Cloud Computing

Complete Notes

[Link]. (H) Computer Science · Semester VI

DSC18 / GE7d / DSE8e · NEP UGCF 2022

7 Units · 45 Hours · Based on Buyya & Sosinsky

Table of Contents

Unit 1 Overview of Cloud Computing 6 hrs

Unit 2 Parallel & Distributed Computing 6 hrs

Unit 3 Virtualisation & Cloud-Enabling Tech 10 hrs

Unit 4 Cloud Architecture, Services & Storage 6 hrs

Unit 5 Data-Intensive Computing & MapReduce 6 hrs

Unit 6 Cloud Computing Management 6 hrs

Unit 7 Understanding Cloud Security 5 hrs

 Unit 1

Overview of Cloud Computing 6 hrs | Buyya Ch.1

1.1 Introduction to Cloud Computing

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a
shared pool of configurable computing resources (networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management effort or service
provider interaction. — NIST SP 800-145

NIST Definition (5 Essential Characteristics)

• On-demand self-service: A consumer can unilaterally provision computing capabilities without

requiring human interaction with each service provider.

• Broad network access: Capabilities are available over the network and accessed through
standard mechanisms (laptops, mobiles, tablets).

• Resource pooling: Provider's resources are pooled to serve multiple consumers using a
multi-tenant model.

• Rapid elasticity: Capabilities can be elastically provisioned and released, appearing unlimited
to the consumer.

• Measured service: Resource usage can be monitored, controlled, and reported for both
provider and consumer transparency.

1.2 Benefits and Limitations

Benefits
• Cost efficiency: Eliminates capital expenditure on hardware; pay-as-you-go model reduces upfront
investment.
• Scalability: Resources can be scaled up or down instantly to match demand.
• Accessibility: Services accessible from anywhere with an internet connection.
• Reliability: Data is mirrored across multiple redundant sites.
• Automatic updates: Service providers handle hardware and software updates.
• Collaboration: Multiple users can access and work on the same data simultaneously.

Limitations
• Security & privacy: Sensitive data stored off-premises raises concerns about unauthorised access.
• Downtime: Cloud services can suffer outages; always-on internet required.
• Vendor lock-in: Migrating from one provider to another is complex and costly.
• Limited control: Users have little control over the underlying infrastructure.
• Bandwidth issues: Moving large amounts of data to/from the cloud consumes significant bandwidth.

1.3 History & Evolution of Cloud Computing

• 1960s — Mainframes: Time-sharing systems allowed multiple users to share a single mainframe.
John McCarthy proposed utility computing — computing as a public utility.
• 1970s–80s — Virtualisation: IBM developed VM/370, pioneering hardware virtualisation. Multiple
OS instances on one physical machine.
• 1990s — Grid Computing: Computing grids connected geographically distributed resources to solve
large-scale scientific problems (SETI@home, Folding@home).
• 1990s — Cluster Computing: Groups of commodity computers connected by a LAN, working as a
single system for high-performance tasks.
• 1990s — Distributed Computing: Computation distributed across multiple networked computers,
sharing resources and workload.
• 1999 — [Link]: First major company to deliver enterprise applications via a website — birth
of SaaS.
• 2002 — AWS: Amazon Web Services launched, offering a suite of cloud-based services.
• 2006 — EC2 & S3: Amazon launched Elastic Compute Cloud (EC2) and Simple Storage Service
(S3), making IaaS mainstream.
• 2008–Present: Google App Engine, Microsoft Azure, OpenStack; cloud became the standard IT
delivery model.

1.4 Underlying Principles

Service-Oriented Computing (SOC)

SOC is a paradigm that utilises services as fundamental elements for developing applications. Services
are self-describing, open components that support rapid, low-cost composition of distributed
applications.

• Services are loosely coupled, reusable, and platform-independent.

• Communication via standard protocols (HTTP, SOAP, REST).
• Foundation for SOA (Service-Oriented Architecture).

Utility-Oriented Computing
Computing resources are packaged and sold as a metered service — similar to electricity or water.
Users pay only for what they consume. Cloud computing is the practical realisation of utility computing.

Elasticity in Cloud
Elasticity is the ability to dynamically acquire or release resources as workload demands change,
maintaining consistent performance. It is a key differentiator of cloud from traditional hosting.

