates how easy it can be to onboard a Kubernetes cluster. First, connect your Kubernetes cluster to CAST AI and see how much you can save by optimizing cluster configuration. After exploring the available savings and cost reports, you can onboard the cluster into CAST AI and set the Autoscaler policies, which will manage the cluster for you. It takes less than five minutes to fully onboard a cluster.

    Benefits of Solutions Using AI-Assisted Kubernetes Orchestrator

    An AI-assisted cloud orchestrator can provide the following benefits.

    • Spot instance automation
    • Spot instance fallback
    • Real-time autoscaling
    • Instant rebalancing
    • Visibility into cloud usage and costs
    • Avoids over-provisioning
    • Cloud resources are not left idle
    • A consistent approach between teams and departments
    • Reduce monthly average cloud spend by up to 60%

    Summary

    The prior blog Optimizing Cloud Costs for DevOps With AI-Assisted Orchestration explained why an AI-assisted Kubernetes orchestrator is needed to optimize cloud costs for DevOps, DevSecOps and SRE. In this blog, specific requirements for such an AI-assisted Kubernetes orchestrator was explained using CAST AI as an example. The steps to onboard a cluster to the AI tool was explained.

  • How FinOps Can Optimize Cloud Costs and Drive Innovation

    How FinOps Can Optimize Cloud Costs and Drive Innovation

    Two mainstays drive most application migration and modernization initiatives. First, organizations are moving workloads to the cloud as an innovation catalyst. Achieving their strategic goals requires the speed, agility, reliability and advanced technical capabilities available to them in a hyperscale cloud.

    Second, they’re intent on ensuring the return on investment (ROI) through cost optimization, which is different from the abstract “cost savings” that was part of many early cloud pitches. It’s a recognition that attaining ambitious strategic goals depends on ruthless attention to the bottom line. Cloud enables the capabilities described above not just by making them available at the click of a button but via a finance and business model far more palatable to CFOs and boards than if the company were to build everything in their own data centers – including the data centers themselves.

    Cloud Usage Costs

    Therein lies a fundamental problem—and one of the major application modernization trends we’re seeing in 2022: Cost optimization in the cloud is far more challenging than many organizations first expect. And as cloud use bills balloon, the costs begin to undermine the benefits of migrating there in the first place.

    Identifying cost savings in the cloud isn’t really the problem. Doing so isn’t easy, per se, but there are various ways to go about it—such as changing a storage type, instance type, or retention policy, among many possibilities.

    Implementing those cost savings is the real issue. Companies know where and how to optimize utilization and spending but struggle for various reasons to make the changes needed to realize these gains. This challenge is why we’re seeing the growth of FinOps in 2022. FinOps is the culture and practice of creating visibility and accountability to manage cloud spend throughout an organization.

    FinOps responds to two significant problems that hinder cloud cost optimization measures.

    The first is conflicting incentives. The IT team or a consultant or managed services provider may identify opportunities for saving money in a company’s cloud bill, but that same IT team—the ones typically responsible for the “keyboard work” needed to implement the changes—may not truly own the application in question. Moreover, the business unit or team that does own the application may not, in fact, have any financial accountability for the infrastructure that powers that app. They don’t have any skin in the game and are often reluctant to approve changes especially if the app is meeting their performance goals.

    Second, many organizations migrate to the cloud only to realize they lack dependable visibility into how they are allocating costs in their new environment. A CFO or even CIO with a multi-million-dollar cloud spend may have very little visibility into who in their organization is spending that money—much less why they’re spending that money.

    These are significant issues that can spiral into runaway cloud bills—and ultimately suffocate the business value that the cloud was supposed to unlock in the first place.

    FinOps is to Dollars What DevOps is to Code

    Enter FinOps: FinOps is to dollars what DevOps is to code. It is essentially about driving awareness of cloud spending throughout a business, from C suite to a junior developer. In doing so, FinOps makes possible the kinds of cost optimizations required to attain the cloud’s transformative potential.

    Just as DevOps fosters values like shared responsibility and visibility (without playing the blame game) to sustainably increase development velocity, systems reliability, and other priorities, the FinOps framework brings a similar approach to cloud resource utilization. DevOps is ultimately concerned with that first mainstay cloud goal I described above: Achieving speed, agility, reliability, etc. FinOps focuses on the second mainstay: Cost optimization.

