❖ The cloud is made up of servers in data centers all over the world.

Moving to the cloud can save companies money and add convenience
for users.
❖ The definition for the cloud can seem murky, but essentially, it’s a term
used to describe a global network of servers, each with a unique
function. The cloud is not a physical entity, but instead is a vast network
of remote servers around the globe which are hooked together and
meant to operate as a single ecosystem.

❖ Cloud computing is a revolutionary technology transforming how we

store, access, and process data. It simply refers to delivering computing
 resources, such as servers, storage, databases, software, and
applications, over the Internet. Cloud computing uses a network of
remote computer systems housed on the net to save and process data
rather than relying on physical infrastructure.
❖ There are the following 5 types of cloud that you can deploy according
to the organization's needs-

Public Cloud:-

Public cloud is defined as computing services offered by third-party

providers over the public Internet, making them available to anyone
who wants to use or purchase them. They may be free or sold on-
demand, allowing customers to pay only per usage for the CPU cycles,
storage, or bandwidth they consume.

OR,

Public cloud is open to all to store and access information via the
Internet using the pay-per-usage method. In public cloud, computing
resources are managed and operated by the Cloud Service Provider
(CSP). The CSP looks after the supporting infrastructure and
ensures that the resources are accessible to and scalable for the users.
Example: Amazon elastic compute cloud (EC2), IBM SmartCloud
Enterprise, Microsoft, Google App Engine, Windows Azure Services
Platform.

Private Cloud :-
Private cloud is also known as an internal cloud or corporate cloud. It is
used by organizations to build and manage their own data centers
internally or by the third party. It can be deployed using Opensource
tools such as Openstack and Eucalyptus.

OR,

Private cloud solutions are dedicated to one organization or business,

and often have much more specific security controls than a public cloud.
Many medical offices, banking institutions, and other organizations who
are required to meet federal and state guidelines for data controls use a
private cloud. Using private cloud storage allows them to control highly
sensitive data by meeting regulations and industry-
based criteria, whether that be medical
records, trade secrets, or other
classified information.
Examples:- VMware vSphere, OpenStack, Microsoft Azure Stack, Oracle
Cloud at Customer, and IBM Cloud Private.
Based on the location and management, National Institute of Standards and
Technology (NIST) divide private cloud into the following two parts-
1-On-premise private cloud
2-Outsourced private cloud

Hybrid Cloud = (Public Cloud + Private Cloud)

Hybrid cloud solutions are a blend of public and private clouds. This is a more
complex cloud solution in that the organization must manage multiple
platforms and determine where data is stored. An example of a hybrid cloud
solution is an organization that wants to keep confidential information secured
on their private cloud, but make more general, customer-facing content on a
public cloud.

OR,

Hybrid cloud is partially secure because the services which are running on the
public cloud can be accessed by anyone, while the services which are running
on a private cloud can be accessed only by the organization's users. In a hybrid
cloud setup, organizations can leverage the benefits of both public and private
clouds to create a flexible and scalable computing environment. The public
cloud portion allows using cloud services provided by third-party providers,
accessible over the Internet.

Examples: Google Application Suite (Gmail, Google Apps, and Google Drive),
Office 365 (MS Office on the Web and One Drive), Amazon Web Services.

Community Cloud:-
Community cloud allows systems and services to be accessible by a group of
several organizations to share the information between the organization and a
specific community. It is owned, managed, and operated by one or more
organizations in the community, a third party, or a combination of them. In a
community cloud setup, the participating organizations, which can be from the
same industry, government sector, or any other community, collaborate to
establish a shared cloud infrastructure. This infrastructure allows them to
access shared services, applications, and data relevant to their community.

OR,
Community cloud is a cloud infrastructure that allows systems and services to
be accessible by a group of several organizations to share the information. It is
owned, managed, and operated by one or more organizations in the
community, a third party, or a combination of them.

Example: Health Care community cloud

Multi-Cloud
Multi-cloud is a strategy in cloud computing where companies utilize more
than one cloud service provider or platform to meet their computing needs. It
involves distributing workloads, applications, and statistics throughout
numerous cloud environments consisting of public, private, and hybrid clouds.

