Application modernization is quickly becoming one of the pillars of successful digital transformation and cloud migration initiatives. Many organizations are becoming aware of the dramatic benefits that can be achieved by moving legacy, on-premises apps and databases into cloud native infrastructure and services, such as reduced Total Cost of Ownership (TCO), elimination of expensive commercial software licenses, and improved performance, scalability, security and availability.

The complexity of applications and databases to a cloud-centric architecture requires a rapid, accurate, and customized assessment of modernization potential and identification of challenges. Addressing business and functional drivers, TCO calculations, uncovering technological challenges and cross-platform incompatibilities, preparation of migration, and rollback plans can be essential to the success and outcome of the migration. 

These cloud migration initiatives are often divided into three high-level phases: 

1. Discovery: identifying and cataloging the source inventory. Output is usually an inventory of source apps, databases, servers, networking, storage, etc. The discovery of existing assets within a data center is usually straightforward and can often be highly automated. 
2. Pre-migration readiness: the planning phase. This includes the analysis of the current portfolio of the databases and applications for migration readiness, determining the target architecture, identifying technological challenges or incompatibilities, calculating TCO, and preparing detailed migration plans. 
3. Migration execution: where the rubber hits the road. During this phase of the migration process, database schemas are actively converted, the application data access layer is refactored, data is replicated from source to target, often in real-time, and the application is deployed in its determined compute platform(s). 

Successful evaluation and planning phase as part of the pre-migration readiness phase can bolster confidence in investment towards modernization. Skipping or inaccurately completing the pre-migration phase can lead to a costly and sub-optimal result. Relying on manual pre-migration assessments can lead to long migration timelines, reduced success rates and poor confidence in the post-migration state, increased risk and total migration cost.

Some of the commonly asked question during pre-migration include:

1. How compatible are my source databases, which are often commercial and proprietary in nature, with their open-source cloud-native alternatives? For example, how compatible are my Oracle workloads and usage patterns with Cloud SQL for PostgreSQL?
2. What’s my degree of vendor lock-in with my current technology stack? Are proprietary features and capabilities being used that are incompatible with open-source database technologies?
3. How tightly-coupled are my applications with my current database engine technology? Can my applications be deployed as-is, refactored for cloud readiness with ease, or will it be a big undertaking?
4. How much effort will my migration require? How expensive will it be? What will be my run-rate in Google Cloud post-migration and my ROI?
5. Can we identify quick-win applications and databases to start with?

There is a direct association between the accuracy and speed of the pre-migration phase and the outcome of the migration itself. The faster and more accurately organizations complete the required pre-migration analysis, the more cost efficient and successful the migration itself will usually be.  

EPAM Systems, Inc., a leader in digital transformation, worked with Google Cloud as a preferred partner to accelerate cloud migrations beginning with pre-migration assessments. Leveraging EPAM’s migVisor for Google Cloud—a unique pre-migration accelerator that automates the pre-migration process—and EPAM’s consulting and support services, organizations can quickly generate a cloud migration roadmap for rapid and systematic pre-migration analysis. This approach has resulted in the completion of thousands of database assessments for hundreds of customers.

migVisor is agentless, non-intrusive, and hosted in the EPAM cloud. migVisor seamlessly connects to your source databases and runs SQL queries to ascertain the database configuration, code, schema objects and infrastructure setup. Scanning of source databases is done rapidly and without interruption to production workloads.

migVisor prepares customers to land applications in Google Cloud and its managed suite of databases services and platforms such as Cloud SQL, bare metal hosting, Spanner and Cloud Bigtable. migVisor supports re-hosting (lift-and-shift), re-platforming, and re-factoring.  

“EPAM’s recent application assessment update to its migration tooling system, migVisor, will bring a new level of transparency to the entire application and database modernization process”,  said Dan Sandlin, Google Cloud Data GTM Director at Google Cloud. “This enables organizations to make the most of digital technologies and provides a clear IT ecosystem transformation that allows our customers to build a flexible foundation for future innovation.”

Previously, migVisor focused on assessments of the source databases and the compatibility of customers’ existing database portfolio with cloud-centric database technologies. Coming this quarter, migVisor adds support for application assessments, augmenting its existing and class-leading capabilities in the database space. 

The addition of application modernization assessment functionality in migVisor, combined with EPAM’s certification and specialization in Google Cloud Data Management and hands-on engineering experience, strengthens EPAM’s position as a leader for large-scale digital transformation projects and migVisor as a trusted product for cloud migration assessments to Google Cloud customers. EPAM provides customers an end-to-end solution for faster and more cost-effective migrations.  Assessments that used to take weeks can now be completed in mere days. 

