Vendor lock-in is the condition in which an organisation becomes so dependent on a particular technology vendor's products, services, APIs, or data formats that the cost and complexity of switching to an alternative becomes prohibitive — effectively removing the organisation's ability to negotiate, exit, or make independent technology decisions.
Forms of cloud vendor lock-in
Data lock-in: Your data is stored in a proprietary format or location that makes extraction expensive. Cloud egress fees ($0.08–$0.09/GB) are the most direct form of data lock-in — the more data you have, the more it costs to leave.
API lock-in: Your applications use cloud-provider-specific APIs (AWS S3 APIs, Azure Cosmos DB APIs, GCP BigQuery APIs) rather than open standards. Migrating means rewriting every integration.
Toolchain lock-in: Your deployment pipelines, monitoring stacks, identity systems, and developer tools are all provider-specific. A migration requires rebuilding the entire operational model, not just moving workloads.
Skills lock-in: Your engineering team has deep expertise in AWS (or Azure, or GCP) but no experience with alternatives. A migration requires extensive retraining or new hires.
Lock-in and Indian regulatory risk
For Indian regulated entities, vendor lock-in carries a specific regulatory risk: if a cloud provider exits the Indian market, changes pricing dramatically, changes data residency terms, or experiences a prolonged outage, the regulated entity's ability to continue operations and maintain compliance depends entirely on that provider's commercial decisions. The RBI has explicitly identified cloud provider concentration as a systemic risk and requires entities to demonstrate viable exit strategies.
Open source as a lock-in mitigation strategy
Building on open-source components — Kubernetes, PostgreSQL, Kafka, Prometheus, etc. — rather than proprietary cloud services is the primary technical strategy for avoiding lock-in. Open standards (OCI containers, S3-compatible object storage APIs, OpenTelemetry) ensure that workloads can run on any infrastructure that supports those standards.