    In this way, FinOps is becoming a vital trend in application modernization because you cannot have innovation without cost optimization. (If you think otherwise, invite your CFO to lunch and see how they feel about it.)

    FinOps engenders cost optimization in various ways, but there are two key facets I’ll highlight here. The first is that FinOps culture and practices typically entail implementing “showbacks,” a system that clarifies who is using (read: spending) what in the cloud.

    Showbacks take some time to set up—they involve things like resource labeling and tagging and creating a reporting structure, for example—but are well worth it. They form the foundation of shared visibility into resource utilization and spending. With showbacks in place, you can see who is spending what and optimize accordingly. For example, you might discover a business unit that uses a high percentage of overall spend for a relatively low percentage of revenue. There might be a good reason for that, but you may have uncovered an opportunity to reduce spending if not.

    Chargebacks are the second phase, in which application owners, teams and business units – virtually any org structure can work here – become directly responsible (via their budget) for their cloud spending. With showbacks and chargebacks, you have visibility. You can also reduce or eliminate misaligned incentives since there is more granular control and responsibility for spending down to the engineering level if desired.

    It can even create healthy competition among cross-functional teams or the broader organization—who can decrease their spending the most, who has the best spend-to-income ratio, etc. At 2nd Watch, we use an “innovation score” model to assess cloud spending in a client’s organization, for example, that factors costs into the overall score.

    FinOps enables everyone to speak the same language, not just about cloud but about cloud spending.

    It’s worth noting that the showbacks and chargebacks aren’t new concepts at all. Yet we’re seeing growing interest in them in the industry—and a corresponding increase of tangible goals attached to implementing them, such as “implementation of showbacks and chargebacks by Q1 2023.”

    This is a reflection of the FinOps movement—and the fundamental necessity of optimizing cloud costs.

    You don’t have to call it FinOps, but you do have to address how you allocate and use your resources in the cloud. All of the cloud’s good stuff—the outsized benefits and business value it creates—depend on it.

  • How Observability Can Improve Gaming

    How Observability Can Improve Gaming

    Competing in the gaming industry is becoming increasingly costly. To attract new players, millions of dollars are spent in user acquisition (UA), development and cloud infrastructure. As the space becomes more expensive, revenue and cost optimizations can become a matter of survival. 

    The cost to businesses because of server outages, game response lag or generally poor performance can equate to billions of market cap of gaming companies. The value of observability in modern games is about ensuring that revenue opportunity is not missed in a costly operating landscape. Observability assures that all investment spent on user acquisition is protected and that gaming user experience (UX) is maximized. And user experience depends not only on how the game’s UI is performing but also on the entire gaming environment performance and reliability.

    A modern gaming environment is usually highly distributed—a lot of pieces have to come together. The engineering team develops code for the gaming application, which can consist of many microservices, containers, managed cloud services, third-party APIs and serverless functions. Game designers create game levels, the art team produces visual effects and animations and the audio department creates game audio. Once these moving parts are packaged together, the game service has to be deployed on cloud infrastructure and the game itself shipped as executables for consoles, mobile devices and laptops.

    gaming observability

    All these elements generate massive amounts of observability data, particularly if a game is popular and played by millions of users. Thus, making sure that all gaming elements are working as expected means that gaming companies have to implement efficient ways of collecting and analyzing the massive amounts of that data. That data comes from gaming services, consoles and other sources in real-time. For instance, it is not uncommon to deal with hundreds of terabytes of ingested log data per day. As a result, improving the gaming experience can be quite challenging for gaming companies with large-scale operations. The companies’ success depends on how efficiently they can harness all the data generated by gaming environments.

    This is where observability comes in. Observability provides critical insights into what is—or what may be—wrong with the game, all its moving parts and user experience. Powerful observability capabilities are essential, including processing vast amounts of data (logs, metrics, traces, etc.) in real-time, managing fluctuating observability data from variable user loads and running concurrent real-time queries on a massive scale.

    So, what, exactly, needs to be measured for a great gaming user experience?

