Cloud Computing
Module 1: Definition of Cloud Computing and its Basics
1. Definition of Cloud Computing
Core Definition
loud computing is a model for enablingubiquitous, convenient, on-demand network
C
accessto a shared pool of configurable computing resources (e.g., networks, servers, storage,
applications, and services) that can berapidly provisioned and releasedwith minimal
management effort or service provider interaction.
hink of it like anelectricity grid. You plug into an outlet and get power without needing to own
T
or manage the power plant. Cloud computing lets you "plug in" and use computing resources
over the internet.
Cloud Models
A. NIST ModelThis is the standard definition model. It defines cloud computing by:
● 5 Essential Characteristics:
○ On-demand self-service:You can get resources (like server time) automatically
without human intervention.
○ Broad network access:Services are available over the network (usually the
internet) via standard clients (laptops, phones).
○ Resource pooling:The provider's resources are pooled to serve many
customers (multi-tenancy). You don't know or care exactly which physical
machine is running your code.
○ Rapid elasticity:You can scale resources up or down quickly (sometimes
automatically) to match demand.
○ Measured service:Resource usage is monitored, controlled, and billed. You pay
for what you use.
● 3 Service Models:(See below)
● 4 Deployment Models:(See below)
B. Cloud Cube ModelThis model helps define a cloud by looking at 4 dimensions:
. Internal/External:Is the cloud hosted within your organization or by a third party?
1
2. Proprietary/Open:Is it built on closed, proprietary technology or open standards?
3. Perimeterised/De-perimeterised:Does it rely on a traditional network boundary
(firewall) or on more advanced, identity-based security?
4. Sourced (Insourced/Outsourced):Is the service managed by your own staff or by a
third party?
1
. Deployment ModelsThis isWHEREthe cloud infrastructure is located andWHOhas
C
access.
● Public Cloud:
○ What:Owned and operated by a third-party provider (e.g., AWS, Google Cloud,
Microsoft Azure). Resources are shared by many organizations (multi-tenant).
○ Pro:High scalability, pay-as-you-go, no hardware maintenance.
○ Con:Less control, potential for data security/sovereignty concerns.
● Private Cloud:
○ What:Infrastructure is operated solely for a single organization. It can be
managed internally or by a third party, and hosted on-premises or off-premises.
○ Pro:High control, security, and privacy.
○ Con:More expensive, limited scalability (to the size of your private hardware),
you are responsible for maintenance.
● Hybrid Cloud:
○ What:A combination of two or more clouds (public, private) that remain separate
entities but are bound together by technology that enables data and application
portability.
○ Pro:Best of both worlds. Use the private cloud for sensitive data (e.g., "cloud
bursting" where an app runs in the private cloud but "bursts" to the public cloud
for extra capacity).
○ Con:Complex to manage.
● Community Cloud:
○ What:Infrastructure is shared by several organizations with common concerns
(e.g., security, compliance, jurisdiction). Like a semi-private cloud for a specific
group (e.g., a group of universities or government agencies).
○ Pro:Lower cost than private, with shared compliance benefits.
○ Con:Less common, requires collaboration between organizations.
2
D. Service ModelsThis isWHATthe cloud provider manages for you. It's a "stack" of services.
● Infrastructure as a Service (IaaS):
○ Concept:The most basic level. The provider gives you virtualized computing
resources:virtual machines, storage, and networking. You manage the OS,
middleware, and applications.
○ Analogy:Renting an empty plot of land. You decide what kind of house (OS) to
build and what to put in it (apps).
○ Examples:Amazon Web Services (AWS) EC2, Google Compute Engine,
Microsoft Azure Virtual Machines.
● Platform as a Service (PaaS):
○ Concept:The provider gives you aplatform to develop, test, and deploy
applications. You don't manage the underlying servers, OS, or storage. You just
manage your application code and data.
○ Analogy:Renting a pre-built house frame and foundation. You just need to do
the interior finishing (code).
