Should more businesses copy Netflix and Spotify’s single-cloud strategy?

With­out the mav­er­icks who are pre­pared chal­lenge received wis­dom, the busi­ness world would be a lot less dynam­ic – or inter­est­ing, for that mat­ter. Take Paul Gra­ham, co-founder of start­up accel­er­a­tor Y Com­bi­na­tor, for instance. Renowned in Sil­i­con Val­ley for his abil­i­ty to pick a win­ner, he recent­ly admit­ted that he’d nev­er read one busi­ness plan or bal­ance sheet sup­plied by firms seek­ing an invest­ment from him. 

Graham’s jus­ti­fi­ca­tion? “The rea­son I don’t care about busi­ness plans is that I can learn more from five min­utes of inter­ro­gat­ing the founders than I can from read­ing the 10 pages of fluff they’ve writ­ten.”

And con­sid­er fin­tech uni­corn Bolt, which broke its industry’s norm of long work­ing hours by adopt­ing a four-day week in Sep­tem­ber 2021. Acknowl­edg­ing that it was an exper­i­ment, the firm’s founder and exec­u­tive chair­man, Ryan Bres­low, explained at the time: “Peo­ple are done work­ing like cows for five days. They are ready to work like lions for four.” 

There are con­trar­i­ans in the cloud com­put­ing world too. When the con­sen­sus over­whelm­ing­ly favours host­ing appli­ca­tions using a mul­ti-cloud solu­tion (the use of two or more com­put­ing ser­vices from any num­ber of ven­dors), a small minor­i­ty res­olute­ly back the sin­gle-cloud mod­el. 

The benefits of a multi-cloud approach

But why? The mul­ti-cloud mod­el offers clear advan­tages for users. For instance, it makes it pos­si­ble for them to hag­gle on prices and select the best-val­ue ven­dor for each ser­vice required, because some providers are bet­ter than oth­ers for cer­tain tasks. In essence, it gives users the choice and mod­u­lar flex­i­bil­i­ty that a sin­gle-cloud approach clear­ly can­not pro­vide.

Of the 1,700 IT deci­sion-mak­ers polled in a sur­vey for US cloud com­put­ing firm Nutanix in Sep­tem­ber last year, 83% agreed that a hybrid mul­ti-cloud approach was ide­al.

Do the refuseniks have a con­vinc­ing argu­ment? Is the sin­gle-cloud mod­el worth stick­ing with if no one provider can offer the best val­ue for all ser­vices?

Scott Riley, founder of inde­pen­dent con­sul­tan­cy Cloud Nexus, is proud to be a con­trar­i­an. He blasts what he sees as three wide­ly held myths asso­ci­at­ed with the mul­ti-cloud approach. 

“The cost dif­fer­ences between the main hyper-scale cloud providers are not that sig­nif­i­cant unless you’re pre­pared to make a mul­ti-year com­mit­ment,” he says. “You have the price or you might buy through a dis­trib­u­tor for a 10% dis­count.”

The con­cept of using mul­ti-cloud to geolo­cate data is also wrong, argues Riley, who says: “All hyper-scale providers have mul­ti­ple geo­graph­i­cal data cen­tres with indi­vid­ual fault-tol­er­ant plat­forms.” 

It’s a fair point. Where in the world is beyond the reach of the major cloud hosts these days? The Pit­cairn Islands, per­haps? 

Then there’s resilience. Is it real­ly cor­rect to say that mul­ti-cloud is inher­ent­ly bet­ter in this respect? 

“Load dis­tri­b­u­tion has to hap­pen some­where,” Riley says. “Take an inbound request and pass it to the near­est, or least busy, serv­er in any giv­en cloud. Where does this sit: cloud A, cloud B or a third cloud? Wher­ev­er it sits, when­ev­er that plat­form has an issue, no one is get­ting to the appli­ca­tion, regard­less of how many cloud plat­forms you’ve deployed it to.”

Security concerns

Secu­ri­ty is one of the biggest aspects of cloud strat­e­gy. There’s a wide­spread belief that using sev­er­al providers is a more resilient approach than rely­ing on one.

But that’s anoth­er pop­u­lar fal­la­cy, accord­ing to Tim Erlin, vice-pres­i­dent of strat­e­gy at cyber­se­cu­ri­ty com­pa­ny Trip­wire. 