Examples: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud
Platform (GCP).
 Difference between:- public cloud, private cloud, hybrid cloud, and community cloud
-

Parameter Public Cloud Private Cloud Hybrid Cloud Community Multi-Cloud

Cloud

Service Enterprise Enterprise Community Multiple cloud

Host
provider (Third party) (Third party) (Third party) providers

Community Multiple
Users General public Selected users Selected users
members organizations

Access Internet Internet, VPN Internet, VPN Internet, VPN Internet, VPN

Service Multiple
Owner Enterprise Enterprise Community
provider organizations

Shared cost Variable

Infrastructure Mixed
Cost Pay-per-usage among depending on
investment (variable)
members usage

Varied Varied Varied

Provider's Enhanced
Security (depends on (depends on (depends on
responsibility control
setup) setup) setup)

Scalable Scalable Scalable Scalable

Scalability Highly scalable within within within within
resources resources resources resources

Varied Varied Varied

Limited
Customization High control (depends on (depends on (depends on
control
setup) setup) setup)

Varied
Resource Shared among Shared among
Not shared Not shared (depends on
Sharing community providers
setup)
❖ A Server is a program or a device that provides functionality for called
clients which are other programs or devices.
❖ A server is a hardware device or software that processes requests sent
over a network and replies to them. A client is the device that submits a
request and waits for a response from the server. The computer system
that accepts requests for online files and transmits those files to the
client is referred to as a “server” in the context of the Internet.

A device needs to be set up to listen for client requests across a network

connection in order to perform the role of a server. The operating system
may include this functionality as an installed application, a role, or a
combination of the two.
❖ Application Server :-
These servers host web apps allowing
users in the network to run and use
them preventing the installation of a
copy on their own computers. These
servers need not be part of the World
Wide Web. Their clients are computers
with a web browser.

❖ Catalog Server :-
These servers maintain an index or
table of contents of information that
can be found across a large distributed
network. Distributed networks may
include computers, users, files shared
on file servers, and web apps.

❖ Communication Server :-
These servers maintain an environment
needed for one communication
endpoint to find other endpoints and
then communicate with them. These
servers may or may not include a
directory of communication endpoints
and a presence detection service,
depending on the openness and
security parameters of the network.
 Computing Server :-
These servers share vast amounts of
computing resources which include
CPU and random-access memory over
a network. Any computer program that
needs more CPU power and RAM than
a personal computer can probably
afford can use these types of servers.
The client must be a networked
computer to implement the client–
server model which is a necessity.

❖ Database Server:-
These servers maintain and share any
form of database over a network. A
database is an organized collection of
data with predefined properties that
may be displayed in a table. Clients of
these servers
are spreadsheets, accounting
software, asset management software,
or virtually any computer program that
consumes well-organized data,
especially in large volumes.

❖ File Server
Shares files and folders, storage space
to hold files and folders, or both, over
a network. Networked computers are
the intended clients, even though local
programs can be clients.

❖ Game Server
These servers enable several
computers or gaming devices to play
multiplayer games. Personal
computers or gaming consoles are
their clients.
❖ Mail Server
These servers make email
communication possible in the same
way as a post office makes snail mail
communication possible. Clients of
these servers are senders and
recipients of email.

❖ Web Server
These servers host web pages. A web
server is responsible for making the
World Wide Web possible. Each
website has one or more web servers.
Their clients are computers with a
web browser.
Cloud computing is the on-demand delivery of IT resources over the
Internet with pay-as-you-go pricing. Instead of buying, owning, and
maintaining physical data centers and servers, you can access
technology services, such as
computing power, storage, and
databases, on an as-needed basis
from a cloud provider like Amazon
Web Services (AWS).

OR,

Cloud computing is adopted by

every company, whether it is an
MNC or a startup many are still
migrating towards it because of the cost-cutting, lesser maintenance,
and the increased capacity of the data with the help of servers
maintained by the cloud providers.
One more reason for this drastic change from the On-premises servers
of the companies to the Cloud providers is the ‘Pay as you go’ principle-
based services provided by them i.e., you only have to pay for the service
which you are using.
Benefits of Cloud Computing
• Security
• Flexibility
• Mobility
• Cost Savings
• Increased Collaboration
• Quality Control
• Disaster Recovery
• Loss Prevention
• Automatic Software Updates
• Competitive Edge
• Sustainability
• Agility
➢ Massive Scale

