Cloud Overview

What is Cloud Computing?

Cloud computing delivers on-demand IT resources over the internet with pay-as-you-go pricing. Instead of buying and maintaining physical data centers, you access technology services from a cloud provider. The primary service models differ in how much of the stack is managed for you.

Model	Full Name	You Manage	Provider Manages	Examples
IaaS	Infrastructure as a Service	OS, runtime, data, apps	Servers, storage, networking, virtualization	AWS EC2, GCP Compute Engine, Azure VMs
PaaS	Platform as a Service	Data and apps	OS, runtime, middleware, servers, storage	AWS Elastic Beanstalk, GCP App Engine, Heroku
SaaS	Software as a Service	Configuration and data input	Everything	Gmail, Salesforce, Slack, Datadog
FaaS	Function as a Service	Code logic only	Infrastructure, scaling, OS, runtime	AWS Lambda, GCP Cloud Functions, Azure Functions

Multi-Cloud vs Hybrid Cloud

Multi-Cloud Strategy

Multi-cloud uses services from two or more public cloud providers (e.g., AWS + GCP) simultaneously for different workloads or as redundancy.

Hybrid Cloud Strategy

Hybrid cloud connects on-premises infrastructure with one or more public clouds, enabling data and applications to move between environments.

AWS Well-Architected Framework — 6 Pillars

The AWS Well-Architected Framework provides architectural best practices across six pillars. Each pillar includes design principles, questions, and best practices to help evaluate and improve cloud architectures.

GCP Architecture Framework — Pillar Mapping

GCP's Architecture Framework aligns closely with AWS's model, providing the same 6 categories adapted to Google's ecosystem.

Pillar	AWS WA Equivalent	Key GCP Services
Operational Excellence	Operational Excellence	Cloud Deployment Manager, Cloud Build, Cloud Monitoring, Error Reporting
Security, Privacy, Compliance	Security	IAM, Cloud KMS, Security Command Center, Cloud Armor, VPC Service Controls
Reliability	Reliability	Cloud Load Balancing, Cloud DNS, Cloud Storage, Spanner (global), GKE Autopilot
Performance Optimization	Performance Efficiency	Cloud CDN, Memorystore, Bigtable, BigQuery, Cloud Trace, Profiler
Cost Optimization	Cost Optimization	Billing Reports, Recommender, Committed Use Discounts, Spot VMs, Budgets
Sustainability	Sustainability	Carbon Footprint dashboard, Tau T2D (ARM), serverless products, region selection

Cloud Design Patterns

Cloud Migration Strategies — The 6 Rs

When moving workloads to the cloud, choose the migration strategy based on business goals, time constraints, and technical complexity.

Landing Zone Concept

A Landing Zone is a pre-configured, secure, multi-account cloud environment based on best practices. It provides the foundation upon which all cloud workloads are deployed.

Account / Project Structure

# AWS Organization Structure
Root (Management Account)
├── Security OU
│   ├── Audit Account        # CloudTrail, Config aggregation
│   └── Log Archive Account  # Centralized logging (S3)
├── Infrastructure OU
│   ├── Network Account      # Transit Gateway, Direct Connect
│   └── Shared Services      # Active Directory, DNS, AMI catalog
├── Workloads OU
│   ├── Production OU
│   │   ├── Prod-AppA Account
│   │   └── Prod-AppB Account
│   ├── Staging OU
│   │   └── Staging-AppA Account
│   └── Dev OU
│       └── Dev-Sandbox Account
└── Sandbox OU
    └── Individual developer sandboxes

Network Topology

# Hub-and-Spoke with Transit Gateway (AWS)
Network Account (Hub)
  ├── Transit Gateway
  ├── Shared VPC (10.0.0.0/16)
  │   ├── VPN / Direct Connect endpoints
  │   └── Centralized Egress (NAT Gateway)
  └── DNS VPC (Route 53 Resolver)

Spoke VPCs (per workload account)
  ├── Prod VPC: 10.10.0.0/16 → TGW attachment
  ├── Staging VPC: 10.20.0.0/16 → TGW attachment
  └── Dev VPC: 10.30.0.0/16 → TGW attachment

# GCP Shared VPC equivalent
Host Project (VPC host)
  └── Shared VPC → subnets delegated to service projects
Service Project A (prod workloads) → uses shared subnets
Service Project B (dev workloads) → uses shared subnets

IAM Hierarchy

# AWS IAM hierarchy via Organizations
- SCPs (Service Control Policies) at OU level: deny guardrails
- Permission Boundaries: limit max IAM permissions per role
- Role: specific task roles (Developer, ReadOnly, Admin)
- IAM Identity Center (SSO): federated access across accounts

# GCP IAM hierarchy
Organization → Folders → Projects → Resources
- Org Policies: constraints applied top-down
- IAM bindings at each level (inherited downward)
- Service Accounts: workload identity at resource level
- Workload Identity Federation: keyless auth for CI/CD

FinOps Integration — Cost from Day 1

Tagging Strategy

# Required tags for every resource (enforce via SCPs / Org Policies)
Environment:    prod | staging | dev | sandbox
Owner:          team-platform | team-backend | team-data
Project:        project-name or cost-center-code
Application:    app-name
ManagedBy:      terraform | manual | cloudformation
CostCenter:     CC-12345

# AWS Tag Policy example (JSON)
{
  "tags": {
    "Environment": {
      "tag_key": { "@@assign": "Environment" },
      "tag_value": {
        "@@assign": ["prod", "staging", "dev", "sandbox"]
      },
      "enforced_for": {
        "@@assign": ["ec2:instance", "rds:db", "s3:bucket"]
      }
    }
  }
}

# Terraform tagging (locals block)
locals {
  common_tags = {
    Environment = var.environment
    Owner       = var.team
    Project     = var.project
    ManagedBy   = "terraform"
    CostCenter  = var.cost_center
  }
}

Key Tooling Ecosystem

Tool	Category	Purpose
Terraform	IaC	Provision and manage cloud infrastructure declaratively across AWS, GCP, Azure
Ansible	Configuration Management	Configure OS, install packages, manage files on cloud VMs and on-premises servers
Helm	Package Manager	Deploy and manage Kubernetes applications using versioned charts
ArgoCD	GitOps / CD	Continuous delivery for Kubernetes — sync cluster state with Git repository
Prometheus	Monitoring	Metrics collection and alerting for cloud-native and Kubernetes workloads
CloudWatch	Monitoring (AWS)	AWS-native metrics, logs, alarms, dashboards, and tracing (X-Ray integration)
Cloud Monitoring	Monitoring (GCP)	GCP-native metrics collection, alerting policies, and uptime checks
Grafana	Visualization	Unified dashboards for Prometheus, CloudWatch, and Cloud Monitoring data sources