    Measuring the Gaming User Experience

    Gaming companies are under continuous financial pressure to deliver new features that attract and retain new users in order to offset mounting operating expenses. Attracting new users is a balancing act from the gaming companies’ perspective. If they move too slowly, they will lose gamers. If they move too quickly, the gaming user experience can deteriorate due to newly introduced bugs. Gamers can be very vocal on social networks, especially if their intent is to express their dissatisfaction with compromised gaming quality. As a result, companies are forced to balance the rate of feature introduction with user satisfaction. That’s why they need to measure user experience continuously.

    To improve gaming user experience, gaming organizations must establish measurable key performance indicators (KPIs), which can drive improvements and overall quality. KPIs include, but are not limited to: 

    • User video quality (frames per second)
    • Memory usage
    • Crash reports count
    • Database performance measurements
    • Service latencies 
    • User request count
    • Game-specific errors and warnings count
    • Code quality measurements, such as automated test coverage success criteria (a part of the CI/CD pipeline)

    Monitoring Service Latency for a High-Quality Gaming Experience

    Gaming applications are often bursty when it comes to user load, especially during the introduction of new games or new features. One of the critical indicators to monitor is service latency to manage fluctuating user demand during those times. 

    DevOps teams and SREs need to collect logs at a massive scale to analyze the performance of services, infrastructure and individual host utilization metrics such as high CPU utilization. This information gives engineers clues about the sources of bottlenecks and potential deterioration related to service latency. And logging tools need to be able to deal with this fluctuating demand, too. This level of insight into the state of the gaming application helps engineers troubleshoot issues before gamers face increased service latency that can impact their gaming experience.

    Analyzing Game-Specific Observability Data

    Game developers can create custom logs and metrics and combine those with observability data from the gaming engines. Both must be analyzed to assure a high-quality user experience. Some of the common gaming data parameters available for analysis are:

    • Log data that indicates when a player joins and leaves the game (associated with the player’s name)
    • The location of a player reported at specified times
    • Logs related to significant gaming events associated with each player (such as goals achieved or actions performed)
    • Logs related to chat messages between players, player location, the time when the message was generated and message context

    The more data collected, the better the chances to understand any issues that can turn players away from the game. Observability data management should evolve in parallel with game development. As new features are added, the code should be instrumented with KPIs to ensure the quality of the newly introduced code in the long run.

    Database Performance Monitoring is Critical for Gaming User Experience

    To store time-sensitive gaming data, DevOps teams must use fast databases. The database performance and how fast the game’s properties are retrieved from a database directly impact user satisfaction. Slow database performance negatively affects the gaming user experience. For DevOps teams to avoid any service issues, it is a must to measure key database performance indicators such as response times metrics, out-of-memory error logs and others.

    Fast databases could be expensive in the extremely competitive market where gaming companies are always looking for cost optimization to survive in the business. It’s non-trivial for DevOps teams to monitor user experience related to database performance and, at the same time, to look for ways to optimize the cost of fast databases.

    Build a Pipeline and Delivery Monitoring

    For a large-scale video game, new code is often pushed many times per day. Builds can be significant and deployed across many gaming consoles and end devices. Continuous build pipeline and delivery monitoring are crucial for frequent and commonly large software deployments.

    With large builds deployed daily over the network to thousands of gaming platforms—where each platform receives a massive amount of data—monitoring of build deployments should be automated. Errors from log data should trigger alerts and drive redeployments. QA automation is necessary to reduce the burden of QA efforts and make build deliveries less error-prone and less tedious. 

    Better Observability Improves In-Game Commerce

    Insights into user behavior are as important as monitoring possible issues affecting user experience. Observability tools can provide key insights into the overall engagement of all game users. High engagement then drives more excitement. Higher user excitement may increase the success of ad campaigns and accelerate in-game purchases.

