65 architectures
Reference architectures
How we build it, drawn with each cloud's own icons. Select a component to see what it does and the practice behind it.
Cloud TransformationLanding ZoneThe foundation every wave lands on: accounts, guardrails, network hub, identity and logs, built once and the same way.Open it
Cloud TransformationHybrid Network and IdentityThe data centre and the cloud working as one: a private circuit with a VPN behind it, names that resolve both ways, and one sign-in.Open it
Cloud TransformationServer Migration FactoryServers rehosted wave after wave: replicated continuously, tested, cut over, with the source kept for rollback.Open it
Cloud TransformationDatabase Migration to Managed ServicesDatabases move to a managed service with as little downtime as their owners allow: copied in full, kept in step, then switched by name.Open it
Cloud TransformationWeb Application on Managed ServicesWhere a replatformed web application lands: one way in at the edge, the app in two zones, its data on managed services.Open it
Cloud TransformationDisaster Recovery to the CloudThe second data centre gives way to a recovery region: servers copied in the background, recovery servers started only for a drill or a disaster.Open it
Cloud TransformationCloud Transformation, End to EndAssessed on evidence, landed on a foundation, moved in waves, run from the first day.Open it
Cloud TransformationManaged Cloud OperationsSignals from every layer, alerts that carry their first action, tickets in the customer's ITSM, and recovery that is drilled.Open it
Cloud TransformationContainer Platform with GitOpsFrom commit to cluster: scanned images in a private registry, GitOps deploys, approval before production, one view of every service.Open it
Cloud TransformationAWS Multi-Account Landing ZoneCore accounts for security, logs, network and shared services; product accounts per environment; sandboxes kept apart.Open it
DevSecOpsContainer Delivery on Amazon ECS and EKSOne webhook router starts the right pipeline; scanned images go blue/green to ECS and by GitOps to EKS.Open it
Cloud TransformationA New Product Platform on AWSCloudFront and AWS WAF at the edge, containers on ECS or EKS, Aurora and ElastiCache behind, pipelines and code from day one.Open it
Cloud TransformationData-Centre Migration to AWS in WavesDiscovery data decides a path per workload; AWS migration services move servers, databases and files in waves onto the landing zone.Open it
Cloud TransformationManaged Operations on AWSSignals from every account in one place, patching, backup and recovery on schedule, findings and spend reviewed, tickets to a Level 1–3 team.Open it
Cloud TransformationAzure Hub-and-Spoke Landing ZoneA Microsoft Entra tenant with management groups and policy, one hub network, and application subscriptions as spokes in two regions.Open it
MLOpsMachine Learning and Analytics on AzureData Factory feeds a staging area; Azure Machine Learning trains, registers and serves models; Power BI and apps use the results.Open it
Cloud TransformationMigration to Azure in WavesDiscover with Azure Migrate, move servers, databases and file shares wave by wave, test, cut over, then operate.Open it
Cloud TransformationManaged Operations on AzureAzure Monitor and Sentinel feed the customer's ITSM; patching, backup and recovery run on policy; cost is reviewed every month.Open it
DevSecOpsRegulated GKE Platform on Google CloudEvery project created from code, microservices on GKE, security from the edge to the containers, releases only through the pipeline.Open it
DataOpsMultilingual Text Analytics on Google CloudComposer schedules Dataflow, models translate and classify, BigQuery checks quality, Looker shows the result the next day.Open it
Cloud TransformationGreenfield Platform on Google CloudA new application platform from zero: projects from Terraform, GKE and Cloud Run behind Cloud Armor, releases through a secure pipeline.Open it
Cloud TransformationMigration to Google Cloud, Pilot FirstFour phases with decision gates: discover the estate, plan the waves, move one low-risk workload as a pilot, then launch the rest.Open it
Cloud TransformationGoogle Cloud Landing ZoneOrganization, folders and projects from a bootstrap project: policies, identity, a network hub with private links, and central logs and findings.Open it
Cloud TransformationManaged Operations on Google CloudWorkloads watched, patched, backed up and kept within budget: Google's operations tools with an NGT team and an ITSM process around them.Open it
Cloud TransformationHuawei Cloud Landing Zone and Secured Working AreaA governed landing zone with one network hub, and virtual desktops that keep the delivery team's work inside the cloud.Open it
Cloud TransformationMigration to Huawei Cloud in WavesServers, databases and files moved with Huawei Cloud's own migration services, in waves with a pilot, hyper-care and hand-over.Open it
Cloud TransformationContainer Platform on Huawei CloudMicroservices on Cloud Container Engine, images through security gates into SWR, releases pulled in by Argo CD.Open it
DevSecOpsHuawei Cloud Next to AWS and Azure: One DevSecOps ToolchainOne set of pipelines, Terraform modules and access automation that deploys to Huawei Cloud as it does to AWS and Azure.Open it
Cloud TransformationOperating Workloads on Huawei CloudMetrics, traces, logs and audit with Huawei Cloud's own services, backups in a second region, hyper-care, then hand-over.Open it
Cloud TransformationAlibaba Cloud Landing Zone as CodeAccounts in Resource Directory, one network hub on a CEN transit router, guardrails and logs, all deployed from code.Open it
Cloud TransformationGreenfield Product Platform on Alibaba CloudA new product on ACK or SAE with PolarDB, Tair and OSS, behind CDN, WAF and ALB, built and watched from day one.Open it
