Cloud Computing Fundamentals: Infrastructure, Architecture & Governance

What is Cloud Computing? The NIST SP 800-145 Standard

According to the official standard formulated by the National Institute of Standards and Technology (NIST SP 800-145), cloud computing is defined as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

Capital Expenditure (CapEx) vs Operational Expenditure (OpEx)

Prior to cloud computing, organizations maintained on-premises datacenters requiring massive upfront capital investment (CapEx): purchasing physical blade servers, redundant uninterruptible power supplies (UPS), commercial HVAC cooling systems, and long-term real estate leases with procurement lead times spanning 3 to 6 months.

Cloud infrastructure shifts financial accounting to operational expenses (OpEx): organizations pay strictly for computational seconds, gigabytes transferred, and I/O operations consumed on a variable utility model. This eliminates over-provisioning waste (provisioning for peak Black Friday load that sits 90% idle the remainder of the year).

Cloud Service Models (IaaS, PaaS, SaaS) & Shared Responsibility

Cloud computing organizes abstractions into three foundational service models, differing by how much of the technology stack is managed by the cloud vendor versus the engineering organization:

1. Infrastructure as a Service (IaaS)

The provider provisions raw virtualized hardware: virtual machines (VMs), raw block storage, virtual private clouds (VPCs), and subnets. The consumer retains absolute root control over the operating system, file system, networking security rules, software updates, and application runtimes. Examples: AWS EC2, Google Compute Engine, Azure Virtual Machines.

2. Platform as a Service (PaaS)

The provider abstracts away the physical servers, operating system patches, runtime installation (Node.js, Python), and hardware provisioning. Engineers simply deploy application source code or pre-packaged container images. The platform automatically handles provisioning, health checks, auto-scaling, and load balancing. Examples: AWS Elastic Beanstalk, Render, Heroku, Google App Engine.

3. Software as a Service (SaaS)

The provider delivers a complete, fully functioning software application accessed over the internet, typically via a web browser or API. The customer manages zero infrastructure or code, configuring only user accounts and enterprise settings. Examples: Google Workspace, Microsoft 365, Salesforce, Stripe Dashboard.

The Cloud Shared Responsibility Model

Security in the cloud is a joint obligation:

• Security OF the Cloud (Provider Responsibility): Physical security of datacenters (biometric access, armed guards, CCTV), physical server hardware, biometric perimeter defenses, power generators, physical fiber links, and hypervisor maintenance.
• Security IN the Cloud (Customer Responsibility): Customer data encryption (in transit via TLS and at rest via KMS), operating system security patches (for IaaS), firewall configuration (Security Groups and Network ACLs), Identity and Access Management (IAM permissions, MFA enforcement), and application code security (OWASP defenses).

Cloud Deployment Models: Public, Private, Hybrid & Multi-Cloud

The choice of deployment model depends on regulatory compliance, data sovereignty, latency requirements, and existing enterprise investments:

Hyperscale Cloud Providers: AWS vs Microsoft Azure vs GCP

The global cloud market is anchored by three hyperscalers, each possessing architectural distinctives:

Global Cloud Infrastructure: Regions, Availability Zones & PoPs

High-availability cloud engineering relies on hierarchical physical infrastructure topologies designed to prevent geographic catastrophes from causing total outages:

Key operational rules for cloud architects:

• Regions: Geographically separate physical clusters. Storing data in eu-central-1 (Frankfurt) guarantees that data never leaves German legal jurisdiction, fulfilling strict data sovereignty compliance.
• Availability Zones (AZs): An AZ consists of one or more physical datacenters engineered to be isolated from failures in other AZs (distinct power substations, cooling systems, flood planes). Deploying workloads across at least two AZs achieves Multi-AZ High Availability.
• Edge Locations: Caching endpoints situated in high-density metropolitan cities globally. They terminate client TLS handshakes close to end-users and serve cached static assets, dropping network round-trip time from 150ms to <15ms.

Virtual Machines & Hypervisor Architectures

A virtual machine (VM) is an emulation of a physical computer system. Virtualization allows multiple isolated guest operating systems to execute concurrently on a single physical host server, mediated by a hypervisor (Virtual Machine Monitor - VMM).

Cloud VM instance classes are tailored for specific computational patterns:

• General Purpose (e.g., AWS m6i): Balanced ratio of CPU to memory; ideal for web application servers and microservices.
• Compute Optimized (e.g., AWS c6i): High ratio of compute performance per vCPU; ideal for media encoding, batch processing, and high-performance computing (HPC).
• Memory Optimized (e.g., AWS r6i): Massive RAM allocation (up to 768GB+); engineered for in-memory caches (Redis clusters) and transactional databases.

