Jongkil Jay Jeong, Senior Fellow, School of Computing and Information System, The University of Melbourne
The world’s largest cloud computing platform, Amazon Web Services (AWS), has experienced a major outage that has impacted thousands of organisations, including banks, financial software platforms such as Xero, and social media platforms such as Snapchat.
The outage began at roughly 6pm AEDT on Monday. It was caused by a malfunction at one of AWS’ data centres located in Northern Virginia in the United States. AWS says it has fixed the underlying issue but some internet users are still reporting service disruptions.
This incident highlights the vulnerabilities of relying so much on cloud computing – or “the cloud” as it’s often called. But there are ways to mitigate some of the risks.
Renting IT infrastructure
Cloud computing is the on-demand delivery of diverse IT resources such as computing power, database storage, and applications over the internet. In simple terms, it’s renting (not owning) your own IT infrastructure.
Cloud computing came into prevalence with the dot com boom in the late 1990s, wherein digital tech companies started to deliver software over the internet. As companies such as Amazon matured in their own ability to offer what’s known as “software as a service” over the web, they started to offer others the ability to rent their virtual servers for a cost as well.
This was a lucrative value proposition. Cloud computing enables a pay-as-you-go model similar to a utility bill, rather than the huge upfront investment required to purchase, operate and manage your own data centre.
As a result, the latest statistics suggest more than 94% of all enterprises use cloud-based services in some form.
A market dominated by three companies
The global cloud market is dominated by three companies. AWS holds the largest share (roughly 30%). It’s followed by Microsoft Azure (about 20%) and Google Cloud Platform (about 13%).
All three service providers have had recent outages, significantly impacting digital service platforms. For example, in 2024, an issue with third-party software severely impacted Microsoft Azure, causing extensive operational failures for businesses globally.
Google Cloud Platform also experienced a major outage this year due to an internal misconfiguration.
Profound risks
The heavy reliance of the global internet on just a few major providers — AWS, Azure, and Google Cloud — creates profound risks for both businesses and everyday users.
First, this concentration forms a single point of failure. As seen in the latest AWS event, a simple configuration error in one central system can trigger a domino effect that instantly paralyses vast segments of the internet.
Second, these providers often impose vendor lock-in. Companies find it prohibitively difficult and expensive to switch platforms due to complex data architectures and excessively high fees charged for moving large volumes of data out of the cloud (data egress costs). This effectively traps customers, leaving them hostage to a single vendor’s terms.
Finally, the dominance of US-based cloud service providers introduces geopolitical and regulatory risks. Data stored in these massive systems is subject to US laws and government demands, which can complicate compliance with international data sovereignty regulations such as Australia’s Privacy Act.
Furthermore, these companies hold the power to censor or restrict access to services, giving them control over how firms operate.
The current best practice to mitigate these risks is to adopt a multi-cloud approach that enables you to decentralise. This involves running critical applications across multiple vendors to eliminate the single point of failure.
This approach can be complemented by what’s known as “edge computing”, wherein data storage and processing is moved away from large, central data centres, toward smaller, distributed nodes (such as local servers) that firms can control directly.
The combination of edge computing and a multi-cloud approach enhances resilience, improves speed, and helps companies meet strict data regulatory requirements while avoiding dependence on any single entity.
As the old saying goes, don’t put all of your eggs in one basket.
Jongkil Jay Jeong received prior funding from the Cyber Security Cooperative Research Centre and Department of Foreign Affairs and Trade, Australia.
