So I've dabbled in this a bit. I deplore "marketing speech" but the perimeter is disappearing, so my effort has veered more towards HIPS agents and EDR controls (which may not be your question). In my pipe dream world, there is a perfect stack of agents that can defend an endpoint as well as if it was in my network.
I've never done this with incoming IDS. I think, over every port, at a cloud provider - internet is a point of failure, so you'll need redundancy. Throughput is going to be a concern, too - ensuring a minimum speed test. You'll also need to lock down those hops very tightly between internal and external. If it's a vendor providing this, I'd want to know specifically what the SLA's are and if I'm on a shared IPS .
I have done this on outgoing connections. This was a large enterprise with millions to spend, so we just figured what the heck...they're offering it as a service (really a Palo Alto) and are guaranteeing throughput, so let's just try it. This probably sounds a bit weird, but there are good reasons for it. It worked, I suppose, but there were issues - sometimes due to the complexity of the setup, sometimes due to the service itself. You're likely to face a load issue on your IPS so whoever you're doing this with, better guarantee some level of service. Makes me nervous to think that the CEO's daily visits to Yahoo! news are being slowed down or stopped by something that's not in my direct control.
The biggie, control, is likely where I'm going to lose the most sleep. The other issues can probably be overcome. Historically, IPS rules were specific to the business. What was "bad" for someone might not be bad for others. So what defines that? If I move to the cloud, how much granular control do I have? If you are in a shared cloud (to my earlier remark), that could mess up your ability to create specific rules for your business.
Several other thoughts, but I'll just stop there b/c they delve into other areas beyond IPS.