“There are good rea­sons to have a mul­ti-cloud strat­e­gy, but secu­ri­ty isn’t usu­al­ly one of them,” he says. “The secu­ri­ty advan­tages are dubi­ous at worst and require sig­nif­i­cant invest­ment at best. Most often, the secu­ri­ty ben­e­fits are ascribed to the pro­tec­tion that mul­ti-cloud gives against dis­trib­uted denial-of-ser­vice [DDoS] attacks, which is real­ly a rehash of the resilience argu­ment.”

Achiev­ing resilience requires a sub­stan­tial out­lay – and there are bet­ter ways of doing so than adopt­ing a mul­ti-cloud approach, Erlin adds. 

“Build­ing a mul­ti-cloud infra­struc­ture that allows for seam­less failover [the facil­i­ty to switch auto­mat­i­cal­ly to a back-up sys­tem] across providers requires spe­cif­ic invest­ment. It’s not sim­ply an emer­gent qual­i­ty of hav­ing mul­ti­ple providers,” he says. “This might be a worth­while invest­ment for busi­ness­es that require that lev­el of avail­abil­i­ty and/or are at a high risk of DDoS attacks, but it should be con­sid­ered along­side alter­na­tives that might mit­i­gate the risk at a low­er cost.”

Maybe the biggest argu­ment in favour of a sin­gle-cloud strat­e­gy is the sim­plic­i­ty it offers. 

David Lid­dle, senior cloud secu­ri­ty con­sul­tant at Adar­ma Secu­ri­ty explains: “In addi­tion to insid­er threats, cloud mis­con­fig­u­ra­tions are one of the biggest issues fac­ing users. These mis­con­fig­u­ra­tions, which range from over­ly per­mis­sive poli­cies attached to iden­ti­ties to poor­ly con­fig­ured secu­ri­ty groups, can be intro­duced in sev­er­al ways. Spot­ting them in a sin­gle hyper-scale envi­ron­ment can be extreme­ly dif­fi­cult. With a mul­ti-cloud approach, the prob­lem of elim­i­nat­ing mis­con­fig­u­ra­tions becomes even more dif­fi­cult.”

Then there are the risks of migra­tion. Mov­ing from a sin­gle host to mul­ti-cloud is a seri­ous under­tak­ing. It requires vir­tu­al machines (VMs) to be stripped out, because cloud hosts, while sim­i­lar in func­tion­al­i­ty, have their own quirks. A VM that runs on Ama­zon Web Ser­vices (AWS) may not run on Microsoft Azure, for instance. 

Com­pa­nies need to be sure they’ve got the right mon­i­tor­ing tools in place to run a mul­ti-cloud spread. Every extra ele­ment is a point in favour of the sim­plic­i­ty of the sin­gle-cloud approach.

Why the tech giants avoid multi-cloud

Per­haps the most con­vinc­ing evi­dence is from the tech giants. Net­flix, for exam­ple, runs com­put­ing and stor­age exclu­sive­ly on AWS. It tri­alled a mul­ti-cloud oper­a­tion briefly in 2018 before com­mit­ting to a sin­gle provider. Net­flix is no ordi­nary cus­tomer – at one point it account­ed for 15% of all glob­al inter­net traf­fic. If it had felt that using only one provider were too much of a risk, it sure­ly would have diver­si­fied by now.

Spo­ti­fy prefers one provider too, hav­ing migrat­ed from AWS to Google Cloud in 2016. The company’s vice-pres­i­dent of tech­nol­o­gy, Tyson Singer, said last year: “There’s sim­plic­i­ty in hav­ing a sin­gle cloud. It saves us a lot of has­sle and com­plex­i­ty.”

The approach that both Net­flix and Spo­ti­fy have adopt­ed is unfash­ion­able nonethe­less. Mul­ti-cloud is the default option. But it is use­ful to know all the argu­ments for and against. 

“Is mul­ti-cloud advis­able? The answer is far from straight­for­ward,” Lid­dle says. “For some, mul­ti-cloud is essen­tial. For oth­ers, it’s an aspi­ra­tional mon­ey pit.”

Small­er com­pa­nies in par­tic­u­lar may feel embold­ened to keep things sim­ple. And, if they do, they can take com­fort in pur­su­ing a strat­e­gy that suits a pair of dig­i­tal behe­moths.

Trends don’t last for­ev­er in busi­ness. Con­trar­i­ans act and fol­low­ers emerge. Run­ning a sin­gle-cloud strat­e­gy may feel awk­ward, but you may sim­ply be ahead of the curve.