Architecture Design and Implementation Built for the Cloud · Topic 8 of 11
Hybrid Compute and Data Synchronization
Run workloads on premises or near users with Outposts, Local Zones and EKS or ECS Anywhere, and sync data with DataSync, Storage Gateway and Transfer.
- 5 min
- Outposts brings AWS-managed infrastructure on premises and needs a link to its parent Region.
- Local Zones place AWS compute in metro areas for low latency to nearby users.
- EKS Anywhere runs on your hardware and works disconnected; ECS Anywhere is managed from the Region.
What it is
Not every workload can live in an AWS Region. Some must stay on premises for data residency or latency to local equipment, and some must run close to users in a city with no Region.
Hybrid compute brings AWS services or AWS management to those places. Hybrid data synchronization keeps files and objects flowing between on-premises systems and AWS storage.
How it works
Hybrid compute options
| Option | Where it runs | Who manages the hardware | Choose it when |
|---|---|---|---|
| AWS Outposts | AWS-designed racks or servers in your data center | AWS delivers, installs and maintains it | AWS APIs and services on premises, local data processing, data residency |
| AWS Local Zones | AWS infrastructure in a metro area | AWS | Single-digit millisecond latency for users in that city without owning hardware |
| Amazon EKS Anywhere | Your own hardware or virtualization | You | Kubernetes on premises with the EKS distribution, including disconnected sites |
| Amazon ECS Anywhere | Your own servers or VMs, registered as external instances | You | ECS control plane in the Region scheduling containers on premises |
An Outpost is an extension of a Region. It depends on a service link back to its parent Region for management, so plan redundant connectivity to that Region.
Local Zones are also extensions of a parent Region. You opt in to the zone and create subnets there, then place latency-sensitive tiers such as game servers, media rendering or real-time apps in those subnets.
EKS Anywhere runs the cluster control plane on your infrastructure, so it keeps working without a Region connection. ECS Anywhere keeps the control plane in the Region, and the registered instances run the ECS and SSM agents with outbound connectivity to AWS.
Amazon EKS also supports hybrid nodes, where on-premises machines join a cluster whose control plane runs in the Region. That suits teams that want AWS to run the control plane but must keep some compute local.
Choosing hybrid compute by requirement
- "Data must never leave the facility, and the team wants the same AWS APIs" -> Outposts.
- "Users in a city far from any Region need lower latency" -> Local Zones.
- "Air-gapped site, Kubernetes, customer hardware" -> EKS Anywhere.
- "Existing on-premises servers should run containers managed from the ECS console" -> ECS Anywhere.
Data synchronization services
| Service | Pattern | Protocols and targets |
|---|---|---|
| AWS DataSync | Online transfer: one-time migration or scheduled, incremental sync with verification | Sources such as NFS, SMB, HDFS and object storage; targets such as S3, EFS and FSx |
| AWS Storage Gateway, S3 File Gateway | On-premises apps keep using file shares while data lands in S3, with a local cache | NFS and SMB to S3 objects |
| Storage Gateway, Volume Gateway | Block storage with cloud-backed snapshots | iSCSI volumes, cached or stored mode |
| Storage Gateway, Tape Gateway | Replace physical tape with virtual tapes in AWS | iSCSI virtual tape library for existing backup software |
| AWS Transfer Family | Managed file transfer endpoints for partners | SFTP, FTPS and FTP into S3 or EFS; AS2 into S3 |
The deciding question is whether the on-premises application should keep using its current interface. DataSync moves data and then stops, while Storage Gateway stays in the data path so applications read and write as before.
DataSync can run over Direct Connect or VPN by using a VPC endpoint, and it can limit bandwidth to protect production links. Its built-in integrity verification checks that the copy matches the source.
Transfer Family supports service-managed users or a custom identity provider, so existing partner logins can continue. It removes the need to run and patch SFTP servers on EC2.
How the exam asks about this
- "Hundreds of terabytes on an NFS filer must move to Amazon EFS with ongoing nightly updates until cutover" -> AWS DataSync with a scheduled incremental task.
- "A factory must process sensor data locally with AWS services because of latency to machines and residency rules" -> AWS Outposts.
- "Trading partners upload files by SFTP and the company wants to stop managing SFTP servers" -> AWS Transfer Family with an S3 backend.
What to remember for the exam
- Outposts brings AWS-managed infrastructure on premises and needs a link to its parent Region.
- Local Zones place AWS compute in metro areas for low latency to nearby users.
- EKS Anywhere runs on your hardware and works disconnected; ECS Anywhere is managed from the Region.
- DataSync is for moving and synchronizing data, with scheduling, verification and bandwidth limits.
- Storage Gateway keeps on-premises apps on file, volume or tape interfaces while data lives in AWS.
- Transfer Family provides managed SFTP, FTPS and FTP into S3 or EFS, and AS2 into S3.
Outposts and Local Zones are not separate Regions. A design that needs Regional disaster recovery still needs a second Region, and an Outpost that loses its service link cannot be managed from the Region until the link returns.
Common mistakes
Choosing Storage Gateway for a one-time migration. Storage Gateway is a long-lived hybrid bridge. A one-time or scheduled bulk move is DataSync's job.
Choosing Outposts to reduce latency for a city's users. Outposts is hardware in your own facility. For low latency to users in a metro area without owning space, Local Zones is the answer.
Running SFTP on EC2 for partner uploads. This adds patching, scaling and high availability work. Transfer Family is the managed option with the lowest operational overhead.
Check yourself
Which service keeps on-premises applications using SMB shares while storing files as S3 objects?
Amazon S3 File Gateway, part of AWS Storage Gateway, which caches data locally and stores it in S3.
What is the main difference between ECS Anywhere and EKS Anywhere?
ECS Anywhere keeps the control plane in the AWS Region and needs connectivity, while EKS Anywhere runs the whole cluster on your infrastructure and can run disconnected.
Which service gives low latency to users in a metro area without hardware in your data center?
AWS Local Zones, which extend a parent Region into that metro area.
Topic 8 of 11 in Architecture Design and Implementation Built for the Cloud
Test yourself on Architecture Design and Implementation Built for the Cloud
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.