• Horizontal scaling (scale out): Add more instances of the same resource.
• Vertical scaling (scale up): Increase capacity of an existing resource.
• Auto-scaling: Automatic adjustment triggered by metrics (CPU, memory, requests per second).
On-Demand Provisioning
Resources are allocated instantly, without human intervention from the provider, as soon as a consumer
requests them. This eliminates lead times of days or weeks seen in traditional IT procurement.

1.5 Cloud Platforms — GCP, AWS, Azure

Feature AWS Azure GCP

Founded 2006 2010 2008

Compute EC2 Azure VMs Compute Engine

Storage S3 Blob Storage Cloud Storage

PaaS Elastic Beanstalk App Service App Engine

DB RDS / DynamoDB SQL DB / CosmosDB Cloud SQL / Spanner

Market share ~32% ~22% ~12%

 Unit 2

Parallel & Distributed Computing 6 hrs | Buyya Ch.2

2.1 Parallel vs Distributed Computing

Aspect Parallel Computing Distributed Computing

Definition Multiple processors work Multiple autonomous computers

simultaneously on sub-tasks of the communicate over a network to
same problem achieve a goal

Location Processors share memory (same Nodes are geographically dispersed

machine)

Communication Shared memory / message passing Message passing over network

(LAN/WAN)

Coordination Tightly coupled Loosely coupled

Goal Speed up computation Resource sharing, fault tolerance,

scalability

Example Multi-core CPU, GPU computing Internet, Cloud, P2P networks

2.2 Elements of Parallel Computing

Types of Parallelism
• Data parallelism: Same operation on different data elements simultaneously. Example: vector
addition.
• Task parallelism: Different operations on same or different data simultaneously.
• Pipeline parallelism: Different stages of a task execute concurrently on different data.

Flynn's Taxonomy
• SISD: Single Instruction, Single Data — traditional sequential computer.
• SIMD: Single Instruction, Multiple Data — GPU, vector processors.
• MISD: Multiple Instruction, Single Data — rare, fault-tolerant systems.
• MIMD: Multiple Instruction, Multiple Data — multi-core CPUs, clusters.

Key Concepts
• Speedup (Amdahl's Law): The speedup of a program using multiple processors is limited by the
sequential fraction. S = 1 / (1-p + p/n) where p = parallelisable fraction, n = processors.
• Granularity: Ratio of computation to communication. Fine-grained = many small tasks;
coarse-grained = few large tasks.
• Scalability: Ability of a parallel system to demonstrate proportional increase in performance with
more processors.

2.3 Elements of Distributed Computing

• Transparency: Users perceive the distributed system as a single coherent system (location,
replication, failure transparency).
• Openness: System follows published standards and protocols; components can be
replaced/extended.
• Scalability: System can expand in size, geographically, and administratively without degrading
performance.
• Fault tolerance: System continues to operate despite partial failures through redundancy and
replication.
• Concurrency: Multiple processes execute simultaneously, sharing resources.
• Heterogeneity: Different hardware, OS, programming languages interoperate via middleware.

2.4 System Architectural Styles

Client-Server Architecture
A server provides services; clients request them. The server is always on, clients connect intermittently.
Examples: web browsers (client) and web servers.

Peer-to-Peer (P2P) Architecture

All nodes act as both clients and servers. No central authority. Highly decentralised and fault-tolerant.
Examples: BitTorrent, Bitcoin.

Three-Tier / Multi-Tier Architecture

• Presentation tier (UI)
• Logic tier (application server / business logic)
• Data tier (database)

Microservices Architecture
Application decomposed into small, independent services, each responsible for a specific business
function. Services communicate via APIs. Enables independent deployment and scaling.

Event-Driven Architecture
Components communicate through events. Producer emits events; consumers subscribe and react.
Promotes loose coupling. Example: AWS Lambda, Apache Kafka.
 Unit 3

Virtualisation & Cloud-Enabling 10 hrs | Buyya Ch.3 &

Ch.5
Technology

3.1 Introduction to Virtualisation

Virtualisation is the process of creating a virtual (rather than physical) version of something — such as a
server, storage device, network, or OS. It abstracts physical hardware into multiple virtual environments.

Key Characteristics of Virtualisation

• Partitioning: Multiple operating systems run on a single physical machine, each in its own
partition.

• Isolation: Each virtual machine is isolated from others — a crash in one does not affect others.