➢ Resilient Computing

➢ Homogeneity

➢ Geographic Distribution

➢ Virtualization

➢ Service Orientation

➢ Low Cost Software

➢ Sustainability

➢ Automation

➢ Flexible pricing models

➢ Multi-tenancy

➢ Measured service

➢ On-demand self-services

➢ Broad network access

➢ Rapid elasticity

➢ Advanced Security
There are the following three types of cloud service models
1. Software as a service (SaaS)
2. Platform as a service (PaaS)
3. Infrastructure as a service (IaaS)
Iaas:-
• IaaS is also known as Hardware
as a Service (HaaS). It is a
computing infrastructure
managed over the internet. The
main advantage of using IaaS is
that it helps users to avoid the
cost and complexity of
purchasing and managing the
physical servers.
• Infrastructure as a service (IaaS)
is a cloud computing offering in
which a vendor provides users
access to computing resources
such as servers, storage and networking. Organizations use their own
platforms and applications within a service provider's infrastructure. A
vendor provides clients pay-as-you-go access to storage, networking,
servers and other computing resources in the cloud.
• Example:- DigitalOcean, Linode, Amazon Web Services (AWS), Microsoft
Azure, Google Compute Engine (GCE), Rackspace, and Cisco Metacloud.
Paas:-
• PaaS cloud computing
platform is created for the
programmer to develop, test,
run, and manage the
applications.
• PaaS is a category of cloud
computing that provides a
platform and environment to
allow developers to build
applications and services over
the internet. PaaS services are
hosted in the cloud and
accessed by users simply via
their web browser.
A PaaS provider hosts the hardware and software on its own
infrastructure.
 • As a result, PaaS frees users from having to install in-house hardware
and software to develop or run a new application. Thus, the
development and deployment of the application take
place independent of the hardware.
• Example:- AWS Elastic Beanstalk, Windows Azure, Heroku, [Link], Google App
Engine, Apache Stratos, Magento Commerce Cloud, and OpenShift.

Saas:-
• SaaS is also known as
"on-demand software".
It is a software in which
the applications are
hosted by a cloud service
provider. Users can
access these applications
with the help of internet
connection and web
browser.
• Software-as-a-Service
(SaaS) is a way of
delivering services and applications over the Internet. Instead of
installing and maintaining software, we simply access it via the Internet,
freeing ourselves from the complex software and hardware
management. It removes the need to install and run applications on our
own computers or in the data centers eliminating the expenses of
hardware as well as software maintenance.
• Example: BigCommerce, Google Apps, Salesforce, Dropbox, ZenDesk,
Cisco WebEx, ZenDesk, Slack, and GoToMeeting
 Different between IaaS, PaaS, and SaaS:-

IaaS Paas SaaS

It provides a virtual data center

It provides virtual platforms and It provides web software and
to store information and create
tools to create, test, and deploy apps to complete business
platforms for app development,
apps. tasks.
testing, and deployment.

It provides access to resources It provides runtime

It provides software as a service
such as virtual machines, virtual environments and deployment
to the end-users.
storage, etc. tools for applications.

It is used by network architects. It is used by developers. It is used by end users.

SaaS provides
IaaS provides only PaaS provides
Infrastructure+Platform
Infrastructure. Infrastructure+Platform.
+Software.

OverView Of Amazon Web

In 2006, Amazon Web Services (AWS) began offering IT infrastructure services

to businesses as web services—now commonly known as cloud computing.
One of the key benefits of cloud computing is the opportunity to replace
upfront capital infrastructure expenses with low variable costs that scale with
your business. With the cloud, businesses no longer need to plan for and
procure servers and other IT infrastructure weeks or months in advance.
Instead, they can instantly spin up hundreds or thousands of servers in minutes
and deliver results faster.
Today, AWS provides a highly reliable, scalable, low-cost infrastructure
platform in the cloud that powers hundreds of thousands
of businesses in 190 countries around the world.

• AWS (Amazon Web Services) is a cloud computing platform.

• The first product (S3) was released in 2006.
• AWS has grown a lot since then in both size and product range.
• It is, to date, the largest cloud provider in the world.
• AWS is the largest of the cloud providers.
• AWS competence is popular is the job marketing.
• You can do most things in the AWS Cloud.
• Big community/support.

In the Journey of AWS, understanding the key concepts such as Regions,

Availability Zones, Global Network Infrastructure, etc is crucial. The
fundamentals of AWS keep on maintaining the applications reliable and
scalable with services globally with coming to a strategic deployment of
resources for optimal performance and resilience. The following are the some
of the main fundamentals of AWS:
Global Network Infrastructure:-
• AWS ensures the reliability and scalability of services through setting up
its own AWS Network Infrastructure globally. It helps in better
management of data transmissions for optimized performance and
security reliance.
• Amazon Web Services provides the most extensive global footprint
compared to any other cloud providers in the market, opening up new
regions faster than others. AWS maintains numerous global
geographic regions, from North America, South America, Europe, Asia
Pacific, and the Middle East. AWS serves a million active customers in
more than 190 countries.
• AWS can support this massive workload, Global Cloud Infrastructure
which consists of Availability Zones, Regions, and Edge Networks. The
AWS Global Cloud Infrastructure is the most secure, extensive, and
reliable cloud platform in the industry today, which offers a wide range
of cloud service offerings.
• AWS is a cloud computing platform which is globally available.
• Global infrastructure is a region around the world in which AWS is
based. Global infrastructure is a bunch of high-level IT services which
is shown below:
• AWS is available in 19 regions, and 57 availability zones in December
2018 and 5 more regions 15 more availability zones for 2019.

