What are the best practices for developing systems in cloud and mobile environments?

Have a big vision focused on company benefits (lower costs, faster time to market, flexibility, scalability, increased revenue, digital transformation...) and be prepared for the vision to evolve (as you learn). Start now... its a learning experience... agile... deliver real company value every few weeks (even if quite simple and limited at the start). Small frequent steps allow you to "pivot" if needed. Again with an eye on the vision and the overall company benefits/value. Don't be afraid to take a step back to enable two steps forward - that's learning and adapting. Note this is very much about avoiding analysis paralysis... avoid "big bang" (waterfall) approaches that almost always result in disappointment if not outright failure.

There is no one-size fits all or a silver bullet for this multi-billion ( or should we say trillion) dollar question. All the challenges such as * Complexity of decision-making process * Lack of understanding of cloud service models * Difficulty in assessing specific needs and requirements * Limited knowledge of available options and their capabilities * Balancing control and convenience factors * Integration challenges with existing systems and infrastructure * Cost considerations and budget constraints * Potential vendor lock-in or migration issues * Security and compliance concerns * Scalability and future growth considerations * User adoption and training requirements * Vendor reputation and reliability assessment. Play a major role!

Few tenants from my perspective 1. Let your application decide where to reside - the very nature of it will pretty much guide you to choose the right cloud option 2. Right cloud service provider is almost a choice of the enterprise but looking if its a straight IaaS then no major difference but if its a PaaS or SaaS - comparing the features keeping your business requirement lens matters. 3. Performance, Compliance, Scalability, Security as many stated above play a vital role to ensure that you don’t build a bandaid but a solid future ready solution 4. User Experience matters : things like edge , CDN which takes the solution closer to the user - keep those in to considerations 5. Nothing fits on day 1. Keep Observability on radar to track

Security and telemetry are the baseline of any cloud software system. Agile, CI, Feature flags, and RBAC should also be part of your system. Security is making sure everything from PII to cloud provider is in place and managed. Your cloud environments should be built from code not by hand. Tooling around DB access should be done through UI, not direct access (this provides audit logging). The focus on telemetry is that as a team you should know when users are experiencing crashes or performance issues before they write into support. Report your exceptions, log your errors actively monitor them, and manage them. Make your software delivery pipeline easy and fast, make sure you can stage features and test easily.

Generally speaking, the basic requirements for any solution are: Compute, Storage, and Networking, based on the desired needs and architecture the solution can consume one or all three "as a service" from a cloud provider.

Additional considerations: Cost Management: Monitor scaling costs with alerts. Database Scalability: Optimize for high availability and adaptive scaling. Fault Tolerance: Use multi-zone deployments for continuous service. Performance Testing: Simulate high traffic to identify bottlenecks. Decoupling: Separate system components for independent scaling. Monitoring & Analytics: Track system performance to guide decisions.

The advantages for cost savings is also worth mentioning. The scalability and elasticity means you don't have to over-provision resources for peaks or pay for idle resources. This become more apparent especially with serverless services. The CDN can also be used to save cost, again more apparent with serverless services, since serverless is usually pay-per-use, any content delivered via the CDN is not reaching your serverless services thus saving you money.

Other important aspects: - balance the pros and cons between “few large nodes” and “many small nodes”. - as a rule of thumb when traffic is low vertical scaling is a good option but as the number of users increases horizontal scaling may be more fitted providing fault tolerance.

Embrace stateless components, microservices, load balancing, auto-scaling, and CDNs to hit the target of handling varying workloads seamlessly while optimizing resource utilization.

Be realistic. Consider order of magnitude and build to perform for your next order of magnitude. For example, if you have 100 users build for a 1000. Solving for 10,000 or more is a wholly different problem.

Consider the following for reliability: - Implement redundancy at all layers - load balancers, autoscaling, database replication etc. to eliminate single points of failure. - Verify failover policies and procedures through failure simulations and drills. - Conduct chaos engineering experiments to proactively uncover weaknesses. - Analyze mean time between failures and mean time to recovery for core components.

Additional considerations: Edge Computing: Reduce latency by processing data near its source. CDN Integration: Speed up content delivery and offload primary servers. CAP Theorem: Balance consistency, availability, and partition tolerance. Security: Integrate DDoS protection, WAF, and conduct vulnerability checks. Server Checks: Monitor service health to preempt issues. Service Mesh: Boost microservice communication and reliability. Updates: Regularly patch software for security and optimal performance.

I'd like to add that you need to understand what each security measure does and doesn't protect you against. But more importantly, you need to implement full security at every layer right from the start. You can't fix this later.

Also consider security throughout your delivery pipelines. There a multiple vectors of attack where vulnerabilities can be introduced. From your Git repo, to your build systems and artifact repositories and the open-source software you have integrated. Ideally your cloud provider should be able to provide end-to-end security tooling to help you mitigate these risks before you application even gets to production.

Be sure to understand the local laws and regulations to cover requirements such as Data Residency. Some countries and regions have particular requirements.

Separating the deployments to different regions (Canada, EU, australia) can also help the compliance with privacy rules - e.g. GDPR, Shrems 2, etc.

Additional considerations: Multi-factor Authentication: Enhances user verification. Zero Trust Architecture: Requires verification for all requests. Intrusion Detection: Monitors suspicious system activities. Data Masking: Obscures sensitive database content. Role-Based Access: Assigns access based on roles. Security Training: Keeps staff updated on threats. Incident Response: Prepares for security breaches. Data Loss Prevention Tools: Controls data transfer. Secure Software Lifecycle: Integrates security in development. VPN & Secure Endpoints: Ensures encrypted connections.

I would add here the importance of the accessibility rules too. Responsive design is not enough if it ends up with hard readability.

Additional Considerations: Battery Efficiency: Optimize app energy usage. Push Notifications: Engage users without overwhelming them. Geolocation: Use location-based features for context. Biometrics: Implement fingerprint or facial access. CI/CD: Update apps seamlessly. Diverse Testing: Account for various devices and OS. Follow Store Guidelines: Ensure easy app store approval. Accessibility: Make the app usable for everyone. Data Efficiency: Minimize app data consumption. Gesture Support: Incorporate common mobile interactions.

Observability is crucial for operational efficiency. It involves using data (logs, metrics, traces) to deeply understand the system. This differs from monitoring, which only alerts on failures. Observability provides a holistic view, revealing where and why architecture fails. 1.Data-Driven Optimization: A data-centric approach is key for refining processes and architecture, boosting efficiency. 2.Proactive Failure Detection: Observability means continuous data monitoring, enabling early detection of potential failures. 3.Auto-Recovery and Log Insight: Auto-recovery ensures system stability without human intervention. Analyzing recovery logs refines this process.

Remember that both cloud and mobile environments are dynamic, and best practices may evolve over time. Staying up-to-date with the latest developments and trends in these areas is essential for successful system development. Additionally, the specific requirements of your project may lead to variations in these best practices, so adapt them to your needs accordingly.

- I shall employ monitoring tools, observability, and analytics to acquire valuable insights into application usage and performance, guiding ongoing improvements. - I consistently promote and facilitate collaboration between development and operations teams to streamline deployment processes and bolster system reliability, fostering a robust DevOps culture. - The presence of comprehensive documentation is highly advantageous.