• Encapsulation: The entire state of a VM can be saved as files, making it portable.

• Hardware independence: VMs run independently of the underlying physical hardware.

3.2 Types of Virtualisation

Server virtualisation
Partitions a physical server into multiple virtual servers. Each virtual server runs its own OS. Examples:
VMware ESXi, Microsoft Hyper-V, KVM.

Desktop virtualisation (VDI)

Desktop environments hosted on a centralised server; users access via thin clients. Reduces hardware
costs, simplifies management.

Storage virtualisation
Pools physical storage from multiple devices into a single logical storage unit. Examples: SAN (Storage
Area Network), NAS.

Network virtualisation
Combines hardware and software resources into a single software-based virtual network. Includes
VLANs, VPNs, SDN (Software-Defined Networking).

Application virtualisation
Applications run in an isolated environment separate from the underlying OS. Example: Docker
containers, Java JVM.

OS-level virtualisation (Containers)

OS kernel allows multiple isolated user-space instances (containers). Lightweight vs VMs. Example:
Docker, LXC.

3.3 Implementation Levels of Virtualisation

• Instruction Set Architecture (ISA) level: Emulation of one CPU architecture on another. Slowest
but most flexible. Example: QEMU emulating ARM on x86.
• Hardware Abstraction Level (HAL): Hypervisor sits between hardware and OS. Most common
cloud approach. Type 1 and Type 2 hypervisors operate here.
• Operating System level: OS provides multiple isolated environments. Containers use this level. Very
low overhead.
• Library / API level: Virtualisation of user-space libraries. Example: Wine (runs Windows apps on
Linux).
• Application level: Virtual machine for a specific programming language. Example: JVM (Java Virtual
Machine), CLR (.NET).

3.4 Hypervisors — Types & Structures

Type 1 (Bare-metal) Hypervisor

Runs directly on physical hardware. No host OS layer. High performance and security. Used in
enterprise and cloud data centres.

• Examples: VMware ESXi, Microsoft Hyper-V, Xen, KVM

• Cloud providers (AWS, Azure, GCP) all use Type 1 hypervisors.

Type 2 (Hosted) Hypervisor

Runs on top of a conventional OS. Easier to set up but has additional overhead from the host OS.

• Examples: VMware Workstation, VirtualBox, Parallels

CPU Virtualisation
The hypervisor intercepts privileged CPU instructions from guest VMs and emulates them safely.
Modern CPUs have hardware-assisted virtualisation extensions:

• Intel VT-x (Virtualisation Technology) and AMD-V — direct execution of guest code with hardware
traps.
• Reduces overhead of software-based virtualisation significantly.

Memory Virtualisation
Each VM believes it has its own contiguous physical memory, but the hypervisor maps guest physical
addresses to actual host physical addresses.

• Shadow page tables: Hypervisor maintains a mapping from guest virtual to host physical addresses.
• Extended Page Tables (EPT) / Nested Page Tables (NPT): Hardware-assisted memory
virtualisation — reduces TLB misses.
• Memory ballooning: Dynamically reclaim unused memory from VMs with low demand.
I/O Device Virtualisation
I/O operations from VMs are intercepted and mapped to physical devices by the hypervisor.

• Full device emulation: Hypervisor emulates standard devices (e.g., Intel e1000 NIC). Portable but
slow.
• Para-virtualisation (VirtIO): Guest OS uses a special driver aware of virtualisation, reducing
overhead.
• Device pass-through (SR-IOV): Physical device directly assigned to a VM for near-native
performance.

3.5 Virtualisation and Cloud Computing

Virtualisation is the core enabling technology of cloud computing. It allows cloud providers to:

• Slice a single physical server into many VMs (multi-tenancy)

• Rapidly provision and de-provision resources on demand
• Migrate VMs between physical hosts for load balancing and maintenance (live migration)
• Create snapshots and backups of entire virtual environments
• Offer guaranteed isolation between tenants for security

Pros of Virtualisation
• Hardware utilisation increases to 70–80% vs 15% for physical servers
• Reduced power and cooling costs in data centres
• Faster server provisioning (minutes vs weeks)
• Simplified disaster recovery via VM snapshots and replication
• Supports legacy OS and applications on modern hardware

