Most plant still run SCADA, MES historian on same hardware they installed fifteen years ago. Power supply fan whining like jet engine. OS so old vendor laugh at support ticket. It work. It always work. Until it not.
When I first pushed MES to cloud, I assume network ready. It not. Office speed test show 200 Mbps, plenty. But plant floor different. VPN tunnel drop during shift change, guest WiFi spike, historian miss three hours of batch records. Took two days to trace. Lesson hit hard: test from user location, not IT office. Now I send junior engineer for full shift on floor before they touch any architecture diagram. Desk lie. Floor teach.
Three patterns dominate manufacturing cloud migration. Lift shift. Edge cloud hybrid. Phased by workload.
Lift shift move everything as-is. Virtual machine get lifted into cloud VM, same OS, same config, same mess. Appeal? Fast. Risk? High. Plant network still point to old IP, DNS break, latency spike, PLCs timeout. One food client did this unplanned, historian lost eight hours of batch records, QA hold release. Worked out but edge cases painful. Only do this for standalone apps like reporting server or test environment, never direct control path.
Edge cloud hybrid keep real-time stuff local, send analytics to cloud. Historian stay on site but stream aggregated data to cloud for long term storage and machine learning. I did this for parts manufacturer last year. Six plants, each ran local edge node handling OPC UA and MQTT broker. Only hourly rollups went to AWS. When WAN dropped for hours, production never stopped. This pattern win for most SCADA, MES with real time dependencies. Tradeoff: you manage two environments, edge lifecycle become new burden, firmware updates across hundred nodes no joke.
Phased by workload pick one app at a time. Start small like reporting, then MES, then historian, then maybe SCADA if you brave. Automotive supplier did this over eighteen months. First move was OEE dashboard, low risk, no hit to production lines. Plant manager saw value, next MES phase got budget easy. This pattern build trust slow, get stakeholder buy in, take longer though.
Common mistake I see: sizing cloud for average load not peak. Manufacturing burst unlike retail. Batch start, historian poll fire hundred tags at once, cloud VM sized for steady state crawl. I saw MES transaction log fill disk in thirty seconds during production ramp. Now I test worst case burst, double compute, monitor first month tight.
Network assessment also critical. Every plant I visit have flat Layer 2 network from 2005, no segmentation, no QoS. Cloud traffic compete with video surveillance and guest WiFi. Before any migration, you need proper VLAN, traffic shaping, redundant ISP. Most plant have single ISP, single firewall. One pharma client had single point of failure on internet pipe, cloud migration would have tripped FDA batch record requirement. We got secondary LTE before going live.
Security yet another gap. OT team think air gap equal security. It not. I find engineering workstation with RDP open to internet, default credentials on HMI, PLC with no authentication. Cloud migration expand attack surface if you not careful. Zero trust architecture essential. Every device authenticate, every flow logged, least privilege for every user. Manufacturing IT drag on this because plant floor team want everything open for troubleshooting. I get it. Compromise via jump host and just in time access usually satisfies both sides.
Bottom line: manufacturing cloud migration not same as enterprise IT migration. You deal with physical processes, safety systems, legacy protocols, and operators who care about uptime not cloud architecture. Pick pattern fit your risk tolerance, test from plant floor, plan for worst case. Start small, build trust, repeat.
I still have nightmares about that historian gap. Now I never trust a network diagram without walking the floor first. Cloud pattern you pick matter less than network you build around it.