    Observability Tools for Managing Gaming Experience

    When thinking about observability tools that can be instrumental in driving continuous improvement of user experience in the gaming industry, the following functionalities are important:

    • Ability to ingest and analyze log data at petabyte-scale and beyond in real-time to avoid gaming experience deterioration.
    • Zero-schema and ability to accept observability data in various formats from various gaming platforms, cloud servers, gaming consoles, and mobile devices. Because gaming environments use different third-party software packages, logs may come in many formats.
    • Ability to create alerts on collected observability data. Alerting can improve user experience by monitoring properties such as the number of active users experiencing client errors. 
    • Capability to handle backpressure when critical issues occur is essential. An alert storm can clog the data pipes, and the observability tool can be in the dark for hours unless it is designed to cope with backpressure.
    • Ability to collect data from build pipelines to monitor frequent and commonly large software builds being deployed daily over the network to numerous gaming platforms.
    • Capability to collect data from cloud environments such as cloud infrastructure monitoring. 

    Observability is key to protecting gaming revenue opportunities and assuring the success of video games, as long as you know what to look for in observability tools that are used to gather data from gaming environments.

  • 5 Ways to Detect Application Security Vulnerabilities Sooner to Reduce Costs and Risk

    5 Ways to Detect Application Security Vulnerabilities Sooner to Reduce Costs and Risk

    Security testing has always been an important step in the application development process. Yet, traditional measures often occur too late in the process to effectively find and fix vulnerabilities before causing costly production delays, or worse, putting organizations at risk for potential security breaches.

    To minimize security-related costs and risks, testing needs to occur sooner and more frequently throughout the development process. But, how can you accomplish this while keeping pace with growing application development demands?

    Looking at automation can help. Development teams have been using automation to streamline manual activities such as build, deployment and functional testing for years now, and it is time security testing joins the mix. By integrating automated security validation into the continuous integration/continuous development (CI/CD) pipeline, you can catch vulnerabilities sooner, reducing the potential risk and financial impact.

    In this article, we’ll look at five ways automated technology tools can help safeguard the CI/CD pipeline: SAST, detecting OSS vulnerabilities, identifying compromising credentials, DAST and verifying cloud infrastructure security.

    Your CI pipeline provides a ready-made check-in point to install the following automated security gates and pinpoint vulnerabilities.

    Static Application Security Testing (SAST)

    SAST provides the earliest check-in opportunity, allowing you to identify potential issues at the coding stage, so you can resolve problems without breaking builds or allowing vulnerabilities to get passed to the final application release.

    Commercial solutions such as Checkmarx help to identify hundreds of security vulnerabilities and weaknesses in custom code. You can also leverage many open source linters for your specific platforms to detect various vulnerability patterns that can compromise code security.

    Detecting Open Source Software Vulnerabilities

    Just because the code is secure doesn’t mean the entire application is protected. Most applications use a large number of dependencies, or third-party open source software (OSS) components. These may have various security vulnerabilities and put your application at risk.

    Tools such as Whitesource Bolt and Black Duck can scan all of your projects, not only to detect OSS components, but also identify and provide fixes for any known vulnerabilities. 

    Identifying Compromising Credentials

    Human error is always a security concern, especially when it comes to credentials. Just consider how many times you’ve heard of developers committing code only to later realize they’d accidentally included a password. These errors can lead to high-cost consequences for organizations.

    There are many tools that scan for secrets and credentials that can be accidentally committed to a source code repository. One example is Microsoft Credential Scanner (CredScan). Perform this scan in the PR/CI build to identify the issue as soon as it happens so they can be changed before this becomes a problem.

    Once an application is deployed, you can continue to scan for vulnerabilities through the following automated continuous delivery pipeline capabilities.

    Dynamic Application Security Testing

    Unlike SAST, which looks for potential security vulnerabilities by examining an application from the inside—at the source code—Dynamic Application Security Testing (DAST) looks at the application while it is running to identify any potential vulnerabilities that a hacker could exploit.

    OWASP Zed Attack Proxy (ZAP) is an open source tool for performing pen testing on web applications and APIs. Pen testing helps ensure that there are no security vulnerabilities hackers can manipulate. It can be installed as a client application or come configured on a docker container. OWASP ZAP scans can be incorporated into your pipeline to check every deployment for security vulnerabilities.

    Verifying Cloud Infrastructure Security

    Finally, in addition to validating the application, the infrastructure should be validated to check for vulnerabilities. When using a public cloud, deploying the application and shared infrastructure is easy, so it’s important to validate that everything has been done securely.