Cons of Virtualisation
• Performance overhead (5–15%) compared to bare-metal
• Requires skilled administrators to manage hypervisors
• VM sprawl — uncontrolled growth of unused VMs wasting resources
• Security risks from hypervisor vulnerabilities (VM escape attacks)
• Licensing complexity and costs

3.6 Data Center Technology

Cloud data centres are large facilities housing thousands of servers, storage systems, and networking
equipment. Key components:

• Physical infrastructure: Server racks, power distribution units (PDUs), raised floors, cooling
systems (CRAC units), fire suppression.
• Networking: High-speed switches, routers, load balancers, firewalls. Typically use spine-leaf
topology for low latency.
• Power: Redundant power feeds, UPS (Uninterruptible Power Supplies), diesel generators for backup.
• Cooling: Precision air conditioning, hot-aisle/cold-aisle containment, liquid cooling for high-density
compute.
• PUE (Power Usage Effectiveness): PUE = Total facility power / IT equipment power. Ideal PUE =
1.0. Google data centres achieve ~1.1.

3.7 Containerisation
Containers are a lightweight form of OS-level virtualisation. They package an application and all its
dependencies (libraries, config) into a single unit that runs consistently across environments.

Containers vs Virtual Machines

Aspect Container Virtual Machine

OS Shares host kernel Full guest OS

Size MBs GBs

Startup Seconds Minutes

Isolation Process-level Hardware-level

Use case Microservices, DevOps Full OS isolation, legacy apps

Docker
Docker is the most widely used containerisation platform. Key concepts:

• Image: Read-only template for creating containers (layered filesystem).

• Container: A running instance of an image.
• Dockerfile: Script specifying how to build a Docker image.
• Docker Hub: Public registry of Docker images.
• Kubernetes (K8s): Container orchestration system — automates deployment, scaling, and
management of containerised applications.
 Unit 4

Cloud Architecture, Services & 6 hrs | Buyya Ch.4

Storage

4.1 Layered Cloud Architecture

Cloud architecture is organised into layers, each building on the one below:

• Physical layer: Hardware: servers, networking, storage, data centres.

• Virtualisation layer: Hypervisors abstract physical hardware into virtual resources.
• Infrastructure layer (IaaS): Virtual machines, storage volumes, virtual networks made available to
users.
• Platform layer (PaaS): Runtime environments, middleware, databases, development tools.
• Application layer (SaaS): End-user software applications delivered via the internet.

4.2 NIST Cloud Computing Reference Architecture

The NIST reference architecture defines five major actors:

• Cloud Consumer: Person or organisation that uses cloud services provided by a Cloud Provider.
• Cloud Provider: Entity responsible for making services available; manages infrastructure.
• Cloud Auditor: Independently assesses cloud services, security, performance, and compliance.
• Cloud Broker: Manages the use, performance, and delivery of cloud services; negotiates
relationships.
• Cloud Carrier: Intermediary providing connectivity (network, telecom) between consumers and
providers.

4.3 Service Models

Infrastructure as a Service (IaaS)

Provides fundamental computing resources — virtual machines, storage, networking — on a
pay-per-use basis. The consumer manages OS, middleware, and applications. The provider manages
physical infrastructure.

• Examples: AWS EC2, Azure Virtual Machines, Google Compute Engine

• Use cases: Dev/test environments, big data, hosting custom applications

Platform as a Service (PaaS)

Provides a platform with runtime, middleware, and tools for developers to build, test, and deploy
applications without managing the underlying infrastructure.

• Examples: AWS Elastic Beanstalk, Google App Engine, Azure App Service, Heroku
• Use cases: Web application development, API backends, microservices
Software as a Service (SaaS)
Delivers complete applications over the internet. Users access via a web browser; provider manages
everything from infrastructure to application.

• Examples: Gmail, Microsoft 365, Salesforce, Zoom, Dropbox

• Use cases: Email, CRM, collaboration, ERP

Service Model Responsibility Summary

IaaS: You manage — OS, runtime, middleware, data, applications.

PaaS: You manage — data and applications only.

SaaS: You manage — nothing (only data within the app).

4.4 Types of Cloud Deployment

Public Cloud
Infrastructure owned and operated by a third-party provider; available to the general public over the
internet. Cheapest, most scalable. Examples: AWS, Azure, GCP.

Private Cloud
Infrastructure provisioned exclusively for a single organisation. Can be on-premises or hosted. More
control, higher cost. Examples: VMware vSphere, OpenStack.