Within minutes of registering for an account, anyone can start using migVisor by EPAM to automatically assess applications and application code. Visit the migVisor page to learn more and sign up for your account.

Organizations in every region and industry are developing APIs to enable easier and more standardized delivery of services and data for digital experiences. This increasing shift to digital experiences has grown API usage and traffic volumes. However, as malicious API attacks also have grown, API security has become an important battleground over business risk.

To help customers more easily address their growing API security needs, Google Cloud is announcing today the Preview of Advanced API Security, a comprehensive set of API security capabilities built on Apigee, our API management platform. Advanced API Security enables organizations to more easily detect security threats. Here’s a closer look at the two key functionality included in this launch: identifying API misconfigurations and detecting bots.

Identify API misconfigurations

Misconfigured APIs are one of the leading reasons for API security incidents. In 2017, Gartner® predicted that by 2022 API abuses will be the most frequent attack vector resulting in data breaches for enterprise web applications. Today, our customers tell us application API security is one of their top concerns, which is supported by an independent study from 2021 by Fugue and Sonatype. The report found that misconfigurations are the number one cause of data breaches, and that “too many cloud APIs and interfaces to adequately govern” are frequently the main point of attack in cyberattacks.

While identifying and resolving API misconfigurations is a top priority for many organizations, the configuration management process can be time consuming and require considerable resources.

Advanced API Security can make it easier for API teams to identify API proxies that do not conform to security standards. To help identify APIs that are misconfigured or experiencing abuse, Advanced API Security regularly assesses managed APIs and provides API teams with a recommended action when configuration issues are detected.

Advanced API Security identifies misconfigured API proxies, including the missing CORS policy.
APIs form an integral part of the digital connective tissue that make modern medicine run smoothly for patients and healthcare staff. One common healthcare API use case occurs when a healthcare organization inputs a patient’s medical coverage information into a system that works with insurance companies. Almost instantly, that system determines the patient’s coverage for a specific medication or procedure, a process which is enabled by APIs. Because of the often-sensitive personal healthcare data being transmitted, it is important that the required authentication and authorization policies are implemented so that only authorized users, such as an insurance company, can access the API.

Advanced API Security can detect if those required policies have not been applied, an alert which can help reduce the surface area of API security risks. By leveraging Advanced API Security, API teams at healthcare organizations can more easily detect misconfiguration issues and can reduce security risks to sensitive information.

Detect Bots

Because of the increasing volume of API traffic, there is also an increase in cybercrime in the form of API bot attacks—the automated software programs deployed over the Internet for malicious purposes like identity theft.

Advanced API Security uses pre-configured rules to help provide API teams an easier way to identify malicious bots within API traffic. Each rule represents a different type of unusual traffic from a single IP address. If an API traffic pattern meets any of the rules, Advanced API Security reports it as a bot.

Additionally, Advanced API Security can speed up the process of identifying data breaches by identifying bots that successfully resulted in the HTTP 200 OK success status response code.

Financial services APIs are frequently the target of malicious bot attacks due to the high-value data that is processed. A bank that has adopted open banking standards by making APIs accessible to customers and partners can use Advanced API Security to make it easier to analyze traffic patterns and identify the sources of malicious traffic. You may experience this when your bank allows you to access your data with a third-party application. While a malicious hacker could try to use a bot to access this information, Advanced API Security can help the bank’s API team to identify and stop malicious bot activity in API traffic.

API Security at Equinix

Equinix powers the world’s digital leaders, bringing together and interconnecting infrastructure to fast-track digital advantage. Operating a global network of more than 240 data centers with a 99.999% or greater uptime, Equinix simplifies global interconnections for organizations, saving customers time and effort with the Apigee API management platform.

“A key enabler of our success is Google’s Apigee, delivering digital infrastructure services securely and quickly to our customers and partners,” said Yun Freund, senior vice president of Platform at Equinix. “Security is a key pillar to our API-first strategy and Apigee has been instrumental in enabling our customers to securely bridge the connections they need for their businesses to easily identify potential security risks and mitigate threats in a timely fashion. As our API traffic has grown, so has the amount of time and effort required to secure our APIs. Having a bundled solution in one managed platform gives us a differentiated high-performing solution.”

Getting started

To learn more, check out the documentation or contact us to request access to get started with Advanced API Security.

To learn more about API security best practices, please register to attend our Cloud OnAir webcast on Thursday, July 28th, 2:00 pm PT.

