How do you ensure governance of multi-cloud internet services?

It’s impossible to get a framework like this right at the first attempt. It will need to be iterative. While everything in the example is valid, adding things like FinOps/optimisation, anomaly response processes and internal escalation paths is something I see often missed in frameworks.

The compliance in multi-cloud is perspective and it can vary depending on key factors like Region, Cloud Provider and End User experience. There's no silver bullet or a single framework which can help in compliance issues, atleast as of now (I believe)

Use tools like Terraform to set up a template project with key configurations. Define resources like a service account solely for token generation, and 'caller' APIs that interact with these accounts, enhancing security. This approach ensures both consistency and scalability. Integrate Terraform with native services, such as Google Cloud's pub-sub alerts triggered upon new project creation. This ensures immediate monitoring, logging, and budget alert setups. Adopting such strategies streamlines provisioning and strengthens framework security and governance.

When using IaC (infrastructure as Code) it can cause some challenges with automated cost optimisation tooling, due to the creation of drift. While some new tools coming to market aim to fix this, in your processes, PR approvals etc, there has to be a plan on how to handle optimisation and drift.

In addition to using IaC frameworks like Terraform. The containerisation can be done in k8s to reduce development/deployment efforts for each cloud providers.

The choice of CMP will often drive behaviours within the organisation, so it shouldn’t be a decision lightly. Also one shouldn’t simply pick from the big names. List what’s important to you as an organisation from the tool (or tools) and then make sure that’s a strong suite from the provider you choose.

You can actually follow a very similar concept for embedding FinOps too. With the process for escalation and review being key. As Security is everyone’s responsibility, so is cost.

Fostering a culture to all employees to pursue their tech certs with different cloud providers like AWS, GCP, OCI or Azure. This includes reward system for employees pursuing different certs.

To make training sessions engaging and relatable, consider using methods like weekly whiteboard sessions and avoid excessive technical jargon / acronyms to make information more accessible. Direct face-to-face interactions are critical. Integrating pair programming and incorporating learning and development into your capacity planning can be invaluable. Fostering this culture of continuous learning will ensure that your team understands and adheres to your governance policies and standards, reducing risks in your multi-cloud operations.

One of the key things people get wrong in the cloud when considering how to govern it, is that they create (or carry over from on-Prem) a model where accountability and responsibility are too far apart. It’s the engineers now that drive cost, not infrastructure managers who buy new kit for the DC. If there is no strong link or close relationship between where spend accountability lives and the engineers, costs will spiral and a FinOps culture will be very hard to implement.