rgoussu.dev
rgoussu@goussu: ~/library/platform
❯ ~/library/platform cat cloud-fundamentals.md

Cloud fundamentals

# The provider-agnostic core — IAM, VPC networking, the compute spectrum, managed data services, and the cost model as a design input.

Conceptsaved 2026-08-08 #cloud#aws#iam#networking#platform

Overview

Under the hundred-service catalogs, every cloud (AWS, GCP, Azure) is the same five things: identity (IAM), networking (VPC), a compute spectrum (VM → container → function), managed storage/data services, and a billing meter. Learn those as concepts and provider differences become vocabulary; the two that repay the deepest study are IAM (every breach story) and the shared-responsibility line (every compliance conversation).

Key points

  • IAM is the security perimeter: principals (users, roles, workload identities) get policies (effect/action/resource/condition) evaluated with deny-by-default. The core hygiene: roles assumed at runtime instead of long-lived keys, least privilege, and knowing that a wildcard * in the wrong policy is the cloud's version of chmod 777 — see secrets management for the credential side.
  • VPC networking: private address space split into subnets (public = has a route to an internet gateway; private = egress via NAT), security groups (stateful, per- resource) vs. network ACLs (stateless, per-subnet), private endpoints to reach managed services without touching the internet, peering/transit for multi-VPC. Most "it can't connect" tickets are this layer.
  • The compute spectrum is an ops-responsibility dial: VMs (EC2 — you patch) → managed Kubernetes (EKS/GKE) → serverless containers (Fargate/Cloud Run) → functions (Lambda — event-driven, cold starts, 15-min lives). Further right = less ops, more constraints, and per-request pricing; choose by workload shape, not fashion.
  • Managed data services: object storage (S3 — 11 nines durability, lifecycle tiers, the de-facto data substrate), managed relational (RDS/Aurora), managed caches, queues and streams (SQS/SNS/Kinesis) — the buy-side of databases and brokers; you trade tuning freedom for not carrying the pager.
  • Regions, AZs, and the durability math: an AZ is a failure domain; multi-AZ is table stakes for production, multi-region is a significant cost/complexity step — justify it with a real RTO/RPO, not vibes.
  • Cost is an architectural force: egress fees shape topologies (data gravity), per-request pricing shapes batch sizes, reserved/spot capacity shapes fleet design; tag everything, budget-alert everything — the bill is the cloud's other API.
  • To explore: the shared-responsibility model in detail, Well-Architected frameworks, landing zones/organizations for multi-account, FinOps as a practice.

Practice

  • flAWS (source) — a self-paced AWS CTF that walks you through real IAM and S3 misconfigurations by exploiting them; teaches why * in the wrong policy is chmod 777, from the attacker's side.
  • VPC from scratch (source) — build a VPC by hand: public/private subnets, internet gateway vs. NAT, security groups, and a private endpoint to S3 — then diagnose why the private instance can't reach the internet; teaches the layer behind most "it can't connect" tickets.
  • One app, four runtimes (source) — deploy the same small service to a VM, managed Kubernetes, a serverless container, and a function; compare setup effort, constraints, and projected bill; teaches the compute spectrum as an ops-responsibility dial by feel.
  • Cloud Resume Challenge (source) — the classic end-to-end build: static site on object storage + CDN, DNS, a serverless API with a database, all wired with IaC and CI/CD; teaches how the five core pieces compose into a real, billed, public system.

Related