AM
Ankit Mehta
Founder · VigilesHQ · CloudArch Pro
Ankit Mehta founded CloudArch Pro and Vigiles. His work covers cloud architecture, FinOps, database platforms and incident operations for production systems in APAC. He writes the technical library on this site and reviews consulting deliverables. Distributed SQL and OceanBase writing lives on OceanDB Pro.
Founder and technical author for CloudArch Pro. Founder of Vigiles (vigileshq.com).
He reviews CloudArch Pro consulting deliverables. Claims on this site are cited to official provider documentation or stated as engineering recommendations. See editorial methodology. Distributed SQL and OceanBase writing is on OceanDB Pro.
Credentials
- FinOps Certified Engineer , FinOps Foundation
- FOCUS Certified Analyst , FinOps Foundation
- Alibaba Cloud MVP (7 times) , Alibaba Cloud
- AWS Community Builder (5 times) , AWS
Speaking
- OpenSearchCon
- AWS Summit
Subjects
- Cloud architecture
- FinOps
- Kubernetes
- Alibaba Cloud ACK
- Amazon EKS
- OpenTofu
- Observability
- Incident management
Technical topics
- Production landing zones and account structure
- Hub-and-spoke networking and egress cost
- FinOps allocation and cost-anomaly response
- AI and GPU workload unit cost
- Multi-cloud identity and APAC region design
- Alibaba Cloud ACK, OpenTofu state and private GitOps
Profiles
Published on CloudArch Pro
- Guide
What a Cross-Cloud Security Incident Changed in Our Kubernetes Rebuild
A compromise across AWS and Alibaba Cloud exposed gaps in identity, audit logs, network evidence and recovery. This guide explains the architecture changes made before the Kubernetes rebuild.
- Guide
OpenTofu remote state and private GitOps on Alibaba Cloud
Move OpenTofu state to a private versioned OSS bucket with TableStore locking, then run Argo CD as ClusterIP against a private ACK API for shared applies.
- Guide
Alibaba Cloud ACK node pools: subscription, Spot and autoscaling
Keep ACK system pools on subscription and scale a multi-zone Spot application pool only after role, KMS, SLB quota and instance-stock checks pass.
- Guide
How Qwen models work: tokens, embeddings, attention and scaling laws
How Qwen turns text into tokens, embeddings and a next-token guess, why Thai costs twice the tokens of English, and what scaling laws mean for model choice.
- Guide
Building Secure Alibaba Cloud ACK Platforms
Build private Alibaba Cloud ACK clusters with OpenTofu, secure node pools, Spot autoscaling, OSS state locking and private Argo CD.
- Guide
Build a secure Alibaba Cloud ACK cluster with OpenTofu
Plan a private ACK Pro cluster in ap-southeast-1 with OpenTofu: CIDR ownership, Terway ENIIP, RRSA, encrypted disks, NAT egress and a private API.
- Guide
Prompt engineering with Qwen on Alibaba Cloud Model Studio
Prompt Qwen on Alibaba Cloud Model Studio with zero-shot, few-shot, thinking mode, JSON output, temperature, top_p and top_k, with a runnable test for each.
- Guide
Choosing a Primary Cloud Region for APAC Workloads
A practical framework for selecting AWS, Azure, Google Cloud or Alibaba Cloud regions using user location, data residency, service availability, connectivity, cost and disaster recovery requirements.
- Runbook
Kubernetes cluster cost increase
Separate control-plane fees from node, volume, load-balancer and egress cost when a cluster bill jumps.
- Guide
GPU and AI workload cost governance
Unit cost for training and inference, idle GPU time, and how reservations differ from general compute FinOps.
- Guide
Generative AI on Alibaba Cloud
A chapter-by-chapter series that applies Generative AI on AWS to Alibaba Cloud Model Studio, PAI and Qwen, with runnable demos and token cost for each step.
- Guide
Generative AI on Alibaba Cloud: use cases, Qwen models and the project life cycle
Map the generative AI project life cycle to Alibaba Cloud Model Studio and PAI, pick a Qwen model by cost and context, and make a first API call from Singapore.
- Guide
Alibaba Cloud architecture for APAC workloads
Resource Directory, RAM, CEN and VPC design for APAC on Alibaba Cloud, including Singapore and China mainland regions.
- Guide
Cloud migration readiness assessment
What to inventory, decide and refuse before you move production systems to AWS, Azure or Google Cloud.
