Cloud computing delivers on-demand IT resources over the internet. Understanding the service models (IaaS/PaaS/SaaS), deployment models, and shared responsibility model is foundational to working with any cloud provider.
| Term / Service | Description / Value | Notes |
|---|---|---|
| IaaS | Infrastructure as a Service | VMs, storage, networking — you manage OS and above (EC2, Azure VMs, GCE) |
| PaaS | Platform as a Service | Managed runtime — you manage app and data (App Service, Heroku, GAE) |
| SaaS | Software as a Service | Fully managed app — you just use it (Gmail, Salesforce, Office 365) |
| FaaS | Function as a Service / Serverless | Run code without managing servers (Lambda, Azure Functions, Cloud Run) |
| CaaS | Container as a Service | Managed Kubernetes (EKS, AKS, GKE) |
| Public cloud | Resources shared across customers, owned by provider | AWS, Azure, GCP, Oracle Cloud |
| Private cloud | Dedicated resources for one org, on-premises or hosted | OpenStack, VMware, on-prem k8s |
| Hybrid cloud | Mix of public and private cloud with interconnect | VPN or Direct Connect between on-prem and cloud |
| Multi-cloud | Using multiple public cloud providers | Avoid vendor lock-in, use best-of-breed |
| Region | Geographic area containing multiple data centers | us-east-1, eastus, us-central1 |
| Availability Zone | Isolated data center(s) within a region | us-east-1a, us-east-1b — for high availability |
| Edge Location | CDN point of presence close to end users | CloudFront, Azure CDN, Cloud CDN pops |
| VPC | Virtual Private Cloud — isolated network in the cloud | Your own private network within the cloud |
| Subnet | Subdivision of a VPC with CIDR block | Public subnet (has IGW route) vs private subnet |
| CIDR | Classless Inter-Domain Routing: 10.0.0.0/16 | Defines IP range for VPC and subnets |
| Internet Gateway | IGW — connects VPC to the public internet | Required for public subnets to reach internet |
| NAT Gateway | Network Address Translation — outbound internet for private subnets | Private instances access internet, not accessible from internet |
| Route Table | Rules directing traffic within VPC | 0.0.0.0/0 via IGW = internet access |
| Security Group | Stateful virtual firewall at instance level | Allow inbound 443, 22 — deny everything else |
| NACL | Network Access Control List — stateless, at subnet level | Stateless: must allow inbound AND outbound |
| Load Balancer | Distribute traffic across multiple instances | ALB (HTTP/S), NLB (TCP), Classic (legacy) |
| Auto Scaling | Automatically add/remove instances based on demand | Scale out on high CPU, scale in at night |
| CDN | Content Delivery Network — cache at edge locations | CloudFront, Azure CDN, Cloudflare |
| IAM | Identity and Access Management — who can do what | Users, roles, policies, permissions |
| CapEx vs OpEx | Capital Expenditure vs Operational Expenditure | Cloud shifts from buying hardware (CapEx) to paying monthly (OpEx) |
| Shared Responsibility | Provider manages hardware/hypervisor; customer manages OS/apps | Security of the cloud vs security in the cloud |
# Cloud Architecture Concepts — Visual Reference
# ── VPC Network Design ────────────────────────────────────────
#
# Region: us-east-1
# VPC: 10.0.0.0/16
# ┌─────────────────────────────────────────────────────────┐
# │ │
# │ AZ: us-east-1a AZ: us-east-1b │
# │ ┌──────────────────┐ ┌──────────────────┐ │
# │ │ Public Subnet │ │ Public Subnet │ │
# │ │ 10.0.1.0/24 │ │ 10.0.2.0/24 │ │
# │ │ [Web Servers] │ │ [Web Servers] │ │
# │ │ [Load Balancer] │ │ [Load Balancer] │ │
# │ └──────────────────┘ └──────────────────┘ │
# │ │
# │ ┌──────────────────┐ ┌──────────────────┐ │
# │ │ Private Subnet │ │ Private Subnet │ │
# │ │ 10.0.3.0/24 │ │ 10.0.4.0/24 │ │
# │ │ [App Servers] │ │ [App Servers] │ │
# │ │ [Databases] │ │ [DB Replica] │ │
# │ └──────────────────┘ └──────────────────┘ │
# │ │
# │ Internet Gateway ←→ Public Subnets │
# │ NAT Gateway → Private Subnets (outbound only) │
# └─────────────────────────────────────────────────────────┘
# ── Service Model Comparison ──────────────────────────────────
#
# You manage: SaaS PaaS IaaS On-Prem
# Applications ✗ ✓ ✓ ✓
# Data ✗ ✓ ✓ ✓
# Runtime ✗ ✗ ✓ ✓
# Middleware ✗ ✗ ✓ ✓
# OS ✗ ✗ ✓ ✓
# Virtualization ✗ ✗ ✗ ✓
# Servers/Storage ✗ ✗ ✗ ✓
# Networking ✗ ✗ ✗ ✓
#
# Provider manages: SaaS PaaS IaaS On-Prem
# Virtualization ✓ ✓ ✓ ✗
# Servers/Storage ✓ ✓ ✓ ✗
# Networking ✓ ✓ ✓ ✗
# Runtime ✓ ✓ ✗ ✗
# Applications ✓ ✗ ✗ ✗
# ── Security Group Rules (AWS example) ───────────────────────
#
# Web Server Security Group:
# Inbound:
# Type Protocol Port Source
# HTTPS TCP 443 0.0.0.0/0 (internet)
# HTTP TCP 80 0.0.0.0/0 (redirect to HTTPS)
# SSH TCP 22 10.0.0.0/8 (corporate VPN only)
# Outbound:
# All traffic All All 0.0.0.0/0 (allow all outbound)
#
# Database Security Group:
# Inbound:
# PostgreSQL TCP 5432 sg-webservers-id (app servers only!)
# MySQL TCP 3306 sg-webservers-id
# Outbound: (restrict or allow all)
#
# Best practice: reference security groups, not CIDR blocks
# for internal traffic — security groups auto-update when IPs change
# ── IAM Policy Example (JSON) ────────────────────────────────
iam_policy = {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3ReadOnlyAccess",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::mywebuniversity-content",
"arn:aws:s3:::mywebuniversity-content/*"
]
},
{
"Sid": "DenyDeleteObjects",
"Effect": "Deny",
"Action": ["s3:DeleteObject", "s3:DeleteBucket"],
"Resource": "*"
}
]
}
import json
print(json.dumps(iam_policy, indent=2))
# ── Auto Scaling Policy ───────────────────────────────────────
# Scale out: add 2 instances when CPU > 70% for 5 minutes
# Scale in: remove 1 instance when CPU < 30% for 10 minutes
# Cooldown: 300 seconds between scaling actions
# Min: 2, Max: 20, Desired: 4