○ Examples:Heroku, AWS Elastic Beanstalk, Google App Engine, Netlify.
● Software as a Service (SaaS):
○ Concept:The provider gives you acomplete, ready-to-use applicationthat
you access over the internet (usually via a web browser). The provider manages
everything.
○ Analogy:Renting a fully furnished apartment. You just show up and use it.
○ Examples:Google Workspace (Gmail, Docs), Microsoft 365, Salesforce,
Dropbox.
. Cloud Reference ModelThis is a standard model to describe the different layers and
E
functions of a cloud environment. The main layers are:
. P
1 hysical Layer:The actual hardware (servers, storage disks, network switches).
2. Virtual Layer:The abstraction layer (hypervisors) that creates VMs, virtual storage, etc.
3
3. C ontrol Layer:The "brains" of the cloud. Manages resource allocation, provisioning,
and monitoring.
4. Service Orchestration Layer:Coordinates complex tasks and workflows (e.g.,
auto-scaling an application).
5. Service Layer:The top layer that exposes the services (IaaS, PaaS, SaaS) to the
end-user.
Characteristics & Benefits
● P aradigm Shift:Cloud computing is a shift fromCAPEX (Capital Expenditure)to
OPEX (Operational Expenditure).
○ Old (CAPEX):Buy powerful, expensive servers upfront, hoping you predicted
your needs correctly.
○ New (OPEX):Pay a monthly bill based only on the resources you actually used.
This lowers the financial barrier to entry for startups and allows for rapid
experimentation.
● Benefits & Advantages:
○ Cost Savings:Pay-as-you-go model and no need to buy/maintain hardware.
○ Scalability & Elasticity:Easily scale up for high traffic and scale down to save
money.
○ Flexibility & Agility:Spin up new servers in minutes, not weeks.
○ Reliability:Cloud providers have huge, redundant data centers, offering high
availability and disaster recovery.
○ Global Reach:Deploy your application in data centers around the world with a
few clicks.
4
2. Cloud Architecture: The "How"
A brief look at the components that make a cloud work.
● C omposability:The idea of building complex systems by combining smaller,
independent, interchangeable components (like "services" or "microservices").
● Infrastructure:The core physical and virtual resources (servers, storage, networking,
hypervisors).
● Platforms:The layer above infrastructure that provides the OS, databases, and
development tools (this is the "PaaS" layer).
● Virtual Appliances:Pre-configured virtual machine (VM) images that contain a
ready-to-run software stack (e.g., a "LAMP stack" appliance with Linux, Apache, MySQL,
and PHP already installed).
● Communication Protocols:The "languages" services use to talk to each other (e.g.,
HTTP/HTTPSfor web APIs,AMQPfor message queues).
● Applications:The SaaS-level software that the end-user interacts with.
● Connecting to the Cloud (Clients):How users access the cloud.
○ Thin Clients:Simple, low-power devices (like a web browser or a simple
desktop) that do very little processing. All the heavy lifting is done in the cloud.
○ Thick Clients:Traditional applications (like a desktop app) that do some
processing locally but still connect to the cloud for data.
○ Mobile Clients:Apps on your phone.
3. Services and Applications by Type
A deeper dive into the service models.
IaaS (Infrastructure as a Service)
● B asic Concept:You rent the fundamental building blocks. You have the most control but
also the most responsibility (managing the OS, patches, security).
● Workload:The specific task or amount of processing given to the cloud (e.g., running a
database, transcoding a video).
● Partitioning:A single physical server is "partitioned" into multiple, isolatedVirtual
Private Server (VPS)instances using ahypervisor(like VMware or KVM). This is the
core technology of IaaS.
● Organizational Units:
○ Pods:A group of resources (e.g., servers, storage) managed as a single unit.
○ Aggregations:A logical grouping of pods or other resources, often for a specific
customer or application.
○ Silos:An isolated stack of resources that does not interact with other stacks.
This is generally ananti-patternin the cloud, which favors shared, pooled
resources.