Cloud TransformationModernisation Factory on Alibaba CloudA strangler approach: API Gateway moves routes one by one from the legacy application to microservices on ACK.Open it
Cloud TransformationMigration to Alibaba Cloud in WavesDiscover and assess, build the landing zone first, prove a pilot, then move servers, databases and files wave by wave.Open it
Cloud TransformationManaged Operations on Alibaba CloudFinOps, CloudOps, AIOps and SecOps on Alibaba Cloud's own tools, with tickets in the customer's ITSM and a monthly review.Open it
DevSecOpsGated DevSecOps PipelineCommit to production on one gated path: static checks, scanned images, GitOps deploys, an approval gate and watched runtime.Open it
DevSecOpsCentral CI/CD PlatformOne shared GitLab with a template library and Spot runners on Amazon EKS, deploying into each account with short-lived roles.Open it
DevSecOpsSRE & Observability StackOpen-standard telemetry into one view, SLOs that decide what pages, and an incident loop that ends in fixes shipped as code.Open it
DevSecOpsCloud Security ControlsFive control domains on every account, each with the cloud's own services, and every finding in one view.Open it
Platform EngineeringInternal Developer PlatformFive planes behind one portal: orchestration, pipelines, runtime, and observability and security across all of them.Open it
Platform EngineeringGolden Path: Ticket to Running ServiceThe ticket queue takes weeks; the golden path takes minutes: template, short form, auto-provision, guardrails, deployed.Open it
Platform EngineeringSelf-Service Infrastructure EngineA portal request becomes a Terraform run in the right account: no tickets, no keys on laptops, every run logged.Open it
AI & AgentsMulti-Agent Harness for IT OperationsSpecialised agents behind one super-agent, acting on enterprise systems through an MCP gateway, inside guardrails, routing, audit and a hand-over to people.Open it
AI & AgentsHybrid LLM GatewaySensitive work on open-weight models in your own account, other work on the cloud's model service, all behind one gateway with budgets and audit.Open it
AI & AgentsKnowledge Assistant with RAGDocuments flow in from the systems that own them; questions are checked for scope, answered from retrieved passages with citations, and tested before every release.Open it
AI & AgentsAI-Native SDLC with Human GatesAn agent team takes a ticket to a tested change; engineers approve the plan and merge the result, and quality gates run in between.Open it
DataOpsDataOps Lakehouse PlatformSources land once, are tested at every hop and are served governed to reports, ML and agents, with CI/CD and governance always on.Open it
DataOpsData Quality GatesEvery change is tested before it ships, and every run is tested before the business sees it.Open it
MLOpsSelf-Hosted MLOps on Amazon EKSA closed loop on open-source tools in one private EKS cluster: data read in place, GPUs for training only, a fail-closed gate and a person's signature before any release.Open it
AIOpsAIOps Self-Healing LoopKnown failures run an approved runbook and are verified; new ones get an AI analysis and an engineer's decision, then become rules.Open it
AIOpsAgentic IT OperationsA super-agent routes requests from chat, ITSM and change intake to specialised agents; monitoring reaches its agents directly, so nobody raises a ticket.Open it
FinOpsFinOps Cost GovernanceEvery cost on an owner, every change priced before it exists, every saving verified on the bill.Open it
FinOpsFinOps in the Developer PlatformPriced before it is created, tracked against a budget, with saving suggestions the owners decide on.Open it
FinOpsContinuous Cost OptimisationCandidates found read-only, agreed with owners, applied in code, counted only once they show on the bill.Open it
Cloud TransformationMission-Critical Web App on App ServiceWeb app and API on App Service in two regions, behind Front Door, data private and geo-replicated.Open it
Cloud TransformationHybrid DNS with Azure DNS Private ResolverOn-premises and Azure resolve each other's private names, so private endpoints work from both sides.Open it
Cloud TransformationLanding-Zone Governance AssessmentA scheduled, read-only scan of management groups, policy, access and cost, published as a private report.Open it
Cloud TransformationMultitenant SaaS on AzureMany tenants on shared app tiers in two regions, each with its own database in elastic pools.Open it
DevSecOpsAKS Behind Front Door and Private LinkFront Door reaches private AKS ingress over Private Link: no public IP on the cluster, TLS throughout.Open it
DevSecOpsPrivate AKS with Hub Firewall and BastionA private AKS cluster in a spoke: Azure Firewall controls traffic in and out, admins come through Bastion.Open it
FinOpsApproval-Gated Terraform with Cost EstimatesEvery Terraform change is planned, priced and approved before it applies; load-test environments are created, then destroyed.Open it
AI & AgentsMultimodal RAG over Technical DocumentsCharts, tables and images in technical documents become searchable text, and answers cite their sources.Open it
AI & AgentsDocument Processing with Document IntelligenceInvoices, contracts and forms read by Document Intelligence; confident fields flow on, uncertain ones go to people.Open it
DevSecOpsEphemeral Azure Pipelines Agents on AWS FargateAzure DevOps builds and deploys to AWS with a fresh Fargate agent per job and no long-lived keys.Open it
Cloud TransformationBusiness-Critical Windows Systems Rehosted on AWSWindows and .NET systems moved to EC2 across two Availability Zones, with SQL Server Always On between them.Open it
DataOpsServerless IoT Data Lake on AWSDevice data cleansed per event, history reprocessed in batch, all of it queryable in place with SQL.Open it