    Each public cloud includes tools to help verify that the infrastructure has been provisioned securely. APIs can be leveraged to check immediately after deployment in lower environments to help ensure any infrastructure security issues are caught before they get to production. Additionally, tools such as InSpec provide compliance-as-code to enforce the intent of provisioned infrastructure is always being met.

    Enabling continuous security validation through the CI/CD pipeline can help fortify applications against an expanding array of security threats that can lead to significantly higher costs and exposure. At the same time, automation tools can provide added layers of protection while meeting the organization application development demands.

  • How to Leverage Elastic Services for Cost Optimization

    How to Leverage Elastic Services for Cost Optimization

    Due to the current pandemic, business continuity for many organizations has suffered a great deal. Organizations, primarily those in manufacturing, agriculture, transport, hospitality, energy and retail sectors, have been affected by the unanticipated change in the business landscape. Some companies in these sectors have been experiencing massive losses in revenue, which is why their primary requirement at this point is cost reduction.

    The other side of the crisis is that organizations in sectors such as medical, government and financial services, which are providing essential services, have experienced higher operational demands than usual–again leading to increased operational costs. Irrespective of the industry you belong to, and whether it is experiencing reduced or increased operations, cost optimization is a reality for you to ensure a sustained existence.

    One of the most reliable measures for cost optimization at this stage is to leverage elastic services designed to grow or shrink according to demand, such as cloud and managed services. For example, a well-positioned organization with a cloud native architecture can scale up or scale down cloud consumption to mitigate lost operational demand. Organizations that employ managed services providers can repurpose full-time staff members from impacted business units or product lines to more strategic initiatives.

    The Need for Cost Optimization: Now and Later 

    From observations of the economic impact of the crisis, many organizations have not been well positioned or in a state to leverage elastic services during the current crisis. In the absence of a flexible operational model, they are exposed to risks caused by:

    • A sudden disruption in business continuity.
    • Loss of business or revenues.

    To ensure that they are ready, should another disaster strike, companies need to start planning now. Partnering with a seasoned managed services provider to plan and leverage the consumption and subscription services is advisable, so that they can immediately adjust expenditures that are no longer relevant and can prepare for long-term cost reduction to conserve cash.

    Optimizing Costs with Elastic Services 

    One thing that the impact of the pandemic on businesses has made very clear is that investment toward IT strategy and planning services pays in good times, as well as bad times. Therefore, organizations, whether they are experiencing loss or profit at this stage, should consider long-term investment toward IT strategy and planning services, and thoroughly plan the “new normal” expenditures needed to scale demand/revenue.

    Elastic cloud and managed services can help these organizations strike a balance between the rapid changes in the demand and need for expenditure.

    • With consumption services, organizations can choose to pay only for the services and resources they use. 
    • With subscription services, organizations can choose flexible payment terms that often afford advantageous pricing the longer one commits. Choose the timeframe that balances the risk and reward.
    • Since most enterprises will freeze hiring and try to avoid long-term or substantial capital investments at this stage, they can meet their operational demands by contracting managed services and re-platforming their applications to use cloud services.

    The Three-Step Approach to Successfully Implementing Elastic Services 

    Given the requirements of each business are different, and the way they plan their expenditure varies as well, there is no one-size-fits-all strategy to ensure the successful implementation of elastic services for cost optimization. In order to ensure that elastic services help optimize costs in your organization in an efficient manner, you should follow the three-step approach described below:

    1. Discover: First, collect all your operational revenue and expenses over a three-year period. Understand seasonality lows and highs (these are elastic needs). Perform a business-impact-analysis (B-I-A) to understand the critical business processes and then map them to risk scenarios that can cause business disruption. Capture and arrange the risks and then determine how to build a risk mitigation plan with your strategic IT leadership and advisors.
    2. Analyze: Adapt your existing architecture to identify your business goals and how it has changed due to the new circumstances, and then perform a gap analysis and capabilities assessment. 
    3. Plan: Based on your business goals, revisit how and where it makes sense to use elastic services to fit seasonal fluctuation better, and risk scenarios where rapidly declining operational demand may occur.

    Given the pace and scale of how the business landscape is changing, a traditional wait-and-watch response is not going to work in the long run. Engaging with a strategic leadership partner that can help you analyze your current infrastructure and implement elastic services is a smart move to meet your business objectives.