Google Cloud Results

• Reduced API management costs 34%
• Develops new features in days versus months
• Fixes issues quickly by writing code
• Manages 15B API calls per month without outages

Austin, Texas-based Bazaarvoice switched to Apigee for its API platform because of its competitive pricing and feature set. But another benefit soon became apparent to Bazaarvoice engineers: the ability to write code on the Apigee platform and “own our destiny,” says Kurtis White, Senior Development Manager in Research and Development for Bazaarvoice.

Bazaarvoice specializes in consumer-generated content marketing solutions that connect brands, retailers, and consumers. APIs do the heavy lifting in making those connections. For example, the Conversations API, the heart of the Bazaarvoice platform, lets the company’s retail clients aggregate and leverage users’ product reviews and ratings. With the Conversations API, API keys are passed along in each query string and enable Bazaarvoice customers to access the relevant customer data.

APIs are essential to the Bazaarvoice platform. During its early days the company didn’t use APIs, relying instead on direct communication links to connect its customers to what consumers were saying about them. “That approach just didn’t scale,” says White. “Without reliable APIs, it would be almost impossible for us to be in business today.”

Eight years ago, Bazaarvoice switched to APIs. From about 2013 to 2017, the company relied upon the same API management SaaS solutions provider. But the company was growing. The call volume that its APIs generated was expanding at a rapid pace, too—especially during the busy year-end shopping season. For example, in early October 2016, Bazaarvoice APIs generated nearly 9 billion calls, compared to about 12 billion calls in early December 2016.

Unfortunately, along with the pace of API calls, the costs associated with Bazaarvoice’s existing API solutions provider were also escalating—increasing 74% from early 2016 to early 2017. To keep rising expenses from stifling its own growth, and to continue offering its reliable, high-performing SaaS solution, the company’s IT team decided it was to time to find a different API solutions provider.

In April 2017, Bazaarvoice migrated to the Apigee API platform because of its feature set and, in particular, its competitive pricing. By switching to Apigee, Bazaarvoice reduced its API spend by 34%, White says.

A ticking clock

Migrating from its previous API provider to Apigee involved importing 66,000 API keys—an arduous task. Apigee engineers and business leaders worked directly with their Bazaarvoice counterparts to help ensure a successful transition. “Everyone at Apigee was very responsive to our needs,” White says. “If a problem came up, the Apigee team owned it and worked through it to give us a great experience.”

During the migration, there was a clock ticking in the background. Bazaarvoice wanted to shift 100% of its API calls to Apigee before the contract with its existing API provider came up for renewal. “I wasn’t sure we could make the deadline,” says White. “But we did, and I give a big credit to the Apigee technical team. They provided 24-hour support to our team. And once we went live, our platform was handling 15 billion API calls a month with no outages.”

Following the migration, Apigee support continues to “knock it out of the park,” he added. “Apigee is a great partner to have.”

Controlling destiny

The Bazaarvoice IT team didn’t specifically choose Apigee because of the ability to write code on the platform—but they quickly came to appreciate the feature.

“Our previous API provider was like a black box to us,” says White. “They had written some custom code for us that we depended upon. But we didn’t own that code. And if we needed changes, we had to pay them to do it for us.”

“Apigee allows us to write our own code that runs on the platform and looks at all of the API calls,” White continues. “We can put the code into a virtual control system. We can update it whenever we want to add a feature. Because of how important APIs are to our business, the ability to write code on Apigee lets us control our own destiny. It’s the Apigee number one benefit, in my opinion.” This also accelerates the time it takes Bazaarvoice to bring new features to market.

“Apigee gives us the flexibility to do things we wouldn’t have even tried before,” says White. “We can test new things easily, without getting locked into a service agreement with an external party. Before, it might have taken months to develop new product functionalities. Now it takes days.”

In addition, writing code on the Apigee platform enables the IT team to quickly address any problems that may arise. “If someone notices a problem, we can write the code to fix it right away,” White says.

“Because Apigee lets us iterate and fix problems quickly, our innovation has gone to the next level,” White added. “Before, if you had an idea, you’d wonder if you really wanted to invest $30,000 and three months in it. Probably not. Now, with Apigee, the investment is maybe one day and zero dollars.”

Experimentation pays off for Bazaarvoice and its customers. For example, during the 2017 holiday season, Bazaarvoice was able to give all its customers the capacity to handle twice the number of API calls.

