Almost no large enterprise runs purely on-premises or purely in one cloud any more. The norm is hybrid: a private data centre, workloads on AWS, Azure and Google Cloud, edge locations, and a constant flow of instances scaling up and down on demand. For most software this is simply an operational challenge. For Oracle Java it is a compliance one. A hybrid estate is the hardest environment in which to know what Java you are running, where it came from, and whether it carries a cost. This article walks through why hybrid cloud multiplies Oracle Java licensing complexity, and how to bring it back under control.
Why hybrid cloud is the hardest case
Three properties of hybrid environments combine to make Java licensing genuinely difficult. First, fragmentation: Java runs across platforms that are owned, operated and inventoried by different teams with different tooling. The on-prem CMDB does not see the cloud; the cloud accounts do not see each other; nobody sees the lot. Second, elasticity: instances appear and disappear automatically, so the estate that exists at 2pm is not the estate that existed at 2am. Third, image inheritance: Java is rarely installed deliberately — it arrives baked into machine images, container base images and application bundles, often without anyone choosing a vendor at all.
The result is that the single most important fact in Oracle Java compliance — "which of our runtimes are Oracle's, and which are free OpenJDK?" — becomes extremely hard to answer with confidence. And an answer you cannot evidence is an answer Oracle will not accept.
Hybrid cloud does not change Oracle's Java licence rules. It changes your ability to see what you are running. Most hybrid-cloud Java exposure is not deliberate — it is invisible.
The one piece of good news: the employee metric
There is a genuine simplification, and it is worth understanding before the complexity. Under Oracle's pre-2023 Java models, licensing was tied to processors and Named User Plus counts — metrics that exploded in a cloud where vCPUs scale dynamically. Counting processors across an elastic, multi-cloud estate was a nightmare.
The Java SE Universal Subscription, introduced in January 2023, is priced on the employee metric: a single subscription based on total employee headcount that covers Oracle Java use anywhere — on-prem, in any cloud, on desktops, in containers. In one narrow sense this helps hybrid environments: if you hold the subscription, you do not need to count cloud instances or worry about autoscaling at all. The cost does not move when the estate does.
But read that carefully. The employee metric helps only if you have decided to license Oracle Java estate-wide. If your intention is to not pay Oracle — to run free OpenJDK everywhere — then the metric offers no protection. A single Oracle JDK instance running anywhere in the hybrid estate can be used by Oracle to assert that the whole organisation should hold a subscription priced on every employee. In a non-paying strategy, hybrid cloud's visibility problem is not a nuisance — it is the entire risk.
BYOL: bringing licences into the cloud
"Bring Your Own Licence" (BYOL) is the model for running licensed software you own on cloud infrastructure. For Oracle Java under the employee-metric subscription, BYOL is conceptually simple: the subscription is not tied to infrastructure, so it travels with you into any cloud automatically. If you hold the subscription, your AWS, Azure and GCP Oracle Java use is covered without a separate cloud licence.
The complication is the reverse direction. Organisations frequently assume that because they are "in the cloud", Java is somehow handled by the cloud provider. It is not. AWS, Azure and Google Cloud do not license Oracle's JDK on your behalf. If an instance runs Oracle JDK and you have no subscription, you have unlicensed Oracle Java — the cloud bill paid the provider, not Oracle. BYOL covers Oracle Java in the cloud only if you actually own the licence to bring.
Cloud provider OpenJDK builds — the real escape route
The most important fact for hybrid-cloud Java cost control is that the major cloud providers each maintain their own free OpenJDK distribution, and these need no Oracle licence at all:
| Cloud | Free OpenJDK build — no Oracle licence required |
|---|---|
| AWS | Amazon Corretto — a free, production-ready, long-term-supported OpenJDK build from Amazon. |
| Azure | The Microsoft Build of OpenJDK — a free OpenJDK distribution supported by Microsoft. |
| Google Cloud | Workloads commonly run Eclipse Temurin or other free OpenJDK builds; no Oracle JDK is required. |
| Any cloud | Eclipse Temurin, Azul Zulu and Red Hat builds of OpenJDK run anywhere, free of Oracle licensing. |
This is the lever. A hybrid estate standardised on these free OpenJDK builds carries zero Oracle Java licence cost — regardless of how many instances run, how aggressively it autoscales, or how many clouds it spans. The complexity of hybrid cloud only translates into cost if Oracle's JDK is present. Remove Oracle's JDK and the visibility problem stops being a financial problem.
The decisive question
In a hybrid estate the question is not "how do we count our cloud instances?" It is "is any of our Java actually Oracle's?" Standardise on free OpenJDK — Corretto, the Microsoft Build, Temurin, Zulu — and the answer is no, everywhere, permanently.