5
PaaS (Platform as a Service)
● B asic Concept:The provider manages the "platform" (hardware, OS, networking,
development tools). You focus only on yourapplication code.
● Tools & Environment:PaaS provides a ready-made environment.
○ Examples:A PaaS for a web developer might automatically include a web
server (like Nginx), a database (like PostgreSQL), and a version control system
(like Git). When yougit pushyour code, the platform automatically builds,
deploys, and runs it.
SaaS (Software as a Service)
● B asic Concept:The provider hosts and manages a complete application. You are just
an end-user.
● Characteristics:
○ Multi-Tenant Architecture:A single instance of the application serves multiple
customers (tenants), with their data securely isolated.
○ Web-Based Access:Accessed via a browser, no installation required.
○ Centralized Updates:The provider rolls out updates, so all users are always on
the latest version.
● Open SaaS and SOA:
○ SOA (Service-Oriented Architecture):A design principle where software is built
as a set of interacting, independent services.
○ Open SaaS:SaaS applications that are built using SOA principles and provide
APIs (Application Programming Interfaces). This allows you to easily integrate
the SaaS product with your other applications (e.g., connecting your Salesforce
(SaaS) account to your Mailchimp (SaaS) account).
Other "as a Service" Models
● IDaaS (Identity as a Service):
○ Concept:A cloud-based service for managing user identities and access. It
handles authentication (who you are) and authorization (what you're allowed to
do).
○ Features:Single Sign-On (SSO), Multi-Factor Authentication (MFA).
○ Examples:Okta, Auth0, Azure Active Directory.
● CaaS (Compliance as a Service):
○ Concept:A cloud-based service that helps organizations meet complex
regulatory and compliance requirements (like HIPAA for healthcare, GDPR for
data privacy, or PCI for credit cards).
○ Features:Provides pre-built controls, auditing tools, and reports to prove
compliance.
6
Module 2: Use of Platforms in Cloud Computing
1. Concepts of Abstraction and Virtualization
Core Concepts
● A bstraction:This is the concept ofhiding the complex detailsof a system and
exposing only the simple, necessary parts.
○ Analogy:When you drive a car, you use a steering wheel and pedals (the
abstraction). You don't need to know how the fuel injection or transmission works
(the complex details).
○ In Cloud:A web dashboard (like the AWS Console) is an abstraction. You click a
button to create a "server," hiding the millions of lines of code and physical
hardware management required to make that happen.
● Virtualization:This is thetechnologythatenablesabstraction. It's the process of
creating a software-based, or "virtual," version of a computing resource, such as a
server, storage device, or network.
○ The core component that creates virtual machines is thehypervisor.
Virtualization Technologies
● Types of Virtualization:
○ Access Virtualization (or Desktop Virtualization):Allows a user to access a
desktop operating system (like Windows 11) that is running remotely in a data
center. The user sees only their screen, but the "computer" is miles away. (e.g.,
VMware Horizon, Amazon WorkSpaces).
○ Application Virtualization:Separates an application from the operating system
it runs on. This allows an app (like Word) to run in an isolated "bubble" without
being fully installed. (e.g., Docker containers, VMware ThinApp).
○ CPU Virtualization:The core technology that allows a single physical CPU to be
shared among multiple virtual machines.
○ Storage Virtualization:Pools multiple physical storage devices (hard drives)
into whatlookslike a single, massive storage device.
● Mobility Patterns (Migration):These terms describe how and where we move
workloads.
○ P2V (Physical-to-Virtual):Moving an application from anold physical server
onto avirtual machinein a data center. This is a common first step in migrating to
the cloud.
○ V2V (Virtual-to-Virtual):Moving a virtual machine from one host (or hypervisor)
to another. (e.g., moving from a VMware host to a Hyper-V host).
○ V2P (Virtual-to-Physical):Rare.Moving a workload from a VMbackonto
dedicated physical hardware, usually for extreme performance or licensing
reasons.
