Cloud Network Architecture Upgrade. @cloud-network-upgrade

Cloud networks accrete: peerings added under pressure, public endpoints that were temporary, security groups nobody dares touch. This package redesigns the network architecture for a defined environment, VPC or VNet structure, routing, private connectivity, ingress and egress, and segmentation, and migrates onto it in stages. The finish state is a network where traffic paths are intentional, documented, and enforced.

The sprint maps current-state traffic honestly, designs the target topology, hub-and-spoke or segmented flat, private endpoints over public exposure, controlled egress, and executes a staged cutover that avoids big-bang risk. Everything lands as infrastructure-as-code.

Current-state map and target design

Real traffic flows documented, then a target topology with explicit segmentation boundaries.

Private connectivity

Private endpoints and service connectivity replacing unnecessary public exposure.

Ingress and egress control

Centralised, inspected entry and exit paths with rules your team can reason about.

Staged migration as code

The new network delivered as infrastructure-as-code and adopted in low-risk stages.

1. Scope: map current flows and dependencies, agree the target design and migration stages.
2. Build: implement the target network as code and migrate workloads stage by stage.
3. Handover: verify traffic paths and segmentation, hand over diagrams, code, and runbooks.

The Cloud Network Architecture Upgrade is a menu item on the Scrums.com delivery catalog, available at every plan tier. Add it to your plan backlog and your delivery team schedules it like any other item — scoped, tracked, and reported through the SEOP. See Delivery Plan Tiers.

Can this be done without an outage?

The staged approach is designed for it: each stage moves a bounded set of workloads with a tested reversal. Where a brief window is unavoidable, it is named in the plan, never discovered during it.

Does this cover on-premise connectivity?

Yes, where in scope: VPN or dedicated interconnect patterns to your sites are part of the target design if the environment requires them.

How does this relate to security work?

Segmentation and controlled egress are security controls, and this package implements them. A broader review of the estate's security posture is the Cloud Security Assessment menu item.