Cloud Storage: Block, Object & File Storage

Cloud platforms provide three fundamental storage paradigms, each addressing distinct performance, consistency, and access characteristics:

The production TypeScript implementation below demonstrates generating an AWS S3 presigned upload URL with cryptographic expiration, allowing clients to upload directly to S3 without passing massive files through backend API servers.

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
import crypto from 'crypto';

const s3Client = new S3Client({
  region: process.env.AWS_REGION || 'us-east-1'
});

interface PresignedUploadTicket {
  uploadUrl: string;
  objectKey: string;
  expiresInSeconds: number;
}

export async function generatePresignedUploadUrl(
  tenantId: string,
  fileName: string,
  contentType: string
): Promise<PresignedUploadTicket> {
  // 1. Generate unique, collision-resistant object key
  const uniqueId = crypto.randomUUID();
  const objectKey = `uploads/${tenantId}/${uniqueId}-${fileName}`;
  const expiresInSeconds = 900; // 15 minutes validity

  // 2. Declare PutObject Command with Strict Content-Type Restriction
  const command = new PutObjectCommand({
    Bucket: process.env.S3_BUCKET_NAME!,
    Key: objectKey,
    ContentType: contentType,
    Metadata: {
      'uploaded-by-tenant': tenantId,
      'upload-timestamp': Date.now().toString()
    }
  });

  // 3. Cryptographically sign URL using AWS SigV4 credentials
  const uploadUrl = await getSignedUrl(s3Client, command, { expiresIn: expiresInSeconds });

  return { uploadUrl, objectKey, expiresInSeconds };
}

Identity and Access Management (IAM) & Least Privilege

Identity and Access Management (IAM) is the foundational security plane that controls authentication (who can access the cloud environment) and authorization (what actions they are permitted to perform on which cloud resources).

IAM Core Entities

• IAM Users: Permanent human identities with long-term credentials (password, console access, access keys). In enterprise security, direct IAM users are discouraged in favor of federated SSO (Single Sign-On).
• IAM Groups: Collections of users granted identical policies (e.g., DevOpsEngineers, BillingAuditors).
• IAM Roles: Temporary identities assumed by trusted entities (applications running on EC2, Lambda functions, or federated OpenID Connect identities). Roles issue short-lived credentials generated via the AWS Security Token Service (STS) that expire automatically after 1 hour, eliminating hardcoded secret leaks.

The Principle of Least Privilege

Every user, service, and application container must be granted strictly the minimal permissions required to execute its explicit task—and nothing more. Wildcard permissions like "Action": "*" on "Resource": "*" represent an extreme security violation.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowTenantScopedReadWrite",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::devascent-production-data/tenants/${aws:PrincipalTag/TenantId}/*"
    },
    {
      "Sid": "DenyUnencryptedTransit",
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::devascent-production-data/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Billing, FinOps & Cloud Cost Management

Cloud elasticity without cost control can lead to catastrophic financial surprises. FinOps (Cloud Financial Operations) is the operational discipline of bringing financial accountability to the variable spend model of cloud computing.

1. Compute Purchasing Models

• On-Demand: Pay for compute by the second with zero upfront commitment. Maximum flexibility, but highest unit cost. Best for unpredictable spike traffic and short-lived dev environments.
• Reserved Instances (RIs) / Savings Plans: Commit to a steady state of compute usage (measured in $/hour) for a 1-year or 3-year term. Yields discounts of up to 72% compared to On-Demand. Ideal for production databases and baseline microservice pools.
• Spot Instances: Bid on unused spare compute capacity across cloud datacenters at discounts of up to 90%. However, the cloud provider can reclaim (terminate) the instance with a 2-minute warning. Ideal for fault-tolerant batch workloads, video encoding, and distributed data processing.

2. The FinOps Lifecycle

# Production AWS CloudWatch Cost Budget Alert with SNS Notification
resource "aws_budgets_budget" "monthly_cost_budget" {
  name              = "monthly-production-budget"
  budget_type       = "COST"
  limit_amount      = "5000"
  limit_unit        = "USD"
  time_unit         = "MONTHLY"
  time_period_start = "2026-01-01_00:00"

  # Trigger alert when actual monthly spend exceeds 80%
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["finops-alerts@devascentacademy.me"]
  }

  # Trigger alert when forecasted monthly spend is projected to exceed 100%
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["oncall-leads@devascentacademy.me"]
  }
}

University & Industrial Examination Review