Hybrid Cloud
Combination of public and private clouds, bound together by technology enabling data and application
portability. Offers flexibility and optimised cost.

Community Cloud
Shared infrastructure for a specific community of organisations with common concerns (security,
compliance, mission). Examples: Government cloud, healthcare cloud.

Multi-Cloud
Use of multiple cloud services from different providers to avoid vendor lock-in and optimise
performance.

4.5 Cloud Storage

Cloud storage is a model where data is stored on remote servers accessed via the internet, managed
and maintained by a cloud provider.

Storage-as-a-Service (STaaS)
Cloud providers offer storage capacity on a subscription or pay-per-use basis. Eliminates need for
on-premises storage hardware.
Types of Cloud Storage
• Object storage: Stores data as objects (data + metadata + unique ID). Highly scalable, ideal for
unstructured data. Example: AWS S3, GCP Cloud Storage.
• Block storage: Stores data as fixed-size blocks. Attached to VMs as virtual disks. High performance
for databases. Example: AWS EBS, Azure Disk.
• File storage: Hierarchical file system accessible via NFS/SMB. Example: AWS EFS, Azure Files.

Amazon S3 (Simple Storage Service)

S3 is the most widely used object storage service. Key concepts:

• Buckets: Containers for objects; globally unique names.

• Objects: Files + metadata stored in buckets. Max size 5TB per object.
• Storage classes: S3 Standard, S3 IA (Infrequent Access), S3 Glacier (archival) — balance cost vs
access speed.
• Durability: 99.999999999% (11 nines) — data replicated across multiple Availability Zones.
• Access control: Bucket policies, IAM policies, ACLs.
 Unit 5

Data-Intensive Computing & 6 hrs | Buyya Ch.8

MapReduce

5.1 Introduction to Data-Intensive Computing

Data-intensive computing involves processing, analysing, and extracting knowledge from massive
datasets that cannot be handled by traditional computing approaches. Characteristics of Big Data (5
Vs):

• Volume: Enormous amounts of data (terabytes to petabytes).

• Velocity: Data generated and processed at high speed (streaming data).
• Variety: Structured, semi-structured, unstructured data (text, images, logs).
• Veracity: Uncertainty and quality of data.
• Value: The business insight derived from analysis.

5.2 MapReduce Programming Model

MapReduce is a programming model and framework for processing large datasets in parallel across a
distributed cluster. Introduced by Google in 2004. Inspired by functional programming's map and reduce
operations.

MapReduce Execution Flow

• 1. Input splitting: Input data divided into fixed-size splits (typically 128MB), assigned to
mappers.

• 2. Map phase: Each mapper processes its input split, applying the user-defined Map function,
outputting key-value pairs.

• 3. Shuffle & Sort: Framework collects all values for each key across all mappers and sorts
them. Network-intensive phase.

• 4. Reduce phase: Each reducer receives all values for a set of keys, applies user-defined
Reduce function, writes final output.

• 5. Output: Results written to distributed file system (HDFS).

Word Count Example

Map function: For each word in input, emit (word, 1).

Reduce function: For each word, sum all its 1s to get total count.

Input: 'the cat sat on the mat' → Map: [(the,1),(cat,1),(sat,1),(on,1),(the,1),(mat,1)] → Shuffle: the:[1,1],
cat:[1] → Reduce: the:2, cat:1, sat:1, on:1, mat:1
5.3 Apache Hadoop
Hadoop is the most widely used open-source implementation of the MapReduce framework. Developed
at Yahoo! based on Google's MapReduce and GFS papers.

Key Hadoop Components

• HDFS (Hadoop Distributed File System): Distributed storage layer. Files split into blocks (128MB
default), replicated 3x across data nodes for fault tolerance.
• YARN (Yet Another Resource Negotiator): Resource management and job scheduling. Separates
resource management from computation.
• MapReduce: Batch processing computation framework running on top of YARN/HDFS.
• NameNode: Master node managing HDFS metadata (file-to-block mappings). Critical single point of
failure — uses HA setup.
• DataNode: Worker nodes that store actual data blocks and serve read/write requests.