  • Multi-Cloud Cost Optimization For The Enterprise

    Multi-Cloud Cost Optimization For The Enterprise

    Multi-cloud is an increasingly popular approach for deploying enterprise computing assets. But, in the same vein, managing cloud costs has become a huge challenge. Whilst public cloud continues to grow in popularity, there are many factors that can increase a cloud bill that needs to be taken into consideration. A smart cloud cost management strategy certainly helps to avoid any unwanted billing surprises. Enterprises progressing through their cloud adoption need one in place to control their spend.

    The benefits of cloud infrastructure—scalability, control, security, etc.—are easily seen, but there are challenges, too. Perhaps the biggest challenge of cloud cost management is the difficulty that organizations have in tracking and forecasting usage— these uncertain budget costs can be a massive cloud management pain point. The ability to scale up and down on demand has allowed resource procurement to transition from sole ownership of the finance or procurement team to stakeholders across IT, DevOps and others. Procurement is now in the hands of a group of cost-conscious stakeholders who are responsible for understanding, managing and optimizing costs.

    How much will the public cloud cost? You should begin your cloud cost management strategy by looking at the public cloud providers’ billing models—just like any other IT service, the public cloud can introduce unexpected charges. How much storage, CPU and memory do your applications require currently? Which cloud instances would meet those requirements?

    Then, it’s a question of estimating how much those applications would cost in the cloud and comparing these figures to how much it currently costs you to run them on-premise. If you plan to use multiple public cloud providers, integration and other factors can lead to unexpected fees—try and plan application deployments to see where you might be liable for extra costs. 

    Initially, it seems that most vendors offer similar packages and prices—when you examine them in detail however, perhaps one vendor has a much lower price for certain types of workloads. Understand your business requirements before committing to a cloud vendor, and avoid vendor lock-in. Moving workloads from one cloud vendor to another can sometimes be difficult. If you don’t do your due diligence here, it can be subsequently too difficult to migrate applications or workloads after they are in production.

    Confronting Cloud Costs

    You must first identify waste by uncovering inefficient use of cloud resources. Cloud cost management is not a one-and-done process, but you can make a start saving money on your cloud infrastructure costs if you address key areas that account for the majority of wasted cloud spend and budget overruns.

    Visibility

    Ensure teams have the direct ability to see what they are spending. It’s easy to get carried away spinning up services, unless you know exactly what you are already spending. Identify what you have, and who owns it. Tag resources with user ownership, cost center information, product name and others to give you a better handle on where the spend originates. This information can be used to track usage through detailed billing reports.

    Budgeting

    Once you have a handle on what your spend is, set budgets per account. Doing this after establishing a baseline ensures that you are setting practical and realistic budgets that are based on the actual usage. Look to whitelist instance types (RDS & EC2) to only allow instances of specific types, classes or sizes.

    Manage Storage Lifecycle

    Ensure that you are rotating logs and snapshots regularly and backup and remove any storage volumes that are no longer in use. Ensure that you are using only one logging configuration and have added additional ones only when absolutely necessary. Also, ensure that sandbox or trial accounts are only utilized for exploration purposes and for the duration committed.

    Use Containers

    Another technological solution that can help to reduce operating expenses is the use of containers. Often used by IT teams taking DevOps approaches, containers package applications together with all their dependencies, making them easier to deploy, manage and/or migrate from one environment to another. Containers can also be more cost-effective on one hand but can cause more complexity, and therefore increase costs, if built in the wrong way.

    Review Regions

    Prevent staff from provisioning unapproved virtual instances from the marketplace that include software license costs, or from using specific OS or DB engines from vendors with whom you do not have enterprise agreements in place or are too costly to run at scale. Review in which regions you have services running. The cost of services per region can vary as much as 60%. You need to ensure you are balancing the need with running services in a given region with the cost of doing so. You can use instance scheduling to start and stop instances on a planned schedule. Shutting down environments on nights and weekends can help save you 70% of runtime costs. Look to determine which environments need 24/7 availability, and schedule the rest.

