Cloud & AWS Infrastructure
Overview
Cloud infrastructure knowledge spans AWS certification study materials, practical architecture patterns, container orchestration, serverless computing, and network design. The primary cloud platform referenced is AWS, with notes covering Solutions Architect Professional, AIP, and SAP 2023 certifications.
Core Areas
AWS Services
Key service categories covered in source notes:
- Compute — EC2, Lambda, ECS, EKS, Fargate
- Storage — S3, EBS, EFS, Glacier, Storage Gateway
- Networking — VPC, Route 53, CloudFront, Direct Connect, Transit Gateway
- Databases — RDS, Aurora, DynamoDB, ElastiCache, Redshift
- Security — IAM, KMS, WAF, Shield, GuardDuty, Secrets Manager
- Integration — SQS, SNS, EventBridge, Step Functions, API Gateway
Container Orchestration
Kubernetes is the primary orchestration platform. Topics include:
- Pod scheduling and resource limits
- Deployments, StatefulSets, DaemonSets
- Ingress controllers and service mesh (Istio)
- Helm chart packaging
- EKS (managed Kubernetes on AWS)
See also: Microservices
Serverless
- AWS Lambda function design (cold starts, concurrency, memory tuning)
- Event-driven architectures using SNS/SQS triggers
- API Gateway + Lambda REST API patterns
- Step Functions for workflow orchestration
System Design
Recurring patterns in architecture notes:
- CQRS — Command Query Responsibility Segregation
- Event Sourcing — persisting state as event log
- Circuit Breaker — fault tolerance for service calls
- BFF (Backend for Frontend) — tailored APIs per client type
- Micro-frontends — applying microservices concepts to UI
See: System Design
Network Design
- VPC design: public/private subnets, NAT gateways, VPC peering
- DNS management with Route 53 (weighted routing, failover, latency-based)
- CDN: CloudFront distributions, edge caching, signed URLs
- Hybrid connectivity: Direct Connect, Site-to-Site VPN
AWS Service Notes & Distinctions
Durable service-level distinctions distilled from Solutions Architect Professional study highlights — the gotchas worth remembering.
Messaging & Streaming
- SNS vs SQS — SNS is push pub/sub (messages pushed to subscribers as published); SQS is pull queuing (receivers poll for messages). Fan-out often combines them (SNS → many SQS queues).
- SQS FIFO vs Standard — FIFO gives ordering and exactly-once processing but limited TPS; Standard is high-throughput, at-least-once, no ordering guarantee.
- Dead-Letter Queues — target for messages a source queue can’t process; isolate poison messages for debugging.
- Kinesis Data Streams vs Firehose — Streams = shards for custom real-time consumers; Firehose = managed delivery to S3 / Redshift / Elasticsearch.
- SWF — workflow coordination via workers (do the work) and deciders (control flow).
Storage
- EBS volume types —
gp2SSD is the default for transactional workloads;st1HDD suits big sequential throughput (MapReduce, Kafka, log processing, data warehouse, ETL);sc1is cold HDD;io1/io2for provisioned IOPS. - S3 — Requester Pays buckets shift transfer cost to the caller; event notifications can take minutes; Snowball for large offline data transfer. You can stream uploads (e.g. boto3 with an in-memory file object) instead of writing to local disk first.
Databases & Caching
- DynamoDB — secondary indexes improve access patterns; Streams capture item-level changes; auto scaling optimizes cost/performance.
- LSI vs GSI — an LSI filters on the same hash key using different sort attributes (must be defined at table creation); a GSI queries on different hash keys entirely, at extra throughput cost, and its hash+range need not be unique.
- SimpleDB vs DynamoDB — SimpleDB auto-indexes all attributes for query flexibility but trades away performance and scale; fine for small workloads, DynamoDB for scale.
- Redis vs Memcached — Redis adds persistence, replication/HA, pub/sub, transactions, Lua scripting, and rich data structures (lists, sets, sorted sets, hashes); Memcached is multithreaded but a simple k-v store with no replication.
- Redshift is single-AZ (design HA around that). DMS migrates data; SCT converts schema.
Networking
- VPC Endpoints — Interface endpoints (AWS PrivateLink, ENI-based) reach AWS services privately from within a VPC; Gateway endpoints (S3, DynamoDB) work via route tables. Endpoint policies restrict access.
- CloudFront request triggers can generate HTTP responses directly (useful for auth/redirects). Route 53 supports health checks in complex failover configs.
Analytics
- Athena — serverless SQL directly over S3; converting to columnar formats (Parquet/ORC) cuts cost and boosts performance.
- Glue — managed ETL + data catalog feeding S3 data lakes.
Security & Governance
- IAM policies — identity-based attach to a user/group/role; resource-based attach to the resource (S3 bucket, SQS queue, KMS key).
- STS issues temporary credentials. CloudTrail log file integrity validation detects tampering with audit logs.
- Organizations — OUs + Service Control Policies for multi-account governance. Macie discovers sensitive data; WAF and CloudHSM cover app-layer and key security.
Compute & Deployment
- Elastic Beanstalk blue/green = CNAME swap (it’s a PaaS). CloudFormation nested stacks compose reusable templates. Dedicated Hosts with host affinity for licensing/compliance. AWS Batch for batch compute.
Operations & Monitoring
- CloudWatch Alarm vs Event — an alarm watches a single metric and fires actions only on sustained changes (and can appear on dashboards); an event reacts to state changes in the environment (e.g. a Lambda being created) or a schedule, and is handled by targets with far more options than alarm actions. See Observability for the general model.
Key Frameworks & Patterns
| Pattern | Use Case |
|---|---|
| Multi-AZ | High availability for RDS, ALB, ECS |
| Auto Scaling | Demand-driven compute capacity |
| Blue/Green Deploy | Zero-downtime releases |
| Infrastructure as Code | CloudFormation, CDK, Terraform |
| Well-Architected Framework | Operational excellence, security, reliability, performance, cost |
Relationships
- AI & Machine Learning — ML models deploy on cloud infrastructure (SageMaker, EKS)
- Entrepreneurship & SaaS — SaaS products are built on cloud platforms
- Kubernetes — primary container orchestration
- Microservices — common deployment target for cloud workloads
- Cloud Security — cloud-specific attack surfaces (metadata SSRF, resource hijacking)
- JSON Web Token (JWT) — token-based auth for cloud/serverless APIs
- Self-Hosted Infrastructure — the same trade-offs on a budget: hybrid public/private nodes, and free tiers that charge at the seams
- Databases — choosing among the managed AWS database options
References
- AWS SAP 2023 certification notes
- Kubernetes and Docker deep-dives