Cloud Fundamentals
IaaS/PaaS/SaaS, regions, shared responsibility model.
Theory
Cloud computing delivers compute, storage, networking, and services over the internet on a pay-as-you-go model. The three service models: IaaS (Infrastructure as a Service — rent VMs, VPCs, block storage; AWS EC2, Azure VMs, GCP Compute Engine), PaaS (Platform as a Service — managed runtimes, databases; AWS RDS, Heroku, Google App Engine), SaaS (Software as a Service — fully managed products; Gmail, Salesforce, GitHub).
The shared responsibility model: the cloud provider secures the physical infrastructure, hypervisor, and managed service internals. The customer secures everything above: the OS, application code, IAM policies, network rules, encryption keys, and data. Misunderstanding this boundary is the source of most cloud security incidents — S3 buckets left public, overly permissive IAM roles, unencrypted databases.
Regions and availability zones: a region is a geographic area (us-east-1, eu-west-1) containing multiple isolated data centers. An availability zone (AZ) is one or more data centers in the region with independent power, cooling, and networking. Distributing across 2+ AZs provides high availability (one AZ fails, others serve traffic). Distributing across regions provides disaster recovery and latency optimization for global users.
Core services every engineer should know: compute (EC2/GCE/Azure VMs for custom workloads; Lambda/Cloud Functions for serverless event-driven code), object storage (S3/GCS/Blob — unlimited, cheap, durable file storage), managed databases (RDS for SQL, DynamoDB/Firestore for NoSQL, ElastiCache for Redis), and networking (VPC/VNet — private network inside the cloud, security groups/firewall rules, load balancers).
Pricing models: on-demand (pay per hour/second, no commitment — highest price), reserved instances (1 or 3 year commitment, 30–60% discount), spot instances (bid for spare capacity — up to 90% off but can be terminated with 2 minutes notice, ideal for stateless batch workloads), savings plans (flexible commitment to $ spend per hour, applies across instance types).
IAM (Identity and Access Management) is the security foundation. Principals (users, roles, service accounts) are granted permissions via policies (JSON documents listing allowed/denied actions on resources). Least privilege: grant only the minimum permissions required. Use roles for EC2 instances and Lambda functions — no long-lived access keys stored on machines. Enable MFA for all human users.
Cost optimization: right-size instances (CloudWatch shows CPU < 10% → downsize), use auto-scaling to match capacity to demand, move infrequently accessed S3 objects to cheaper tiers (Glacier), use CDN to reduce data transfer costs, tag all resources for cost allocation (team, project, environment), and set billing alerts. Cloud cost can grow 10× in a year without visibility.
Architecture Diagram
Users / clients
|
Cloud Fundamentals
|
Core services
|
Data + observabilityExamples
# Cloud Fundamentals
# IaaS/PaaS/SaaS, regions, shared responsibility model.
# Validate in staging before production rollout.Interview Questions
What problem does Cloud Fundamentals solve?
It addresses the core use case described in production architecture — map features to reliability, scale, or velocity outcomes.
Key components of Cloud Fundamentals?
Identify inputs, outputs, control plane, data plane, and failure domains — interviewers want structured decomposition.
Common production pitfalls?
Misconfiguration, missing observability, no rollback path, and scaling bottlenecks under peak load.
How do you test changes safely?
Staging parity, canary/gradual rollout, automated health checks, and documented rollback.
Metrics to prove success?
Error rate, latency percentiles, throughput, cost, and toil reduction — pick one primary SLO.
Beginner vs advanced concern?
Beginners focus on setup; advanced teams focus on blast radius, security boundaries, and operability at 10× scale.
Best Practices
- Treat Cloud Fundamentals config as code with review and CI validation.
- Define SLOs and dashboards before production cutover.
- Document rollback and ownership for on-call.
- Use least privilege for credentials.
Common Mistakes
- Adopting Cloud Fundamentals without measurable success criteria.
- No staging environment mirroring production constraints.
- Missing rollback path during incidents.
- Undocumented on-call expectations.
Cheat Sheet
Practical Exercises
Stand up Cloud Fundamentals locally or in free tier; document commands and failure recovery.
Introduce misconfiguration; practice detection and rollback under time limit.