    Use a Cloud Cost Management Vendor

    Many organizations decide that tackling these cost optimization chores on their own takes too much time and skill. Instead, they leverage services from reputable cloud cost management vendors. Cloud cost management is one of the major pain points organizations confront when migrating to the cloud—cloud costs are difficult to estimate without some kind of assistance, due to the complexity of cloud infrastructure.

  • Why AWS Cost Optimization Is About More than Saving Money

    Why AWS Cost Optimization Is About More than Saving Money

    Why is it important to track and monitor cloud costs? The obvious answer is it helps you save money—and everyone wants to save money.

    Yet, cost plays a much larger role in your cloud journey. If you think about cost only in terms of how much you are paying and what you are getting in return, then you’re missing much of the value that careful cloud cost control can provide.

    Let’s take a look at all of the reasons why monitoring and optimizing costs is critical for a successful AWS strategy.

    What Is Cost Optimization?

    In AWS and other clouds, cost optimization is the art and science of identifying and addressing inefficiencies in the way you are using resources.

    Those inefficiencies come in many forms. They could be an EC2 instance that offers more resources than you need for a given workload, which could therefore be replaced by a different, less costly instance.

    They could be a result of using one type of application architecture, like workloads running directly on virtual machines, when another, such as serverless or containers, would deliver the same performance for less overall cost.

    They could be caused by failing to take advantage of the best opportunities available for hosting a given workload. For example, you might be using S3 Standard for storage when S3 Glacier would meet your needs just as well, at a lower cost.

    By identifying these sorts of problems, you can take steps to spend less while maintaining the same level of performance for your cloud workloads. A basic best practice is to use tools such as AWS Trusted Advisor to help ensure that your infrastructure is set up in a cost-efficient way from the start.

    Cost Optimization Insights

    These tools only go so far, and they are not the be-all, end-all of cost optimization. They are designed simply to help choose the right type of configuration for a given workload. However, cost monitoring as a whole goes further, and delivers several other important types of insight into your AWS workloads and strategy.

    Rogue Infrastructure

    By its nature, rogue infrastructure—meaning use of infrastructure for purposes not officially authorized by your organization—is hard to detect. If it wasn’t, it wouldn’t be very good at being rogue.

    If you monitor cloud costs carefully, however, rogue infrastructure will have a hard time hiding. If employees spin up a virtual server in the cloud for personal use, or create storage buckets for organizational data that is not supposed to exist in the cloud, you are likely to discover it when you perform cost optimization operations designed to help identify workloads that should not be running.

    Having a strong IT governance policy in place that requires all cloud-based resources to be tagged is another way to help prevent the creation of rogue infrastructure, and to make unauthorized resources easy to detect. When possible, tagging should be automated to ensure the fastest and most consistent results.

    Security Risks

    Although cost optimization is certainly not the only tool you should use to help identify security issues in your cloud workloads, it provides some useful insight that other tools might lack.

    For example, if you notice that your bills for a certain application or service have increased due to heavier usage without a corresponding increase in legitimate requests, it could be a sign of brute-force attacks or other unauthorized access attempts.

    Neglected Projects

    When was the last time you evaluated each of your applications to ensure it was running as efficiently and securely as possible?

    If you don’t know because you don’t regularly do this, cost optimization can help ensure that you do recognize workloads that could stand to be reconfigured. If you discover that you are paying more than you expect for a given workload, or that one workload’s costs are rising more quickly than those of others without a clear reason, it’s probably time to take a look at that workload and assess whether it should be scaled up or down, migrated to a different type of service, or otherwise adjusted to operate more efficiently.

    Operational Inefficiencies

    Finally, cost optimization can help you identify inefficiencies in the way your organization is run. That is because fees charged by AWS that you could have avoided but didn’t might reflect larger inefficiencies within the organization.

    For instance, consider AWS data storage costs. If your AWS cost analysis shows you are paying early-deletion fees for data stored in S3 Glacier, you should determine why that is happening. It could be simply because you should be using a different storage class, but it could also be because employees are deleting data sooner than intended.

    Conclusion

    Saving money by being cost-efficient should always be one of your goals. But running your overall business in an efficient, transparent manner is another. AWS cost optimization can help you achieve all of this.

    This sponsored article was written on behalf of Eplexity.

    — Chris Tozzi