Regions: -
• AWS provide the services with respective division of regions. The
regions are divided based on geographical areas/locations and will
establish data centers. Based on need and traffic of users, the scale
 of data centers is depended to facilitate users with low-latencies
of servcies.
• AWS has the concept of a Region, which is a physical location around the
world where we cluster data centers. We call each group of logical data
centers an Availability Zone.
• Each AWS Region consists of multiple, isolated, and physically separate AZ's
within a geographic area. Unlike other cloud providers, who often define a
region as a single data center, the multiple AZ design of every AWS Region
offers advantages for customers.
• Each AZ has independent power, cooling, and physical security and is
connected via redundant, ultra-low-latency networks. AWS customers
focused on high availability can design their applications to run in multiple
AZ's to achieve even greater fault-tolerance. AWS infrastructure Regions
meet the highest levels of security, compliance, and data protection

Availability Zones (AZ): -

• To prevent the Data centers for the Natural Calamities or any other
disasters. The Datacentres are established as sub sections with
isolated locations to enhance fault tolerance and disaster recovery
management.
• An Availability Zone (AZ) is one or more discrete data centers with
redundant power, networking, and connectivity in an AWS
Region. AZ’s give customers the ability to operate production
applications and databases that are more highly available, fault
tolerant, and scalable than would be possible from a single data
center.
• All AZ’s in an AWS Region are interconnected with high-
bandwidth, low-latency networking, over fully redundant,
dedicated metro Fiber providing high-throughput, low-latency
networking between AZ’s. All traffic between AZ’s is encrypted.
Local Zones:-
• A Local Zone is an extension of an AWS Region in geographic proximity
to your users. Local Zones have their own connections to the internet
and support AWS Direct Connect, so that resources created in a Local
Zone can serve local users with low-latency communications.
• The code for a Local Zone is its Region code followed by an identifier that
indicates its physical location. For example, us-west-2-lax-1 in Los
Angeles.
• The following diagram illustrates the AWS Region us-west-2, two of its
Availability Zones, and two of its Local Zones. The VPC spans the
Availability Zones and one of the Local Zones. Each zone in the VPC has
one subnet, and each subnet has an instance.

AWS Edge Location:-

• Edge locations are the endpoints for AWS used for caching content.
• Edge locations consist of CloudFront, Amazon's Content Delivery
Network (CDN).
• Edge locations are more than regions. Currently, there are over 150 edge
locations.
• Edge location is not a region but a small location that AWS have. It is
used for caching the content.
• Edge locations are mainly located in most of the major cities to distribute
the content to end users with reduced latency.
• AWS consists of many cloud services that you can use in combinations
tailored to your business or organizational needs. This section
introduces the major AWS services by category. Choose a category to
explore its services.
 IDENTITY AND ACCESS MANAGEMENT
❑ AWS Identity and Access Management (IAM) is a service that helps you
securely control access to AWS resources. With IAM, you can manage
permissions that control which AWS resources users can access. You use
IAM to control who is authenticated (signed in) and authorized (has
permissions) to use resources. IAM provides the infrastructure
necessary to control authentication and authorization for your AWS
accounts.
❑ In AWS Identity and Access Management (IAM), you can specify who or
what can access services and resources in AWS, centrally manage fine-
grained permissions, and analyze access to refine permissions across
AWS.
❑ IAM is mainly used to manage users, groups, roles and access policies

How IAM Works?

❑ IAM verifies that a user or service has the necessary authorization to
access a particular service in the AWS cloud. We can also use IAM to
grant the right level of access to specific users, groups, or services. For

example, we can use IAM to enable an EC2 instance to access S3 buckets

by requesting fine-grained permissions.
❑ IAM Identities assists us in controlling which users can access which
services and resources in the AWS Console and also we can assign
policies to the users, groups, and roles. The IAM Identities can be created
by using the Root user .

❖ An AWS Identity and Access Management (IAM) user is an entity that

you create in AWS. The IAM user represents the human user or workload
who uses the IAM user to interact with AWS. A user in AWS consists of a
name and credentials.

❖ An IAM user group is a collection of IAM users. User groups let you
specify permissions for multiple users, which can make it easier to
manage the permissions for those users.