Hadoop Ecosystem
• Hive: SQL-like query language (HiveQL) on top of Hadoop for data warehousing.
• Pig: High-level scripting language (Pig Latin) for data flow processing.
• HBase: NoSQL columnar database on HDFS for random read/write access.
• Spark: In-memory fast processing engine; 100x faster than MapReduce for iterative algorithms.
• Flume: Service for collecting and moving large log data into HDFS.
• Sqoop: Tool for transferring data between HDFS and relational databases.
• ZooKeeper: Distributed coordination service for managing configuration and synchronisation.

5.4 Google App Engine (GAE)

Google App Engine is a PaaS offering that allows developers to build and run applications on Google's
infrastructure. It abstracts away infrastructure management.

Key Features
• Automatic scaling — scales up and down to zero based on traffic.
• Managed runtime environments: Python, Java, Go, [Link], PHP, Ruby.
• Built-in services: Datastore, Memcache, Task Queues, Cron Jobs.
• Standard Environment: Sandboxed, more restricted, faster scaling, generous free tier.
• Flexible Environment: Runs in Docker containers, supports any language, less restrictive.

Programming Environment
GAE applications are deployed via the gcloud CLI or Cloud Console. [Link] defines runtime and
routing. Applications use App Engine APIs for storage (Cloud Datastore/Firestore), caching
(Memcache), and background tasks (Task Queue).

5.5 OpenStack
OpenStack is an open-source cloud operating system that controls large pools of compute, storage, and
networking resources throughout a data centre. It is the foundation for many private cloud deployments.

Core OpenStack Services

• Nova (Compute): Manages lifecycle of virtual machine instances. Equivalent to AWS EC2.
• Swift (Object Storage): Distributed object store. Equivalent to AWS S3.
• Cinder (Block Storage): Persistent block storage volumes for VMs. Equivalent to AWS EBS.
• Neutron (Networking): Virtual networking — creates networks, subnets, routers, floating IPs.
• Glance (Image Service): Registry and delivery service for VM images.
• Keystone (Identity): Authentication and authorisation service. Manages users, roles, tokens.
• Horizon (Dashboard): Web-based GUI for managing OpenStack resources.
• Heat (Orchestration): Template-based infrastructure automation (similar to AWS CloudFormation).
 Unit 6

Cloud Computing Management 6 hrs | Sosinsky Ch.2

6.1 Measuring the Cloud's Value

Organisations adopt cloud computing based on the value it delivers. Value is measured across multiple
dimensions:

• Business agility: How quickly new services and capabilities can be provisioned and deployed.
• Cost reduction: Savings in capital expenditure, operational expenditure, staffing, and energy.
• Scalability value: Ability to handle growth without proportional cost increase.
• Innovation enablement: Access to advanced services (AI/ML, big data) without upfront investment.
• Risk reduction: Disaster recovery, high availability, and security managed by the provider.

6.2 Total Cost of Ownership (TCO)

TCO is the complete cost of adopting and operating a technology solution over its entire lifecycle. For
cloud adoption decisions, TCO analysis compares on-premises vs cloud.

TCO Components — On-Premises

• Hardware purchase (servers, networking, storage)
• Software licences (OS, middleware, applications)
• Data centre costs (space, power, cooling, physical security)
• IT staff (system admins, DBAs, network engineers)
• Maintenance and refresh cycles (every 3–5 years)
• Disaster recovery infrastructure

TCO Components — Cloud

• Subscription or usage fees (compute, storage, networking)
• Data transfer costs (egress fees)
• Licence fees for managed services
• Cloud management tools and consultancy
• Training and skill development for cloud technologies

TCO Analysis — Key Insight

Cloud is typically more cost-effective for variable workloads and startups. On-premises can be
cheaper for stable, predictable workloads at large scale. Always perform a 3-year TCO analysis
before migration decisions.

6.3 Avoiding Capital Expenditure (CapEx)

Traditional IT involves large upfront capital expenditures (CapEx) — money spent on physical assets.
Cloud converts CapEx to operational expenditure (OpEx).

CapEx (on-premises)
Large upfront investment. Recorded as assets on balance sheet. Depreciated over time. Requires
procurement lead times (weeks to months). Creates stranded capacity if demand changes.

OpEx (cloud)
Pay-as-you-go ongoing expenses. Charged to profit & loss immediately. No procurement delays. Scale
instantly. No stranded capacity — only pay for what you use.