“With our previous API solutions provider, it would have been such a long process to make that happen, it wouldn’t have been worth it,” says White. “But it was really easy to write the code in Apigee. Plus, we made our customers happy and kept them running smoothly during the peak holiday season—with little effort on our part.”

Personalization and monetization

Apigee has played a key role in enabling Bazaarvoice to develop new products, too. In March 2018, Bazaarvoice released a new personalization data product for its customers, built on top of an Apigee-powered API. The new product enables Bazaarvoice retail customers to recommend relevant products to their online shoppers. The products are personalized to the shoppers’ interests, based on their past behavior and what they’re shopping for.

Apigee is also serving as a strategic business advisor, helping Bazaarvoice determine the best way to price its offerings as its API call volumes continue to increase.

“We’re working with Apigee to build an industry-leading model for monetizing our APIs,” says White. “Apigee is the ideal advisor in this regard. We’re handling such large volume, the volume is continuing to grow, and Apigee enables us to power it.”

To help improve your security posture, improve the reliability of your applications, and reduce configuration drift in your environment, we’re excited to announce a new Anthos reference architecture.

Written in collaboration across our product, engineering, support, and field teams, this new reference architecture helps you plan, deploy, and configure the required components for Anthos hybrid environments.

Anthos hybrid environments give you the flexibility to deploy on-premises components that run container-based workloads and VMs using Anthos clusters on VMware and Anthos clusters on bare metal. You can continue to utilize existing investments in your on-premises infrastructure, and start to add components like Anthos Config Management. When you’re ready to bring everything together, you can add additional Google Cloud-based services like Artifact Registry, Cloud Monitoring, and Identity and Access Management (IAM).

The following sneak peek covers some of our best practices for architecting an Anthos hybrid environment. For more detailed guidance and planning information, see the full Anthos hybrid environment reference architecture.

When you design and deploy an Anthos hybrid environment, we recommend that you use two or more on-premises computing customer sites and two or more Google Cloud regions. In your sites, run multiple clusters. This approach is recommended for several reasons, such as:

• Disaster recovery. If one cluster or site fails, you can continue to run workloads.
• Multiple environments, like production and staging, to test infrastructure changes.
• Different cluster types in each environment: admin clusters and user clusters. This approach separates administrative resources, which is a security best-practice.

The following diagram shows an example of an Anthos hybrid environment that’s spread across customer sites and regions, with different clusters for admin and user workloads and for production and staging:

In each site, you can use Anthos clusters on VMware or Anthos clusters on bare metal. For both products, we recommend the following:

• Use a highly available (HA) control plane with three members for continued control plane availability concurrently with operating system upgrades, control plane software updates, or single-machine hardware or kernel failures.
• Deploy two admin clusters so that admin cluster configuration changes and updates can be tested in the staging environment first.

The following diagram shows an example of Anthos clusters on bare metal with control plane and worker nodes spread across physical machines. With Anthos clusters on VMware, the control plane and worker nodes are spread across VMware VMs:

Configure your on-premises clusters and applications to send logging and monitoring data back to Google Cloud for analysis and review. Different personas should only be granted access to the environments they need. The following diagram shows how application developers and application or platform operators can then view logging and monitoring data in Google Cloud:

Use Anthos Config Management to manage Kubernetes objects in your clusters. Anthos Config Management is a GitOps-style tool that uses a Git repository or Open Container Initiative (OCI) as its storage mechanism and source of truth. Git provider workflows allow multiple stakeholders to participate in review of changes.

As shown in the following diagram, a common Anthos Config Management deployment uses one folder containing configuration for all clusters. Use separate additional folders to hold configuration data, one for application:

Plan and implement a way to secure the network traffic in your Anthos hybrid environment. The following services help with authentication, connectivity, and communication in a cluster:

• Anthos Identity Service connects clusters to on-site identity providers to authenticate local access.
• Connect gateway and workforce identity federation can provide secure cloud-mediated access to mobile workforce clusters without using a VPN.
• Workload Identity provides on-premises workloads with managed short-lifetime credentials for access to cloud resources.
• Anthos Service Mesh encrypts and controls communication between services in the same cluster.

The following diagram shows how Anthos Service Mesh can control the flow of traffic between services within your clusters:

You don’t have to implement all these cloud-based services as part of your initial on-premises deployments. As you become more comfortable and want to expand your capabilities, you can add in some of these hybrid offerings. But, we hope that this blog post has given you some ideas to think about when you start to plan and design your own Anthos hybrid environments.

For more detailed guidance and planning information, see the full Anthos hybrid environment reference architecture. Let us know what you think!