❖ An IAM role is an IAM identity that you can create in your account that
has specific permissions. An IAM role is similar to an IAM user, in that it
is an AWS identity with permission policies that determine what the
identity can and cannot do in AWS. However, instead of being uniquely
associated with one person, a role is intended to be assumable by
anyone who needs it. Also, a role does not have standard long-term
credentials such as a password or access keys associated with it. Instead,
when you assume a role, it provides you with temporary security
credentials for your role session.
 Features of Iam

➢ Centralised control of your AWS account: You can control creation,

rotation, and
➢ cancellation of each user's security credentials. You can also control
what data in the aws system users can access and how they can access.
➢ Shared Access to your AWS account: Users can share the resources for
the collaborative projects.
➢ Granular permissions: It is used to set a permission that user can use a
particular service but not other services.
➢ Identity Federation: An Identity Federation means that we can use
Facebook, Active Directory, LinkedIn, etc with IAM. Users can log in to
the AWS Console with same username and password as we log in with
the Active Directory, Facebook, etc.
➢ Multifactor Authentication: An AWS provides multifactor authentication
as we need to enter the username, password, and security check code
to log in to the AWS Management Console.
➢ Permissions based on Organizational groups: Users can be restricted to
the AWS access based on their job duties, for example, admin,
developer, etc.
➢ Networking controls: IAM also ensures that the users can access the
AWS resources within the organization's corporate network.
➢ Provide temporary access for users/devices and services where
necessary: If you are using a mobile app and storing the data in AWS
account, you can do this only when you are using temporary access.
➢ Integrates with many different aws services: IAM is integrated with
many different aws services.
➢ Supports PCI DSS Compliance: PCI DSS (Payment Card Industry Data
Security Standard) is a compliance framework. If you are taking credit
card information, then you need to pay for compliance with the
framework.
 ➢ Eventually Consistent: IAM service is eventually consistent as it achieves
high availability by replicating the data across multiple servers within
the Amazon's data center around the world.
➢ Free to use: AWS IAM is a feature of AWS account which is offered at no
additional charge. You will be charged only when you access other AWS
services by using IAM user.

❑ IAM user limit is 5000 per AWS account . You can add up to 10 users at
one time.
❑ You are also limited to 300 groups per AWS account .
❑ You are limited to 1000 IAM Roles under AWS account.
❑ Default limits of Managed Policies attached to an IAM role and IAM
user is 10.
❑ IAM user can be a member of 10 groups (max ).

❑ AWS multi-factor authentication (MFA) is an AWS Identity and Access

Management (IAM) best practice that requires a second authentication
factor in addition to user name and password sign-in credentials.
❑ For increased security, we recommend that you configure multi-factor
authentication (MFA) to help protect your AWS resources. You can
enable MFA for the AWS account root user and IAM users. When you
enable MFA for the root user, it affects only the root user credentials.
IAM users in the account are distinct identities with their own
credentials, and each identity has its own MFA configuration.
sign-in credentials when they access AWS websites or services. AWS
supports the following
MFA types:
1. Passkeys and security keys
2. Virtual authenticator applications
3. Hardware TOTP tokens.
Passkeys and security keys

AWS Identity and Access Management supports passkeys and security keys for
MFA. Based on FIDO standards, passkeys use public key cryptography to
provide strong, phishing-resistant authentication that is more secure than
passwords. AWS supports two types of passkeys: device-bound passkeys
(security keys) and synced passkeys.
• Security keys: These are physical devices, like a YubiKey, used as a second
factor for authentication. A single security key can support multiple root
user accounts and IAM users.
• Synced passkeys: These use credential managers from providers such as
Google, Apple, Microsoft accounts, and third-party services like
1Password, Dash lane, and Bit warden as a second factor.

Virtual authenticator applications

A virtual authenticator application runs on a phone or other device and

emulates a physical device. Virtual authenticator apps implement the time-
based one-time password (TOTP) algorithm and support multiple tokens on a
single device. The user must type a valid code from the device when prompted
during sign-in. Each token assigned to a user must be unique. A user can't type
a code from another user's token to authenticate.

Hardware TOTP tokens

A hardware device generates a six-digit numeric code based on the time-
based one-time password (TOTP) algorithm. The user must type a valid code
from the device on a second webpage during sign-in. Each MFA device
assigned to a user must be unique. A user cannot type a code from another
user's device to be authenticated. For information on supported hardware
MFA devices, see Multi-Factor Authentication (MFA). For instructions on
setting up a hardware TOTP token for an IAM user.