Skip to main content

Cloud Audit: Multi-Cloud Design

Drop — Multi-Cloud Architecture Design

Date: 2026-02-19 Auditor: solution-arch (CloudForge cloud-audit team) MC Task: #1443

Executive Summary

Drop is 85% cloud-portable thanks to Docker containerization and PostgreSQL. Main AWS lock-in: App Runner (easily replaceable). Recommendation: stay on AWS, optimize current setup, design Terraform with abstraction for future portability.

1. Provider Comparison Matrix

Service AWS (Current) Azure GCP
Compute App Runner ($25-35/mo) Container Apps ($20-30/mo) Cloud Run ($15-25/mo)
Database RDS PostgreSQL ($15-18/mo) Azure DB for PG ($15-20/mo) Cloud SQL ($12-18/mo)
Registry ECR ($1-2/mo) ACR ($5/mo) Artifact Registry ($1-2/mo)
Secrets Secrets Manager ($0.40/secret) Key Vault ($0.03/10k ops) Secret Manager ($0.06/10k ops)
CDN CloudFront ($0-5/mo) Front Door ($35+/mo) Cloud CDN ($0-5/mo)
WAF AWS WAF ($5+/mo) Azure WAF ($20+/mo) Cloud Armor ($5+/mo)
Monitoring CloudWatch ($3-10/mo) Azure Monitor ($5-15/mo) Cloud Monitoring ($0-8/mo)
Total estimate $50-75/mo $100-130/mo $35-60/mo

2. Portable Architecture

                    Cloudflare (DNS + CDN + WAF)  ← Cloud-agnostic edge
                              |
                              | HTTPS
                              v
                    ┌──────────────────┐
                    │  CaaS Platform   │  ← App Runner / Container Apps / Cloud Run
                    │  ┌──────────┐   │
                    │  │ Docker   │   │  ← Identical image everywhere
                    │  │ Next.js  │   │
                    │  │ :3000    │   │
                    │  └──────────┘   │
                    └────────┬────────┘
                             │ DATABASE_URL
                    ┌────────┴────────┐
                    │  Managed PG     │  ← RDS / Azure DB / Cloud SQL
                    └─────────────────┘

Abstraction Strategy

Layer Approach
Compute Docker image to any CaaS. No platform SDK
Database Standard PostgreSQL via DATABASE_URL
Secrets Terraform abstracts provider. App reads env vars
DNS/CDN/WAF Cloudflare (cloud-agnostic, free tier)
Monitoring Sentry (errors) + structured logs to any aggregator
CI/CD GitHub Actions (already cloud-agnostic)

3. Migration Paths

AWS to Azure (3-5 days)

  1. Push image to ACR
  2. Create Azure DB for PostgreSQL Flexible Server
  3. pg_dump/pg_restore data migration
  4. Deploy to Azure Container Apps
  5. Update Cloudflare DNS
  6. Write Azure Terraform modules

AWS to GCP (2-3 days)

  1. Push image to Artifact Registry
  2. Create Cloud SQL PostgreSQL
  3. pg_dump/pg_restore
  4. Deploy to Cloud Run (most similar to App Runner)
  5. Update Cloudflare DNS
  6. Write GCP Terraform modules

Lock-In Assessment

Component Lock-In Notes
App Runner LOW Standard Docker, replaceable
RDS PostgreSQL LOW Standard PG, any managed PG works
ECR LOW Standard OCI registry
VPC Connector MEDIUM AWS-specific networking
IAM Roles MEDIUM AWS-specific auth model
Secrets Manager LOW App reads env vars regardless

4. Recommendation: Stay AWS, Optimize

Rationale:

  • $50-75/mo already low
  • No business need to migrate
  • 85% portable — migration possible in 2-5 days if needed
  • Azure costs MORE (~$100-130/mo)
  • GCP saves ~$15/mo but not worth effort now

Immediate Actions

  1. Security fixes (encrypt RDS, restrict SG, use Secrets Manager)
  2. Add Cloudflare free tier (DNS, CDN, WAF — cloud-agnostic)
  3. Terraform all resources (reproducibility)
  4. Add CloudWatch basic alarms ($3-5/mo)

Future Migration Triggers

  • AWS cost > $200/mo → evaluate GCP Cloud Run
  • EU data sovereignty requirement → Azure Norway East
  • Multi-region needed → Cloudflare Workers + D1
  • Kubernetes requirement → EKS or GKE

5. 12-Month Cost Projection

Scenario Monthly Annual
Current (no changes) $50-75 $600-900
Optimized AWS $55-80 $660-960
AWS + Cloudflare $55-80 $660-960
Azure equivalent $100-130 $1,200-1,560
GCP equivalent $35-60 $420-720

No comments to display

Back to top