Cloud, SDN & Production Architectures · Study deck
Cloud Deployment Models: Multi-Site Cold Storage
A cold-store group tracks heat, doors, power, and repairs at many sites.
Cloud Clara is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Test scenario: cold storage across many sites with a concrete scenario and pass criteria.
- Validate hybrid fails at movement rules with a concrete scenario and pass criteria.
- 'test scenario: cold storage across many sites with a concrete scenario and pass criteria'
- validate hybrid fails at movement rules with a concrete scenario and pass criteria
Major section
Scenario: Cold Storage Across Many Sites
The system needs local alarms, central maintenance planning, and shared compliance evidence.
- Calibration and device health records before upload.
- Limited validation reports for auditors, logistics partners, or shared operations teams.
- Public-only placement would make local alarms dependent on connectivity.
- Private-only placement would make cross-site analysis and partner reporting harder to operate.
Major section
Scenario: Cold Storage Across Many Sites (continued)
Community-only placement would create governance and isolation risks for raw operational data.
- Placement note:: Local control and raw records remain at each facility.
- The central cloud receives hourly summaries, signed daily validation packages, and device-health aggregates.
- Partner access uses reports, not raw telemetry or control APIs.
Major section
Governance Matrix Without Wide Tables
For review, use compact placement cards that fit on mobile and desktop.
- At governance matrix without wide tables, Data class makes the architecture testable.
- That structure supports governance matrix without wide tables: A governance matrix maps data classes to allowed placement zones and required controls.
Major section
Readiness Record
The final design should leave a short record that another architect can challenge.
- A deployment decision is weak if it only says "we chose cloud" or "we chose hybrid." It should identify the workload, boundary, assumptions, controls, and validation results.
Major section
Placement as Boundary Contract
A deployment model is not a provider label.
- The same IoT product can use multiple placement answers.
- A local shutdown loop, a raw historian, a fleet dashboard, and an auditor report do not have the same latency, sensitivity, owner, or recovery requirement.
- The deployment model is therefore not "hybrid" as a slogan.
Major section
Placement as Boundary Contract (continued)
The analytics workload can use public cloud after the gateway emits hourly aggregates with schema version, data-quality flags, and approved site identifiers.
- The auditor workload can use a community or partner zone only for signed reports with expiry, redaction, and dispute rules.
- Raw traces do not cross.
- Validated model artifacts may return only after release approval.
Major section
Placement as Boundary Contract (continued)
Sensitive or high-fidelity telemetry stays local until classification, minimization, retention, and access rules are approved.
- Local control never waits for the cloud path.
- These statements give engineers, security reviewers, and operations teams something concrete to test when network links, identity services, storage queues, or dashboard services are degraded.
- The boundary contract should also describe reverse movement.
Major section
Placement as Boundary Contract (continued)
That boundary contract is also the learner's inspection checklist: identify the workload, name the owner, state the allowed movement, and attach the test that proves the placement still works when a dependency fails.
- Safety or protection decisions stay at edge or site when network latency or cloud availability cannot be trusted.
- Summaries, reports, and model jobs can move to public or community cloud when their transformation and audience are clear.
- A strong architecture can explain both movement and non-movement: what crosses the boundary, what stays behind, and what evidence would force a new placement decision.
Major section
Placement as Boundary Contract (continued)
It needs a version, validation result, rollback path, and local owner.
- For a cold-storage fleet, the compressor shutdown loop belongs at the edge because it must work during a WAN outage.
- Hourly temperature summaries, device-health aggregates, and signed compliance packages can move to public or community cloud when their audience, retention, and redaction rules are explicit.
- Without those fields, the design has only named zones, not a deployment model that can survive operations.
Major section
Workload Placement Record
The record should let a reviewer challenge the exact boundary being crossed.
- Latency test, local fail-safe behavior, operator handoff, and outage drill.
- Decision completes locally within the required deadline when WAN/cloud is unavailable.
- Raw records stay in the approved zone until minimized or explicitly released.
- Model change, schema change, drift alert, or new cross-site comparison.
Major section
Workload Placement Record (continued)
For the cold-storage scenario, the local alarm workload needs a latency and outage drill, not a dashboard screenshot.
- Reports expose only the agreed evidence, not raw control paths or device credentials.
- New partner, changed purpose, disputed report, or access-policy change.
- The raw telemetry workload needs data classification, encryption boundary, retention, and restore proof.
Major section
Hybrid Fails at Movement Rules
Hybrid designs usually fail when the boundary is drawn but the movement rule is vague.
- If raw data, model artifacts, commands, dashboards, and reports all move through the same path, the deployment model stops expressing risk.
- The architecture needs separate rules for direction, transformation, identity, outage behavior, and rollback.
- The same movement rule has to survive failure.
Major section
Hybrid Fails at Movement Rules (continued)
Failure handling is part of the same rule.
- The outbound message should carry the schema version, device group, aggregation window, quality flags, and release status, not the full raw trace.
- If a returned model causes unstable alarms, the gateway rejects or rolls back that version and records the reason.
- "Hybrid" is not evidence.
Major section
Hybrid Fails at Movement Rules (continued)
If the MQTT broker, private link, identity provider, or cloud queue is unavailable, the gateway keeps local alarm logic running and stores bounded summaries for later upload.
- The deployment model is operational only when these enforcement points are visible in gateway configuration, queue policy, storage retention, cloud IAM, release metadata, and incident procedures.
- Telemetry moving out of a site and configuration moving back into a site have different risk.
- Filtering, aggregation, signing, anonymization, and validation should happen before data crosses into a broader zone.
- Cloud-trained models or configuration changes need versioning, local validation, and a safe return path if field behavior drifts.
Major section
Hybrid Fails at Movement Rules (continued)
If the interconnect is unavailable, gateways buffer summaries locally, keep alarms running, and mark late uploads.
- In practice, the movement rule often has to be enforced by more than policy text.
- Gateways tag records before export, queues separate raw telemetry from approved summaries, object storage buckets use different retention and access rules, and cloud analytics jobs reject unknown schema versions.
- If the identity provider is unavailable, local control continues with cached permissions while administrative changes wait.
Deck summary
Key takeaways
The system needs local alarms, central maintenance planning, and shared compliance evidence.
- Community-only placement would create governance and isolation risks for raw operational data.
- For review, use compact placement cards that fit on mobile and desktop.
- The final design should leave a short record that another architect can challenge.
- A deployment model is not a provider label.
Retrieval practice
Recall check 1 of 2
Cloud Clara says: answer from memory, then check your reasoning.
Q1A factory vibration system must stop a machine locally when a severe fault is detected, keep raw vibration traces for engineering review, and train fleet-wide models from approved summaries. Which placement is strongest?
Show answer
Answer: B Good deployment decisions split workloads by timing, sensitivity, and operating evidence.
Retrieval practice
Recall check 2 of 2
Cloud Clara says: answer from memory, then check your reasoning.
Q2A cold-storage system keeps local alarms on site but sends telemetry summaries to cloud analytics and sends model updates back to gateways. Which release record is strongest?
Show answer
Answer: B A hybrid IoT deployment needs separate evidence for local control, data movement, model return, outage behavior, ownership, and change signals.
Print reference
Answers
Answer key.
- B · Good deployment decisions split workloads by timing, sensitivity, and operating evidence.
- B · A hybrid IoT deployment needs separate evidence for local control, data movement, model return, outage behavior, ownership, and change signals.