Financial Benefits of Moving to OpEx

• Improved cash flow — no large upfront investment.
• Better cost predictability with reserved instances and committed use contracts.
• Align IT costs directly with business usage and revenue.
• Free up capital for core business investment and R&D.;

6.4 Service Level Agreements (SLAs)

An SLA is a formal contract between a cloud provider and customer defining the expected level of
service. It sets measurable commitments and penalties for non-compliance.

Key SLA Metrics

• Availability (Uptime): Percentage of time the service is operational. AWS EC2 guarantees 99.99%
monthly uptime (~52 mins downtime/year).
• Performance: Response time, throughput, latency guarantees under specified load.
• Data durability: Probability of data not being lost. AWS S3: 99.999999999% (11 nines).
• Recovery Time Objective (RTO): Maximum acceptable time to restore service after a disruption.
• Recovery Point Objective (RPO): Maximum acceptable data loss measured in time.
• Support response time: Time to acknowledge and resolve issues at different severity levels.

SLA Breach & Remedies

When an SLA is breached, providers typically offer service credits (percentage of monthly bill).
Customers should understand that SLA credits are compensation, not actual loss recovery.

6.5 Inter-Cloud Resource Management

Inter-cloud (or cloud federation) involves multiple cloud providers cooperating to provide seamless
resource sharing and workload migration.

Resource Provisioning Methods

• Static provisioning: Resources allocated in advance based on peak demand estimates. Simple but
wasteful.
• Dynamic provisioning: Resources allocated and de-allocated based on real-time demand. Requires
monitoring and auto-scaling.
• On-demand provisioning: Resources requested and released instantly by consumers. Core cloud
model.
• Spot/Preemptible instances: Unused capacity offered at steep discounts but can be reclaimed with
short notice. AWS Spot, GCP Preemptible VMs.
 Unit 7

Understanding Cloud Security 5 hrs | Sosinsky Ch.12

7.1 Cloud Security Overview

Cloud security encompasses the policies, controls, procedures, and technologies that protect
cloud-based systems, data, and infrastructure. Security is a shared responsibility between the cloud
provider and the customer.

Shared Responsibility Model

• Provider responsibility: Physical security, hardware, hypervisor, network infrastructure, host

OS.

• Customer responsibility (IaaS): Guest OS, application, data, identity & access management.

• Customer responsibility (PaaS): Application code, data, IAM configuration.

• Customer responsibility (SaaS): Data, user access, and configuration within the application.

7.2 Cloud Security Challenges

• Data breaches: Unauthorised access to sensitive data. Multi-tenancy increases exposure — a
vulnerability in the hypervisor could expose one tenant's data to another.
• Insecure APIs: Cloud services managed via APIs. Weak authentication or unencrypted API
endpoints are major attack vectors.
• Account hijacking: Phishing, credential stuffing, or stolen API keys grant attackers access to cloud
accounts.
• Insider threats: Malicious or negligent employees of the cloud provider or customer organisation.
• Data loss: Accidental deletion, data corruption, or insufficient backups.
• Denial of Service (DoS/DDoS): Overwhelming cloud services with traffic, causing outages for
legitimate users.
• Misconfiguration: Incorrect security settings (e.g., public S3 buckets) are the #1 cause of cloud
breaches.
• Compliance and legal issues: Data residency laws, GDPR, HIPAA require data to remain in specific
jurisdictions.

7.3 Securing the Cloud

Network Security
• VPC (Virtual Private Cloud): Isolated virtual network for resources. Define subnets, routing tables,
internet gateways.
• Security Groups: Stateful virtual firewalls at the instance level — control inbound/outbound traffic.
• NACLs (Network Access Control Lists): Stateless firewall at the subnet level.
• VPN / Direct Connect: Encrypted tunnels between on-premises network and cloud VPC.
• DDoS protection: AWS Shield, Azure DDoS Protection, GCP Cloud Armor.

Virtual Machine Security

• Use hardened, minimal base images; regularly patch guest OS.
• Disable unnecessary ports and services.
• Use intrusion detection/prevention systems (IDS/IPS) within VMs.
• Enable host-based firewalls.
• Hypervisor security: Keep hypervisor patched; use VM isolation features to prevent VM escape
attacks.

7.4 Software-as-a-Service Security

SaaS security is the most complex because the customer has the least control. Key concerns:
• Data segregation: Ensure tenant data is logically separated in multi-tenant databases.
• Access control: Enforce least-privilege access; use SSO and MFA.
• Data portability: Ability to export data in standard formats — avoid lock-in and ensure data recovery.
• Vendor assessment: Evaluate provider's security certifications (SOC 2, ISO 27001).