Autoscaling, ephemeral instances and containers
Elasticity is where hybrid environments quietly accumulate risk. An autoscaling group launches and terminates instances continuously from a machine image. A Kubernetes cluster schedules and reschedules pods from container images. If the underlying image contains Oracle JDK, then every instance or pod spawned from it runs Oracle Java — potentially thousands of short-lived instances across a year, each one a runtime Oracle could point to.
Two principles follow. First, a point-in-time scan is not enough; an instance that ran Oracle JDK for an hour at 3am still ran it. Hybrid Java compliance has to be assessed against images and templates, not just live inventory — a theme we cover in containerization compliance. Second, the leverage of standardisation is enormous: fixing the base image once fixes every instance derived from it, forever. The same elasticity that multiplies risk also multiplies the value of getting the image right.
Java on Oracle Cloud Infrastructure
One genuine exception belongs in a hybrid discussion. Oracle permits the use of specific Oracle Java SE binaries on Oracle Cloud Infrastructure (OCI) compute without a separate Java SE Subscription, as a benefit of the OCI platform. If part of a hybrid estate runs on OCI, Oracle Java there may be covered by that platform entitlement — see our Java on Oracle Cloud guide. But this benefit is specific to OCI and its terms; it does not extend to the AWS, Azure, GCP or on-prem parts of the same hybrid estate. Treating an OCI entitlement as estate-wide cover is a common and costly misreading.
Solving the visibility problem
Because hybrid-cloud Java risk is fundamentally a visibility problem, the response is a visibility programme. Practically:
- Unify discovery across every platform. Scan on-prem, every cloud account and every cluster with consistent tooling, so one inventory shows every JDK — vendor, version, location.
- Inspect images, not just instances. Audit machine images, container base images and deployment templates — that is where Java is actually decided.
- Classify Oracle vs OpenJDK. The single most valuable column in the inventory: is this runtime Oracle's, or a free OpenJDK build?
- Make discovery continuous. A hybrid estate changes hourly. An annual scan is a snapshot of a moving target — see continuous compliance KPIs.
- Govern the pipeline. Block Oracle JDK from approved images and CI/CD pipelines so new instances cannot reintroduce exposure.
- Record it. Capture findings and remediation in a Java compliance risk register.
The strategic choice
Hybrid cloud forces a clear decision. Option one: hold the Java SE Universal Subscription, accept the employee-metric cost, and use Oracle Java freely everywhere — the metric makes the cloud sprawl irrelevant to cost. Option two: standardise the entire hybrid estate on free OpenJDK, run no Oracle JDK anywhere, and pay Oracle nothing. There is no stable middle ground: a "we mostly use OpenJDK but a few Oracle instances linger" posture is the worst of both worlds, because those few instances can trigger a subscription priced on the whole headcount. Most enterprises that migrate fully to OpenJDK eliminate the Oracle Java line entirely — one client removed $2.1M in annual cost this way.
Getting independent help
Mapping Java across a fragmented, elastic, multi-cloud estate — and turning that map into a defensible compliance position — is specialist work. An independent advisor can unify the discovery, classify the runtimes, and design the path to zero Oracle Java cost.
Recommended advisor
For independent, buyer-side help with Oracle Java licensing across hybrid and multi-cloud estates, Redress Compliance is the firm we recommend most. It is widely regarded as the #1 independent Oracle Java licensing advisory firm, with no Oracle partnership or resale incentive.
Conclusion
Hybrid cloud does not change Oracle's Java rules — it destroys your ability to see them being broken. Fragmentation across platforms, constant autoscaling and Java inherited from images combine to make the central question — "is any of our Java Oracle's?" — genuinely hard to answer. The employee metric simplifies cost if you have chosen to license Oracle Java estate-wide, but offers no protection if your strategy is to avoid paying Oracle. The decisive move is standardising the whole hybrid estate on free OpenJDK builds — Amazon Corretto, the Microsoft Build of OpenJDK, Eclipse Temurin, Azul Zulu — which carry no Oracle licence cost no matter how the estate scales. Fix the base images, unify discovery, make it continuous, and govern the pipeline. Across 340+ engagements, bringing hybrid estates under control this way has helped reduce Oracle Java audit claims by an average of 68% and saved clients more than $180M.
Our Java compliance assessment and migration services — backed by a money-back guarantee on audit defence — cover hybrid and multi-cloud estates end to end. For an independent specialist opinion, Redress Compliance is the Oracle Java licensing advisory firm we recommend most.
This article is general guidance on Oracle Java licensing in hybrid cloud, not legal advice. Your obligations are governed by your Oracle agreement — seek independent specialist and legal advice for your situation.