- Runbook
Cross-region traffic cost increase
Separate inter-AZ, inter-region and internet egress on the bill, then find the copy or failover path that grew.
- Runbook
Cloud quota exhaustion
Identify the quota that blocked a create or scale call, then request an increase or change the design without guessing the limit.
- Runbook
DNS routing failure
Diagnose hosted-zone, resolver and health-check failures on Route 53, Azure DNS, Cloud DNS and Alibaba Cloud DNS.
- Runbook
Autoscaling Failure Across Four Cloud Providers
Separate a policy that never fired from quota, regional capacity, launch failure, failed health checks and scale-in protection before you raise max size.
- Runbook
Region failover
Execute documented DNS or anycast failover, and separate that from ad-hoc region moves that are not in the DR plan.
- Guide
Cross-region disaster recovery
How to pick RTO, RPO and failover mechanics across AWS, Azure and Google Cloud regions without treating a second AZ as DR.
- Guide
When serverless fits a production platform
Use functions or request-driven containers when the unit of work is an invocation with documented duration limits. Steady workers usually stay on nodes.
- Guide
Kubernetes cost allocation
How to attribute cluster spend to namespaces and workloads on EKS, AKS and GKE using native billing labels and Kubecost.
- Runbook
NAT gateway cost increase
Find why NAT or Cloud NAT spend rose by separating hourly gateway charges from bytes processed.
- Runbook
Unexpected cloud cost spike
Isolate a cloud spend spike by account, service and usage type before you delete or resize anything.
- Guide
Egress cost planning
How to estimate inter-AZ, inter-region and internet egress before the invoice, using native cost data and published meters.
- Guide
Finding unexpected cloud cost increases
Isolate a spend spike by service, account and usage type before you change architecture or delete resources.
- Guide
Cloud tagging and cost allocation
A tag dictionary, inheritance and unallocated spend on AWS, Azure and Google Cloud billing exports.
- Learn
What is AI FinOps?
AI FinOps is FinOps applied to AI spend: GPU capacity, idle time, managed-model tokens, and unit costs that generic cloud allocation does not show.
- Runbook
Expired certificate
Replace an expired TLS certificate on ACM, Key Vault, Certificate Manager or Alibaba SSL Certificates without removing the working listener first.
- Runbook
IAM access lockout
Regain administrative access without deleting the last admin, and use documented break-glass paths on each provider.
- Learn
Cloud cost allocation fundamentals
Cost allocation maps provider usage to an owner using accounts or subscriptions first, then activated tags or labels. Untagged spend is part of the report.
- Guide
Hub-and-spoke cloud networking
Transit Gateway, Azure hub-spoke, Shared VPC and when inspection and egress belong in the hub.
- Guide
Designing multi-cloud identity
Federation, workload identity and trust boundaries when AWS, Azure and Google Cloud all run production.
- Guide
Multi-account and multi-subscription structure
How to split AWS accounts, Azure subscriptions and Google Cloud projects so blast radius, billing and policy stay separable.
- Guide
Designing a production landing zone
Account structure, identity, networking and logging a production landing zone needs on AWS, Azure and Google Cloud.
- Learn
What is a landing zone?
A landing zone is the baseline multi-account environment that applies identity, network, logging and policy before the first production workload is deployed.
- Learn
What is multi-cloud?
Multi-cloud is running production workloads on more than one provider, each with its own identity, network, billing, and failure-domain model.
- Learn
Cloud networking fundamentals
AWS VPCs are regional, Azure VNets are regional, Google Cloud VPCs are global with regional subnets, and Alibaba Cloud VPCs are regional with zonal vSwitches.
- Learn
Identity and access management fundamentals
AWS IAM, Azure RBAC, Google Cloud IAM, and Alibaba Cloud RAM evaluate identity and authorization differently. Federation does not merge those models.
- Learn
Regions, availability zones and failure domains
Regions, zones, and provider-specific isolation boundaries define which failures a multi-AZ design can survive and which ones require another region.
- Learn
Shared responsibility model
Each provider documents a split between security of the platform and security of your configuration, data, and identities. The line moves by service model.
- Learn
What is cloud architecture?
Cloud architecture is the set of tenancy, identity, network, failure-domain and cost-ownership decisions that determine how workloads run on the four major public clouds.
- Learn
What is FinOps?
FinOps is the FinOps Foundation practice for technology value: shared cost data, joint decisions, and accountability across engineering, finance and the business.