7.5 Identity and Access Management (IAM)

IAM is the framework of policies and technologies for managing digital identities and access to
resources. Core principles:

• Least privilege: Grant only the permissions required for a task — nothing more.
• Separation of duties: Split responsibilities so no single user has excessive control.
• MFA (Multi-Factor Authentication): Require multiple verification factors (password +
OTP/biometric) for access.
• Role-based access control (RBAC): Assign permissions to roles, assign roles to users. Simplifies
management.
• Attribute-based access control (ABAC): Access decisions based on attributes (user department,
resource sensitivity, time of day).

AWS IAM Key Concepts

• Users: Individual accounts with long-term credentials.
• Groups: Collections of users sharing the same permissions.
• Roles: Temporary credentials assumed by services or users — preferred for inter-service access.
• Policies: JSON documents defining allowed/denied actions on specific resources.
• MFA enforcement: Require MFA for console login and sensitive API operations.

7.6 Securing Data

Encryption
• Encryption at rest: Data encrypted on storage. AWS S3 SSE (Server-Side Encryption), AES-256.
Protects against physical media theft.
• Encryption in transit: TLS/SSL for all data moving over networks. Prevents eavesdropping.
• Client-side encryption: Data encrypted by customer before uploading — provider cannot read it.
• Key management: AWS KMS (Key Management Service), Azure Key Vault — manages encryption
keys, supports automatic rotation.

Data Backup & Recovery

• 3-2-1 rule: 3 copies of data, on 2 different media, with 1 offsite.
• Automated snapshots and cross-region replication for critical data.
• Test recovery procedures regularly — untested backups are unreliable.

Security Governance
Security governance establishes accountability and decision-making frameworks for cloud security:
• Cloud Security Policy: Defines acceptable use, access control, incident response procedures.
• Compliance frameworks: ISO 27001, SOC 2, GDPR, HIPAA, PCI-DSS.
• Security audits: Regular penetration testing, vulnerability assessments.
• CSPM (Cloud Security Posture Management): Tools that continuously monitor cloud configurations
for misconfigurations and compliance violations.

7.7 Security Standards

• ISO/IEC 27001: International standard for Information Security Management Systems (ISMS).
Provides a systematic approach to managing sensitive information.
• SOC 2: AICPA standard auditing controls for security, availability, processing integrity, confidentiality,
and privacy. Type I (design) and Type II (effectiveness over time).
• CSA STAR: Cloud Security Alliance Security, Trust, Assurance, and Risk registry — cloud-specific
security certification.
• GDPR: EU regulation requiring data protection, breach notification within 72 hours, and right to
erasure for EU citizens' data.
• HIPAA: US standard protecting health information (PHI). Cloud providers acting as business
associates must sign BAAs.
• PCI-DSS: Payment Card Industry standard for organisations storing, processing, or transmitting
cardholder data.
• NIST Cybersecurity Framework: Voluntary framework with five functions: Identify, Protect, Detect,
Respond, Recover.
Quick Revision — Key Formulas & Facts

Topic Formula / Fact

Amdahl's Law S = 1 / ( (1-p) + p/n ) where p = parallel fraction, n = processors

PUE (Data Centre) PUE = Total Facility Power / IT Equipment Power (ideal = 1.0)

AWS S3 Durability 99.999999999% (11 nines)

AWS EC2 SLA Uptime 99.99% monthly (~52 min downtime/year)

MapReduce phases Input Split → Map → Shuffle & Sort → Reduce → Output

Container vs VM size Container: MBs | VM: GBs

NIST Cloud actors Consumer, Provider, Auditor, Broker, Carrier

Service models IaaS = infrastructure | PaaS = platform | SaaS = software

Cloud deployment types Public, Private, Hybrid, Community, Multi-cloud

Type 1 hypervisor Bare-metal — VMware ESXi, Hyper-V, KVM, Xen

Type 2 hypervisor Hosted — VirtualBox, VMware Workstation

Hadoop block size 128 MB default, replicated 3x across DataNodes

IAM Principle Least privilege — grant minimum permissions required

Encryption standards AES-256 at rest | TLS 1.2/1.3 in transit

3-2-1 Backup rule 3 copies, 2 media types, 1 offsite