何謂雲端架構？

Cloud architectures are akin to the designs and blueprints of a building, informing engineers and construction crews where certain components are, how systems are threaded throughout the larger infrastructure, and offers a means for understanding the whole system in detail that can be shared and referenced. In much the same way as building designers, cloud architects begin with a use case and then architect a system to meet the needs that support that use. Then they will pull together the server components, networking infrastructure, and application software that will compose the physical infrastructure, and create the cloud virtualizations served to its users. In this analogy, like every building, each cloud architecture is unique though they’re made of standard materials. Clouds can be constructed for personal use, or for public use—like homes or stadiums, each requires a cloud architecture design suited to its purpose.

Before architecting a cloud solution, organizations need to perform a comprehensive requirements analysis, and answer the basic question of “what do we need this cloud to do for us?” Cloud architects must consider in their designs: user and business requirements, compliance requirements, cloud security requirements, and budgetary requirements. Careful reflection and planning can lead to useful specifications like user requirements documents (URD), and business requirement documents (BRD), which are helping in guiding the new cloud system. In one way, these documents can be used to map requirements against multiple cloud-vendor capabilities to determine appropriate solutions.

When considering compliance and security requirements include the following sub-concerns:

• Compliance Concerns: Data Retention, Encryption, Vulnerability Management, Auditing, and Privacy.
• Security Concerns: Authentication, Log Management, Patch Management, Privileges, Access Control, and System Hardening.

After compiling the requirements for the new cloud architecture, cloud engineers can begin designing a solution based on those requirements. The solution design should include security design, technical design, integrations, and acceptable downtime.

• Security Design — The aim of security design is to answer what level of security is required, and how to implement that level (e.g., using tools like two-factor authentication, encryption, etc.). To begin, identify the data flows in the system, and how that data is secured using a data flow diagram. Data flow diagrams depict the flows and types of data and their level of encryption from point to point. Also consider how the system is segmented, and if that configuration introduces vulnerabilities or removes them. This can mean installing firewalls in-between web, data, and storage layers.
• Technical Design — The technical design outlines the resources and services—software, hardware, network, routing and subnets—used to comprise the system. For software, think about which functional technologies, security controls, and licenses will be used. If the cloud will be deployed on-premises, then hardware is a concern, otherwise, deploying to the public cloud normally beneficially removes the need to think in detail about hardware resources since they are managed in the cloud. Networking, routing, and subnetting are important considerations for system performance and security. Poor segmentation can add vulnerabilities, poor routing can cripple system performance and availability. Design for redundancy and expect failures.
• Integrations — Cloud components are integrated and do not run in isolation. Ineffective designs can introduce bottlenecks, dependencies, and dead ends that develop into long-lasting problems for network admins and developers as systems grow. Understanding how components integrate, especially data flows and authentication domains, is important to ensure the cloud system remains resilient and functioning.
• Downtime — Adopting new cloud architectures, or performing regular cloud maintenance usually results in some downtime which can be planned for, either through redundant systems, or scheduling. (Minimizing downtime is a crucial business objective, e.g. tier 4 classified data centers are defined by a 99.995% annual uptime, allowing only a few minutes of downtime per year providing maximum availability.) While at first, this may be less of a concern for budding clouds, downtime ultimately impacts business goals, and if the cloud is supporting revenue generation, any system downtime is money out the door.

The physical components and user interface are the most visible parts of a cloud system, but cloud architecture encompasses more. In the most general sense, cloud architects concern themselves with the following categories:

• Back-end Hardware — The physical components that support cloud services are CPUs, disk storage, memory, storage networking, and connectivity components like routers and cabling. Businesses may also want to include the components that support the system hardware, like server racks, cooling equipment, lighting, which can help them understand overall costs.
• Middleware — Middleware is the software used to create connections between other components on the network, acting as a communications intermediary. In the cloud, middleware also abstracts the hardware adding a layer of virtualization that gives clouds their characteristic multiple environments on shared resources. This is a broad definition, but examples include web servers, hypervisors, application servers, database servers, or transaction-processing monitors, and more.
• Front-end Interface — Front-end interfaces come in GUI or a console form, though clouds tend to promote GUI interfaces. While cloud architects need to consider the technology that supports the front-end designs and workings, including an experienced UX designer to develop the interface helps bridge the gap between the system and the user.
• Management Software — Cloud management software assists cloud providers to monitor and control multiple cloud deployments, resources, and services. These packages are used to orchestrate the virtual environment, optimize cloud deployments, and potentially understand costs.
• Automation Software — Highly associated with cloud deployments, automation software coupled with virtualization technology has been the enabler that makes the public cloud a reality. When an organization's cloud services grow, serving more users, and more environments, many of these tasks will pile up, completing them manually is time-consuming, and error-prone. Enter automation software to delegate those responsibilities.

Managing the cloud, or cloud governance also must be considered during cloud architecture planning. The following six principles for cloud governance provide a framework for cloud architects.

• Data Management — The data lifecycle needs to be organized, consider data classification, access controls, encryption, long-term storage, and retirement.
• Security and Compliance Management — A progressively more complex area in the cloud, security and compliance concerns risk, privacy, identity and access management (IAM), application security, data encryption, and contingencies.
• Financial Management — While the cloud allows for great cost flexibility and control, these factors must be monitored and budgeted. Financial management uses policies, reports, controls, and alerts, to assist in understanding cloud usage.
• Operations Management — Operations encompasses the tasks of keeping systems up and maintaining service-level agreements. This requires monitoring the state of the cloud, how the technologies interact, and managing the resources for applications and new code deployments.
• Performance Management — Performance management monitors application, and infrastructure resources at a granular level to understand performance and optimize the system.
• Asset and Configuration Management — Automation can help to keep an accurate and up-to-date inventory of assets and devices, as well as be able to push configuration changes to those devices. Additionally, there must be a way to securely control and store keys and secrets.