# Cloud Workload Placement Checklist

**Workload:** _______________  **Date:** _______

> Decide **per workload**. Blanket policies are expensive in either direction — roughly a fifth of
> everything moved to public cloud has since been pulled back.

## 1. Profile this workload

- [ ] Load pattern recorded: steady / variable / spiky / seasonal
- [ ] Utilisation measured, not assumed
- [ ] Data egress volume estimated
- [ ] Availability requirement stated
- [ ] Data residency requirement stated
- [ ] Expected lifetime stated

## 2. Cloud is likely right if

- [ ] Load is variable or unpredictable
- [ ] It needs services you would not build yourself
- [ ] It is new and may not survive
- [ ] It needs global reach
- [ ] It is a disaster recovery standby

## 3. Owned is likely right if

- [ ] **Steady, predictable, always-on load**
- [ ] High and constant data egress
- [ ] Storage- or compute-heavy with stable demand
- [ ] **Production AI inference at volume** — steady, high-volume, and where per-token pricing bites hardest

**Decision:** Cloud / Owned / Hybrid  ·  **By:** _______  ·  **Reviewed:** _______

## 4. Portability — what makes a later change possible

- [ ] Data is exportable, and the export has been **tested**
- [ ] Application containerised
- [ ] Infrastructure described in code
- [ ] Standard database engine where the difference from proprietary is small
- [ ] For each proprietary service: **if this vanished, how long to replace it?** ______

> Weeks is an acceptable answer. If it is measured in quarters, that service is load-bearing — treat
> the dependency as a decision requiring sign-off, not a default.

## 5. Cost controls

- [ ] **Budget alerts set before the first workload**
- [ ] **Mandatory tags**: owner, environment, cost centre — untagged resources are never deleted because nobody dares
- [ ] **Non-production switched off outside working hours**, automated
- [ ] Retention policies on logs, snapshots, backups
- [ ] Orphaned resources audited: unattached disks, IPs, idle load balancers
- [ ] Right-sized against measured usage, not the guessed specification
- [ ] Reserved capacity committed only to a provable baseline
- [ ] **Top ten line items reviewed monthly** with someone who can explain each
- [ ] **A named person owns the bill**

## 6. The costs that surprise people

- [ ] Data transfer out — charged per GB by every provider
- [ ] Cross-availability-zone traffic
- [ ] Stopped instances still billing for storage
- [ ] Unattached IP addresses
- [ ] Load balancers with no traffic
- [ ] NAT gateway — hourly *and* per-GB
- [ ] Managed-service premiums on workloads that did not need managing

## 7. Security

- [ ] Shared responsibility understood — **they secure the platform, you secure the configuration**
- [ ] Public storage access blocked by default
- [ ] MFA on privileged accounts
- [ ] Encryption at rest enabled
- [ ] Audit logging on, ideally to a separate account

## 8. Avoid the two expensive mistakes

- [ ] **Not lift-and-shifting unchanged** — captures almost none of the benefit and adds the rental margin
- [ ] **Not running multi-cloud to avoid lock-in** without a specific reason — the complexity of both, the discounts of neither

## Sign-off

| | Name | Date |
|---|---|---|
| Completed by | | |
| Cost owner | | |