CLOUD CONCEPT

Hybrid Cloud

Hybrid cloud is a deployment model that integrates public cloud services with on-premises or private cloud infrastructure to support connected workloads, data, and operations.

Cloud Concepts Hub →

What is Hybrid Cloud

Hybrid cloud lets an organization keep some systems in facilities it controls while using public cloud resources for other parts of its environment. It matters when migration constraints, latency requirements, data-handling obligations, or existing investments make an entirely cloud-based deployment unsuitable.

Hybrid cloud combines public cloud services with on-premises infrastructure or a private cloud, with integration between the environments. Applications, data flows, identity systems, or operational processes connect these environments to support business requirements. Simply owning a data center and separately using a cloud service does not explain the hybrid architecture; the important question is how those environments work together.

For deployment-model exam questions, distinguish hybrid from cloud and on-premises deployments. A cloud deployment runs the relevant workloads in the cloud rather than depending on an on-premises application environment. An on-premises deployment runs workloads in an organization's own or controlled facilities. A hybrid deployment connects these approaches, such as a cloud-hosted application that accesses an on-premises database. An on-premises environment does not need to implement a full private cloud for this common hybrid pattern.

Consider a manufacturer whose factory applications must respond quickly to local machinery. It can retain production control systems on-site while sending selected telemetry to cloud storage and analytics services. Another organization might retain a legacy transaction system in its data center while hosting a customer-facing web application in the cloud. Hybrid architecture also supports phased migration, during which migrated applications must communicate with systems that have not yet moved.

Connectivity is a foundation, but it is not the entire architecture. Engineers must plan IP address ranges, routing, DNS resolution, firewall rules, authentication, and authorization across both environments. Encrypted site-to-site VPN tunnels or dedicated network connections can provide connectivity. A dedicated connection does not automatically provide encryption, and neither connection type eliminates the need to design for failures or control application access.

Application placement should follow dependency and data-flow analysis. Frequent database calls across a wide-area connection can increase response times even when bandwidth is sufficient. Moving large datasets can incur transfer charges and take substantial time. Caching, asynchronous messaging, and keeping tightly coupled application components together can reduce these problems, but each approach introduces its own consistency and operational considerations.

Hybrid cloud offers placement flexibility and can preserve useful infrastructure investments, but it also requires operating two environments. Teams must coordinate monitoring, patching, inventory, security policies, backups, and incident response. Availability depends on the complete application path: a cloud application that requires an on-premises database can become unavailable when the connection or database fails. Redundant connectivity, tested recovery procedures, and clearly defined recovery objectives are therefore important.

Hybrid cloud is not the same as multicloud, which means using services from multiple cloud providers; an architecture can be both. It also does not guarantee lower cost, regulatory compliance, seamless workload portability, or automatic cloud bursting. For exam scenarios, references to retaining local systems while integrating them with cloud resources are strong indicators of hybrid deployment. The defining feature is the connected deployment model, not a particular service or networking product.

Key aspects of Hybrid Cloud

Hybrid cloud integrates deployment environments while requiring deliberate workload placement, secure connectivity, coordinated operations, and resilience across their boundaries.

Integrated deployment environments

Public cloud resources work with on-premises or private cloud systems through application, data, identity, or operational integration. Identify the actual dependencies rather than treating two unrelated environments as an integrated architecture.

Requirement-driven workload placement

Place components according to latency, data handling, hardware dependencies, migration constraints, and cost. Keeping a database on-site while moving an application tier to the cloud requires testing the network impact on application performance.

Planned connectivity and security

Design routing, DNS, address allocation, encryption, and access controls across the environment boundary. Private connectivity does not replace authentication or automatically encrypt traffic.

Coordinated operations

Establish monitoring, asset inventory, patching, and incident procedures that cover both environments. Shared operational tools can improve visibility, but responsibility for local facilities and hardware remains with the organization or its infrastructure provider.

Cross-environment resilience

Treat network links and remote dependencies as possible failure points. Test whether applications can continue operating during connectivity loss and design redundancy or degraded-operation behavior where required.

Flexible migration and long-term coexistence

Hybrid deployment can support a temporary migration phase or an ongoing architecture. It does not require every workload to move to the public cloud eventually.

Cloud services for Hybrid Cloud

AWS Direct Connect and AWS Site-to-Site VPN provide connectivity between local networks and AWS; some architectures use VPN as a backup to a dedicated connection. AWS Storage Gateway uses network connectivity to support cloud-backed storage for local applications. AWS Outposts brings selected AWS infrastructure and services into customer facilities when workloads need local execution. AWS Systems Manager can provide common operational capabilities for supported managed nodes across environments. These services address different parts of a hybrid architecture rather than forming a mandatory bundle, and engineers must still design identity, routing, encryption, monitoring, and recovery around application dependencies.

AWS Direct Connect image AWS Direct Connect

Provides dedicated network connectivity between an organization's network and AWS, supporting communication between local and cloud workloads. Traffic is not encrypted by default, so encryption requirements must be addressed separately.

Open AWS Direct Connect →
AWS Site to Site VPN image AWS Site-to-Site VPN

Connects an on-premises network to AWS using IPsec VPN tunnels, commonly over the internet. It can provide primary hybrid connectivity or a backup path, with routing and failover explicitly designed and tested.

Open AWS Site-to-Site VPN →
AWS Storage Gateway image AWS Storage Gateway

Connects on-premises applications to AWS-backed storage through supported file, volume, or virtual tape interfaces. It supports hybrid storage patterns without requiring applications to adopt cloud storage APIs directly.

Open AWS Storage Gateway →
AWS Outposts family image AWS Outposts

Places AWS infrastructure and selected AWS services in customer facilities for workloads that require local processing or data placement. It extends AWS operating interfaces on-premises but has service-specific connectivity and facility requirements; it is not a general-purpose disconnected cloud.

Open AWS Outposts →
AWS Systems Manager image AWS Systems Manager

Can manage supported on-premises servers and virtual machines alongside cloud instances when they are configured as managed nodes. It supports coordinated inventory, command execution, and patching, subject to permissions, connectivity, and feature requirements.

Open AWS Systems Manager →