For several years, cloud computing has been a trending topic in the IT space. Organisations have spent the last few years researching and experimenting with cloud environments and they are now adopting public, private and hybrid clouds at an ever-increasing pace. It is delivering on the promise of freeing IT from day-to-day management of data centres, allowing organisations to focus more time on high value business objectives.
The cloud, however, is not without its challenges. Security concerns are well documented and remain top of mind for many CIOs even today. Cloud providers are maturing their environments, delivering close to 100% availability and meeting security challenges.
IT organisations have implemented the right capabilities to assist with the management of cloud resources and self-service capabilities to allow the business to take advantage of cloud-based services.
As cloud environments are becoming more popular, there is a rise in challenges that need to be addressed. Software licensing is one of the most significant challenges because teams managing cloud environments are focusing on meeting operational needs as opposed to understanding the repercussions of installing and running software programs in cloud environments. This is creating potential cost increases and compliance exposures, which can result in significant unexpected costs and impacts to the business.
Software license compliance risks when running software in the cloud
Let’s examine why license compliance continues to be a risk in cloud environments.
As operational teams are primarily focused on delivering solutions, IT has access to all the software and software licenses. As members of these teams aren’t familiar with the intricacies and complexities of software licensing, they normally assume that since the enterprise owns the license, the enterprise is able to use the resource in any environment they please, including the cloud. After all, is there any real difference between running your application on physical hardware, on one’s own date centre versus centre running it in someone else’s data centre?
In reality, where the software is run makes all the difference in the world from a licensing perspective. That’s because software use is subject to licensing terms and different software vendors have developed differing and often confusing rules associated with using their software in cloud environments.
It must be understood that even though the software application can be installed and run in the cloud environment, this does not mean that the organisation’s license covers this usage. Some vendors may require customers to buy special licenses, while other vendors may explicitly prohibit their software from running in the cloud. Therefore, in order to avoid potentially costly non-compliance situations, it is important for IT teams to check with their licensing team counterparts BEFORE delivering the cloud-based service to the organisation.
This is also the case with desktop applications organisations may wish to host in a cloud. Desktop applications frequently have special terms to cover running software in virtual environments (such as indirect access license) and perhaps even specific ones when running software in Cloud environments.
In regards to datacentre applications, there are often more complications as many of these are licensed using CPU-based metrics and have specific terms for virtualisation. For example, IBM software is licensed using Processor Value Units (PVUs) and has specific requirements and restrictions when the software runs in virtual machines. So, if an organisation runs IBM software in the cloud, IBM will want to know the full CPU capacity of the physical machine running the cloud environment which could present a difficult challenge as Cloud providers may not share that information with their customers. Even if they do, enterprises may be required by their contracts to pay for “full capacity,” even though the instance that their software runs in is one of many virtual machines running on that server, which can be very costly.
Some software vendors have recognised this and are already starting to add specialised terms to help customers run their software in public cloud environments. For example, if a company wants to run Oracle database in a cloud environment, it is permitted to run it in Amazon, Azure or Oracle Cloud. However, if a company were to choose another cloud provider, it will not have permission to run in that environment and will find itself in a non-compliance situation with Oracle.
These are just a few examples that illustrate why there is a need for organisations to review their license agreements before they migrate software in the cloud.
Additional software license risks in the cloud
There are still additional risks to consider even if a company has the right to run software in the cloud. As discussed, corporate cloud teams have spent a vast amount of time and effort setting up the infrastructure that allows business units to leverage the power of the Cloud. Self-service portals allow users to quickly and easily choose specific service offerings and cloud management tools connected to those portals automatically handle provisioning of selected cloud services for each user.
Again, it isn’t sufficient to assume that having a license covers you for these activities. The cloud introduces new potential risks.
When an employee requests and receives access to a cloud service, they consume the licenses for the software installed in that service instance. The employee will use the service, receiving a business benefit. If the need is permanent, we can be relatively sure that we are OK from licensing perspective. However, from a cost perspective, we need to check whether the Cloud instance in use (typically the virtual machine) is sized correctly.
For example, I may subscribe to a Microsoft SQL Server instance that has 8 CPUs assigned to it. As an employee I am happy because the database is very fast. But, I am only doing small scale testing that could have been done on a single, or dual CPU instance. So, while I am satisfied as an individual user of the cloud service, as an IT organisation, I am spending more on delivery of this service instance than necessary. This would be so because IT pays more for the larger instance and uses more licenses (or a more expensive license) than necessary. Therefore it is important to provide users with a variety of service options, showing the different costs of these choices, so they are given the option of choosing the most cost efficient alternative.
Another risk with licensing is that over time, users will request multiple service instances and may forget to turn off previously used ones. This means that the organisation will have to cover the cost of unused cloud service instances, including subscription and license costs. This would be the cloud equivalent to “shelfware.” Since cloud environments are very dynamic in nature, the likelihood of this type of shelfware occurring increases. The only clues as to its existence would be the bills from the cloud provider for the instance subscriptions. Unfortunately, since organisations will have many instances with different usage patterns, identifying those shelfware instances without the right Software License Optimisation tools capable of tracking them is not easy.
Yes another potential cost can occur because licenses may not be immediately transferable between virtual machines. If I subscribe to a database service and, after using it I unsubscribe from it (decommissioning the service), the license may still be tied to that instance for a period of time. When the next user requests the same type of service while the license is tied up, IT would then have to provide that user with a new license, creating an unintended and unnecessary expense. Again, it is very important to understand licensing terms so that licenses are not needlessly and wastefully consumed.
There are many benefits the cloud brings to businesses, however this new environment brings challenges that need to be understood and addressed before businesses begin to implement the cloud. Since the majority of these relate to software licensing, it is important to include software licensing teams as part of strategic cloud planning. These teams can lend expertise during cloud service design and ensure that license management and optimisation solutions are part of the cloud management stack used. With the help of licensing professionals, operational teams will be able to optimise the use of company resources and also be able to negotiate more favorable licensing terms. This will result in IT delivering quality services at optimal cost while reducing compliance risks.
Steve Beards is VP APAC for Flexera Software