Why pure public cloud lost the argument
Between 2020 and 2025, dozens of high-profile organizations (37signals, X, Dropbox) publicly repatriated workloads from AWS to owned infrastructure and reported 50-70% run-cost reductions. The pattern: steady-state predictable workloads (databases, storage, always-on APIs) are 3-5x cheaper on owned hardware; bursty, elastic and greenfield workloads are cheaper on public cloud. The right answer is hybrid — not because it is fashionable, but because it matches cost to workload shape.
The FinOps operating model
FinOps is a discipline, not a tool. Establish a cross-functional team (finance + engineering + product) that meets weekly on cost. Every cloud resource carries mandatory tags (owner, environment, cost-center, project) enforced by policy-as-code (AWS Config, Azure Policy, GCP Organization Policy). Monthly showback reports allocate cost per team; quarterly optimizations target the top three unit-economics drivers. Reserved / savings-plans coverage tracked against a 12-month rolling commitment target of 70-80% of steady-state.
Landing zones and connectivity
Every cloud has a reference landing zone: AWS Control Tower, Azure Landing Zones, GCP Cloud Foundation Fabric. Deploy them before the first workload — retrofitting governance onto sprawl is 10x more painful. Connect on-premises to cloud with dedicated links (AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect) at 1-10 Gbps, redundant across two providers or two locations. Route east-west between clouds through a transit VPC/VNET with a next-gen firewall (Palo Alto CN-Series, Fortinet FortiGate-VM) — never over public internet.
Consistent operations with Azure Arc, AWS Systems Manager, GCP Anthos
The multi-cloud tax is the operations sprawl — three consoles, three IAM models, three tag taxonomies. Modern control planes (Azure Arc, AWS Systems Manager, Google Anthos) project a consistent management surface over on-premises Kubernetes, VMs and databases. Choose one as your operational hub and register the others into it, rather than forcing engineers to context-switch daily.
Key takeaways
- Hybrid is the destination — match workload shape to environment, not marketing narrative.
- FinOps is a weekly discipline with mandatory tags, showback and RI/SP coverage targets.
- Deploy landing zones before workloads; retrofit governance is 10x more painful.
- Pick one control plane (Arc, SSM, Anthos) and project it over the estate to cut ops sprawl.