7
○ P 2P (Physical-to-Physical):Migrating from one physical server to another. (This
is a traditional, non-cloud migration).
○ D2C (Datacenter-to-Cloud):The overall strategy of migrating applications from
a private datacenter to a public cloud.
○ C2C (Cloud-to-Cloud):Migrating applications from one cloud provider to
another (e.g., from AWS to Azure).
○ C2D (Cloud-to-Datacenter):Moving an applicationoutof the public cloud and
back to a private datacenter (also called "cloud repatriation").
○ D2D (Datacenter-to-Datacenter):Traditional migration between two private
datacenters.
Load Balancing and Virtualization
● B asic Concepts:Aload balanceracts like a "traffic cop" for your application. It
receives all incoming user requests and distributes them across a pool of identical
backend servers (VMs).
● Why?
○ Availability:If one server crashes, the load balancer stops sending traffic to it,
and the app stays online.
○ Scalability:When traffic is high, you can add more servers to the pool, and the
load balancer will start using them immediately.
● Network Resources:Load balancing can be done by dedicated hardware devices,
routers, or (most commonly in the cloud) as a managed software service.
● Advanced Load Balancing:
○ Application Delivery Controller (ADC):A more advanced "smart" load
balancer. It operates atLayer 7 (Application Layer), meaning it can "read" the
application traffic (like HTTP headers or URLs) and make smarter routing
decisions. It can also handle SSL termination and security.
8
○ A pplication Delivery Network (ADN):Asuiteof services (often including ADCs
and WAN optimization) that work together to make an application fast, secure,
and available for all users.
Example (Google Cloud):Google Cloud Load Balancing is a global, managed service
●
that can distribute traffic to servers in different regions around the world, ensuring the
user is always sent to thenearestandhealthiestdata center.
Hypervisors & Machine Imaging
● Hypervisor:The software layer that creates and runs virtual machines.
○ Type 1 (Bare-Metal):Runsdirectlyon the physical hardware. Itisthe operating
system. This is what public clouds use for high performance.
■ Examples:VMware vSphere (ESXi), Microsoft Hyper-V, KVM.
○ Type 2 (Hosted):Runsas an applicationinside a normal OS (like Windows 10 or
macOS). Good for testing and development.
■ Examples:VirtualBox, VMware Workstation.
● M achine Imaging:A"snapshot" or "blueprint"of a fully configured virtual machine.
This image contains the OS, all installed applications, and any patches or configurations.
It is used to quickly deploy new, identical copies of a server.
● OVF (Open Virtualization Format):A vendor-neutral, standard file format for packaging
and distributing VM images. An OVF file allows you to easily move a VM from one
hypervisor (like VMware) to another (like VirtualBox).
9
Porting of Applications in the Cloud
● T he Simple Cloud API:Refers to the Application Programming Interfaces (APIs) that
cloud providers like AWS offer. These APIs let you programmatically create, delete, and
manage your infrastructure. While powerful, relyingonlyon one provider's API can lead
tovendor lock-in.
● AppZero Virtual Application Appliance:An older tool that solved a specific migration
problem. It would "encapsulate" a legacy Windows application (like one running on
Windows Server 2003) and all its dependencies into a package. This package could
then be moved to a modern server (like Windows Server 2016) in the cloudwithout
needing to re-install or re-write the old app.
2. Concepts of Platform as a Service (PaaS)
● D efinition of Services:PaaS provides aplatform(hardware, OS, database, web
server, development tools) as a managed service. The developer is only responsible for
theirapplication codeanddata. The PaaS provider handles all the underlying
infrastructure management.
● Distinction between SaaS and PaaS:This is a classic exam question.
○ SaaS (Software as a Service):Youusea finished application. (e.g.,
[Link]- the CRM application you log into and use).
○ PaaS (Platform as a Service):Youbuildyour own application. (e.g.,[Link]
- the developer platform used to buildnewcustom apps that run on Salesforce's
infrastructure).
● