The short answer
The right cloud architecture for a business is the simplest option that still meets five real constraints: where data is allowed to live, where users are and how fast responses must be, what the team can operate, what drives cost, and how available the system must be.
This guide gives you a scorecard that turns those five constraints into a decision, compares the common options (single cloud with managed services, multi-region, hybrid or on-premises; serverless, containers or VMs), and notes the Vietnamese data rules to check before choosing a storage region.
Why start from constraints, not technology
Complex architecture is only worth it when it solves a real problem. A single well-configured service with backups and monitoring usually beats a distributed system nobody on the team fully understands.
The frameworks from the three major providers follow the same idea. The Google Cloud Well-Architected Framework recommends using fully managed services where feasible to reduce operational effort, and for new workloads starting simple with a minimal viable product rather than over-engineering. That is why the scorecard below starts from operating constraints rather than a list of services.
The five constraints that shape the architecture
1. Data residency and law
Which data is personal data, which must be stored in Vietnam, which may leave the country and under what procedure. This constraint can rule out regions or providers immediately, so assess it first. Details are in the legal note below.
2. Latency and user location
Are users in one city, across the country or in several countries? Do actions need instant responses (checkout, device control) or can they wait a few seconds (reports)? Are there branches with weak networks that must keep working offline? The answers decide the deployment region and whether you need a CDN, edge processing or an offline mode.
3. Team skills
Who runs the system day to day, including at midnight? Which technologies does the team already know? An architecture the team cannot operate is a risk however good it looks on paper. Small teams usually suit managed services; only teams with platform engineers should consider running Kubernetes or on-premises infrastructure themselves.
4. Cost drivers
You do not need a price list to know where costs come from: always-on versus on-demand resources, how much data is stored and for how long, data transferred out and between regions, software licences, and people's time. Decide whether the workload is steady or highly variable, because that determines pay-as-you-go versus committed capacity. See also cloud cost optimisation.
5. Compliance and availability
What does an hour of downtime cost? How much data loss is acceptable? These are your recovery time objective (RTO) and recovery point objective (RPO), and they decide whether you need multiple availability zones, multiple regions, or just good backups. See backup and disaster recovery for SMEs. Enterprise customer requirements, audit logs and access control also belong here.
The 5-constraint scorecard
Score each constraint from 1 (low requirement) to 3 (high requirement) for your system. The right-hand column shows which way a high score pushes the architecture. It is a discussion tool, not a formula: two conflicting constraints both scoring 3 is a signal that business and engineering need a proper conversation.
| Constraint | Score 1 | Score 3 | A high score points to |
|---|---|---|---|
| Data residency and law | No personal or sensitive data | Personal data, data that must stay in Vietnam, transfers abroad need procedures | Regions or providers with infrastructure in Vietnam, hybrid, clear data classification |
| Latency and users | Internal users, a few seconds is fine | Instant actions, many branches, unreliable networks | Regions close to users, CDN, edge processing, offline mode |
| Team skills | Platform engineers and on-call cover | Small team, nobody on call for infrastructure | Managed services, serverless, few self-run components |
| Cost drivers | Steady, predictable load | Highly variable load or large outbound data transfer | Pay-as-you-go, autoscaling, data placed close to processing |
| Compliance and availability | A few hours of downtime is acceptable | Minutes of downtime cause damage; strict logging and access control | Multiple availability zones, multi-region, a rehearsed recovery plan |
Architecture options and when they fit
Single provider with managed services
One region, multiple availability zones, databases and queues operated by the provider. This fits most small and mid-sized businesses: little operational work and easy monitoring. The trade-off is dependence on one provider, so plan an exit at the data layer (see the end of this guide).
Multi-region
Running in two or more regions to survive a whole-region outage or serve users in several countries. It raises availability but adds complexity: data synchronisation, inter-region transfer costs, and personal data possibly leaving the country. Choose it only when the availability or latency score is genuinely high.
Hybrid or on-premises
Part of the system runs on your own servers or in a domestic data centre, the rest in the cloud. It fits when some data must stay on site, branches must work through network outages, or you already own infrastructure with useful life left. The trade-off is that you operate the hardware and must design synchronisation carefully.
Multi-cloud
Using several providers for one system is rarely a good starting point for SMEs: each platform needs its own skills, monitoring and security. It usually makes more sense to use each provider for a clearly separate purpose.
Serverless, containers or VMs
This is a choice at the compute layer, independent of which provider you pick.
- Default suggestion for small teams: managed containers or serverless, plus a managed database.
- Run your own Kubernetes only when someone owns the platform and there is a specific reason.
| Model | Fits | Strengths | Watch out for |
|---|---|---|---|
| Serverless (functions, managed containers) | Event-driven or spiky load, small teams | No servers to manage, scales on demand, can scale to zero | Execution time limits, cold starts, provider-specific services |
| Containers (Kubernetes or a managed container service) | Many services, standardised deployment, easier provider moves | Consistent packaging, easier to move between environments | Self-run Kubernetes needs significant skill and time |
| Virtual machines | Legacy software, OS-level control, steady load | Familiar, full control | You patch, back up and scale yourself; easy to leave idle machines running |
Use a Well-Architected Framework to review
Once you have chosen an option, review it against your provider's framework. The three frameworks have similar pillars:
- AWS Well-Architected Framework: six pillars of operational excellence, security, reliability, performance efficiency, cost optimization and sustainability.
- Azure Well-Architected Framework: five pillars of reliability, security, cost optimization, operational excellence and performance efficiency.
- Google Cloud Well-Architected Framework: pillars covering security, reliability, performance, cost, operations and sustainability.
Using it in practice
Do not try to meet every recommendation at once. Pick the pillars tied to your constraints that scored 3, record the risks you find, and decide which to fix now and which to accept with a note. Microsoft Learn also stresses that pillars involve trade-offs; for example, more reliability usually means more cost.
Data residency under Vietnamese law
Vietnam's Law on Personal Data Protection No. 91/2025/QH15 took effect on 1 January 2026. Under Article 20(1), cross-border transfer of personal data includes: moving personal data stored in Vietnam to storage systems outside Vietnam; an organisation in Vietnam transferring personal data to an organisation or individual abroad; and using a platform outside Vietnam to process personal data collected in Vietnam. In other words, putting customer data in a cloud region abroad can fall under this article.
Article 20(2) requires the transferring party to prepare a cross-border transfer impact assessment and send it to the specialised agency within 60 days of the first transfer, except in the cases listed in clause 6. One of those exceptions is an organisation storing its own employees' personal data on a cloud service. Government regulations set out the details; see our article on Vietnam's 2025 Personal Data Protection Law.
On storing data in Vietnam: the Law on Cybersecurity No. 116/2025/QH15 took effect on 1 July 2026, replacing the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. Two provisions of Article 25 matter here. Article 25(2)(d) requires domestic and foreign businesses providing telecoms, internet and value-added online services in Vietnam to retain users' personal information and user-generated data (account name, usage time, payment information, access IP addresses and similar) for the period set by law after the user stops using the service. Article 25(3) requires businesses that collect, exploit, analyse or process personal data, relationship data or data created by users in Vietnam to store that data in Vietnam for the period set by the Government; foreign businesses in this group must open a branch or representative office. According to an analysis in Vietnam Lawyers Magazine, not every case requires a branch. The Government sets the details; Decree 53/2022/ND-CP was the guidance under the old law, so check which implementing regulations are in force when you deploy.
What this means for architecture: classify data from the start (personal data, user-generated data, operational data), record the storage region for each class including backups and logs, and check whether services replicate data to other regions automatically.
This article is for information only and is not legal advice.
Avoiding lock-in without paying twice
Portability matters most at the data and identity layers. Use standard data formats, have a tested way to export data, and avoid provider-specific features where the benefit is marginal. Full portability is not free: choose the parts that must be portable and accept the rest.
Write a one-page exit plan: where data lives, how it is exported, who can do it, and what breaks first if the provider has an outage. It is cheap insurance and a useful design review.
A six-step decision process
Illustrative example: a retail chain with many stores, unreliable networks at some locations and a three-person IT team. The scorecard puts latency and team skills at 3, and law at 3 because of customer data. A sensible option is one provider with a region that fits the storage requirements, managed database services, and a point-of-sale app with an offline mode in stores. This is a hypothetical scenario, not a specific customer project.
- List workloads and data; classify personal data and data that must stay in Vietnam.
- Score the five constraints with business and engineering representatives together.
- Choose the simplest option that satisfies the constraints that scored 3.
- Set RTO and RPO targets and check the backup and recovery approach.
- Review against the chosen provider's Well-Architected Framework.
- Record the architecture decision (context, options, choice, consequences) and the exit plan; revisit when constraints change.
How EYC helps
EYC advises on and builds cloud and data infrastructure for businesses, starting from operating constraints rather than technology. See cloud and data infrastructure, software and SaaS, or contact EYC.
Frequently asked questions
Which cloud architecture should a small or mid-sized business choose?
Usually one provider with managed services, deployed across multiple availability zones in one region, with backups whose restore has been tested. Add multi-region, hybrid or Kubernetes only when the scorecard shows a specific constraint requires it.
Is serverless better than containers?
Neither is better in general. Serverless suits event-driven load and small teams; containers suit many services that need standardised deployment or easier provider moves. Many systems use both.
Is it illegal to store data in a foreign cloud region?
Not automatically, but it can count as a cross-border transfer of personal data under Article 20 of Law 91/2025/QH15, which requires a transfer impact assessment unless an exception applies. Businesses providing online services in Vietnam may also have to store data in Vietnam under Article 25(3) of the 2025 Cybersecurity Law. Get legal advice for your specific case.
When do I need a hybrid cloud?
When some data must stay on site, branches must work through network outages, or you already own infrastructure with useful life left. Without those reasons, hybrid usually adds operational work without adding value.
What is a Well-Architected Framework?
A set of architecture principles and review questions published by AWS, Microsoft Azure and Google Cloud, organised into pillars such as security, reliability, performance, cost and operations. Use it to review a design after choosing an option, not as a replacement for defining your constraints.