Best Practices for Cloud Database Management Systems
It’s hard to imagine that cloud platforms have been available to the IT community for nearly a decade. The popularity of cloud systems has grown to such an extent that they have become the infrastructure of choice for many organizations.
As a database consultant for over 20 years, I have worked with companies of all types and sizes across a wide range of industries. As their cloud implementations matured, many companies faced a common theme: There were several issues affecting the quality of their cloud database platforms.
Here are some of the most common problems and recommendations to prevent them from happening.
Cloud Database Performance Monitoring
Keeping any database system running smoothly is a wonderfully complex task. From disk reads and buffer cache hit rates to the throughput of concurrent multi-user transactions, there is a seemingly endless array of metrics to monitor and root causes of poor database performance to resolve.
In addition to standard database performance issues, DBaaS and IaaS database platforms add another dimension to performance monitoring and troubleshooting. Transferring information to and from a cloud database system can be difficult, especially if there are large volumes of data and tight time constraints.
A phrase I commonly use with clients is “no database is an island”. Most DBaaS and IaaS databases receive feeds from various sources, interact with other databases and systems during day-to-day operations, and send results to other applications and end users.
Many IT stores have discovered that the cloud requires an “all-in-one” strategy. When application software and the data it accesses are on two different cloud systems or are distributed between cloud and on-premises platforms, data access times can negatively impact performance. This is a significant problem for applications that require extremely fast response times.
Good practice recommendations: In addition to reviewing their preferred DBMS performance metrics, cloud platform administrators should also focus on monitoring the volumes of data transfer to and from cloud systems. Document all entries and exits and include them in your monitoring strategy. While your store may have estimated data transfer volumes when you initially designed the system, it’s pretty sure that they will change over time.
Here is a list of starter questions to help you identify additional monitoring activities:
- How is the database populated? Is it loaded using flat files or database-to-database data transfers?
- What kind of output does the database generate? Does it create large reports, flat files, or data streams that other applications use as input? One of the most overlooked data transfers is when information from the cloud database is used to refresh other systems.
The goal is to forecast future transfer times and work with network engineers to discuss potential solutions and application development teams to reschedule large data transfers that impact other tasks.
Regulatory compliance reports
DBaaS platforms do not expose their underlying architecture to users. Additionally, recording the evidence that auditors need for compliance with vendor, administrator, and end-user change control procedures can be difficult when using cloud-based database systems.
As a result, organizations that adhere to internal, industry-specific, or government regulatory compliance rules often find that they are unable to provide the supporting evidence their auditors need to verify that the system is meeting regulatory objectives. control of the frame. Regulatory frameworks such as SSAE16 SOC, PCI DSS, NIST, NERC, GDPR, and HIPAA all require system-specific settings and change control information as evidence.
While most of the major cloud platform vendors provide compliance documentation for some of the more common regulatory frameworks, smaller competitors may not provide the level of supporting evidence your organization needs. Additionally, internal and third-party auditors often lose their sense of humor when they ask for specific evidence of compliance and you respond with a generic link to a vendor’s website.
Good practice recommendations: Most organizations that store and process data that is subject to one or more regulatory compliance frameworks have classification procedures that classify data based on its sensitivity. One of the most common issues that affects both cloud and on-premises systems is that sensitive information tends to spread to other data stores across the organization.
When building new cloud database systems or migrating existing databases to cloud platforms, meet with security and audit teams to classify the data and agree on the evidence they need to demonstrate the compliance with regulatory frameworks. Additionally, you will need to perform a thorough review of the cloud provider’s compliance documentation to identify their regulatory agency certifications. One method that will help you meet all compliance frameworks is to create a spreadsheet that contains the following columns:
- Description of the control objective
- Applicable / not applicable
- Description of the evidence required for compliance
- Source of evidence: cloud platform provider, your organization, or both
- Location of evidence, naming conventions, and format
Maintaining business continuity
During the genesis of cloud systems, many in the IT community believed that multiple layers of connectivity, IT platforms, and vendor data redundancy would make outages a thing of the past. We quickly learned from a series of high-profile downtime that no matter how robust the architecture vendors created, our organizations would still need to plan for application outages.
Good practice recommendations: Here are some recommendations that will help you mitigate the impact of cloud service outages. Some of the recommendations may be obvious, but many organizations continue to rely solely on their cloud providers to maintain application availability during an outage.
- Rank your applications according to their criticality. Since the creation of computers, the availability of applications has always been directly linked to the cost and complexity of the system. The higher the level of availability required by your organization for a given application, the more expensive and complex it becomes. How much uptime are you willing to buy?
- Carefully assess the high availability features of the cloud provider. While all of the major cloud platforms provide a robust set of fault protection mechanisms, many of these features will require the customer to purchase, configure, and administer them.
- Reduce the impact of downtime from a single cloud provider by implementing a multi-cloud strategy. The Flexera State of the Cloud 2021 survey of 750 decision makers and cloud users found that 92% of respondents now use multiple cloud platforms.
Like all high-quality disaster recovery and business continuity programs, develop a plan to mitigate the impact of cloud service outages. Design, implement, and test the actions your organization will take in the event of an outage. It’s important to note that in many cases your Average Time to Resolution (MTTR) will be totally dependent on your cloud provider.