Building a Cloud Center of Excellence From Zero for a Global Technology Provider

The challenge

The group ran a 24/7 regulated platform. Downtime meant immediate revenue loss and a regulatory compliance event, so every infrastructure change had to be safe on a live system.

There was no central cloud function: teams had built infrastructure however they chose. Oracle Cloud (OCI) was the primary cloud, and AWS was added during the project. Most cloud-governance practice is written for AWS or Azure, so the OCI standards had to be designed for OCI rather than copied. Some of the physical data centers were in a geopolitically unstable region. That was a board-level risk, so moving to the cloud became a question of resilience as well as cost.

My task: create the Cloud Center of Excellence and give the whole company one way of running its cloud across OCI, AWS and its data centers.

What is a Cloud Center of Excellence?

A Center of Excellence is a small central team that makes a whole organisation good at one thing: it sets the standards, builds the shared foundations and helps every team use them. A Cloud Center of Excellence (CCoE) does this for cloud. AWS describes it as the team that leads an organisation in cloud adoption, migration and operation, with responsibility for strategy, governance, security and cost. It is usually a small team. Here the CCoE had real authority: every engineering team worked within the standards it set.

What I did

1. Built the CCoE team and its mandate from zero

   The team did not exist when I joined. I built the team, defined its mandate and scope, and earned authority with the engineering teams across the organisation through early, visible wins: published standards, working governance tooling and the first migrations.

2. Created one set of cloud standards for the whole company

   Together with the team I defined standards for security baselines, network policies, access management, naming, tagging and infrastructure as code. We explained them and helped teams that had previously worked their own way to adopt them. This was change management as much as engineering: the aim was to bring teams along without creating blockers.

   Technical details

   • OCI: compartment structure, IAM compartment design, network topology patterns.
   • AWS: account structure, landing zone, service control policies (SCPs) as guardrails; infrastructure standards based on the AWS Well-Architected Framework.
   • Both clouds: reusable Terraform module libraries, which we used to enforce the standards, plus consistent tagging and cost visibility as the base for FinOps, comparable security baselines and integrated monitoring.

3. Rebuilt the cloud foundations

   We reorganised Oracle Cloud from a single tenancy into a multi-tenancy architecture, based the AWS infrastructure standards on the AWS Well-Architected Framework, and set up redundant interconnections between OCI, AWS and the physical data centers.

   Technical details

   • OCI multi-tenancy: in Oracle Cloud a tenancy is a fully isolated partition of the cloud; separate tenancies give strong isolation between workloads. Users sign in once for all tenancies through a single SAML integration (see the article below).
   • AWS Well-Architected: AWS’s own best-practice framework, built on six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability.
   • Interconnections: redundant links between OCI, AWS and the data centers, so traffic between them does not depend on a single connection.

4. Led the cloud side of moving applications out of the data centers

   Two things drove this move: ageing infrastructure and the geopolitical risk of the data-center location. We planned the order of the moves around both, and around the 24/7 platform. Applications could not be taken offline, and a failed step would have hit real users and real money.

Results

A Cloud Center of Excellence is measured by what the whole company does differently, not by the size of its team. When the project was completed:

• One set of cloud standards for the whole company (security, network, access, naming, tagging and infrastructure as code), used by every engineering team.
• AWS infrastructure standards based on the Well-Architected Framework.
• Oracle Cloud reorganised from a single-tenancy to a multi-tenancy architecture, with one sign-on across all tenancies.
• Redundant interconnections between OCI, AWS and the physical data centers.
• Governance designed for both clouds from the start.
• A permanent CCoE with its own team, mandate and authority.

Company-wide standards set by the CCoE

• Security
• Network
• Access (IAM)
• Infrastructure as code
• Naming & tagging
• Cost visibility

• Oracle Cloud (OCI)Multi-tenancy architecture, one sign-on across tenancies
• AWSInfrastructure standards based on the Well-Architected Framework
• Physical data centersApplications moving to the cloud

Redundant interconnections

What I learned

A Cloud Center of Excellence has to earn its authority quickly. If it takes 18 months to show value, it loses credibility before it earns it.

Early, visible wins give a new central team the right to set standards for everyone. On a 24/7 platform every governance rule is also a change risk, so you have to judge each one by whether it could cause downtime.

Evidence and further reading

• Article · this siteArchitecture in an Unstable World: a practical framework for geopolitical riskThe thinking behind treating geopolitical risk as an architecture input.
• Article · this siteOCI multi-tenancy SSO: one Okta SAML 2.0 integration for several Oracle Cloud tenanciesHow sign-on across OCI tenancies works.
• Related projectEmergency cloud migration of a core banking platform during the outbreak of war in UkraineGeopolitical risk, handled as a live decision.

“Architecture in an Unstable World” was also published on CloudTweaks.

Skills and technologies

• Cloud Center of Excellence
• Cloud strategy
• Cloud governance
• Oracle Cloud Infrastructure (OCI)
• OCI multi-tenancy
• AWS
• AWS Well-Architected
• Landing zones and guardrails
• Multi-cloud
• Hybrid connectivity
• Cloud security
• Network architecture
• Terraform / infrastructure as code
• Cost visibility (FinOps)
• Data-center migration
• Geopolitical risk
• Change management
• 24/7 high availability

← All projects