Amazon VPC trojan horse finds its mark: Private Cloud

Now we've all had a chance to digest the Amazon Virtual Private Cloud announcement and the dust has settled I'm joining the fray with a "scoop of interpretation". Positioned as "a secure and seamless bridge between a company’s existing IT infrastructure and the AWS cloud" the product is (like Google's Secure Data Connector for App Engine which preceded Amazon VPC by almost 6 months) quite simply a secure connection back to legacy infrastructure from the cloud - nothing more, nothing less. Here's a diagram for those who prefer to visualise (Virtual Private Cloud.svg on Wikimedia Commons):

Notice that "private cloud" (at least in the sense that it is most often [ab]used today) is conspicuously absent. What Amazon and Google are clearly telling customers is that they don't need their own "private cloud". Rather, they can safely extend their existing legacy infrastructure into the [inter]cloud using VPN-like connections and all they need to do to get up and running is install the software provided or configure a new VPN connection (Amazon uses IPsec).

Remember, a VPN is the network you have when you're not having a network - it behaves just like a "private network" only it's virtual. Similarly a VPC is exactly that: a virtual "private cloud" - it behaves like a "private cloud" (in that it has a [virtual] perimeter) but users still get all the benefits of cloud computing - including trading capex for opex and leaving the details to someone else.

Also recall that the origin of the cloud was network diagrams where it was used to denote sections of the infrastructure that were somebody else's concern (e.g. a telco). You just needed to poke your packets in one side and [hopefully] they would reappear at the other (much like the Internet). Cloud computing is like that too - everything within the cloud is somebody else's concern, but if you install your own physical "private cloud" then that no longer holds true.

Of course the "private cloud" parade (unsurprisingly consisting almost entirely of vendors who peddle "private cloud" or their agents, often having some or all of their existing revenue streams under direct threat from cloud computing) were quick to jump on this and claim that Amazon's announcement legitimised "private cloud". Au contraire mes amis - from my [front row] seat the message was exactly the opposite. Rather than "legitimis[ing] private cloud" or "substantiating the value proposition" they completely undermined the "private cloud" position by providing a compelling "public cloud" based alternative. This is the mother of all trojan horses and even the most critical of commentators wheeled it right on in to the town square and paraded it to the world.

Upon hearing the announcement Christofer Hoff immediately claimed that Amazon had "peed on [our] fire hydrant" and Appistry's Sam Charrington chimed in, raising him by claiming they had also "peed in the pool" ([ab]using one of my favourite analogies). Sam went on to say that despite having effectively defined the term Amazon's product was not, in fact, "virtual private cloud" at all, calling into question the level of "logical isolation". Reuven Cohen (another private cloud vendor) was more positive having already talked about it a while back, but his definition of VPC as "a method for partitioning a public computing utility such as EC2 into quarantined virtual infrastructure" is a little off the mark - services like EC2 are quarantined by default but granular in that they don't enforce the "strong perimeter" characteristic of VPCs.

Accordingly I would (provisionally) define Virtual Private Cloud (VPC) as follows:

Virtual Private Cloud (VPC) is any private cloud existing within a shared or public cloud (i.e. the Intercloud).

This is derived from the best definition I could find for "Virtual Private Network (VPN)"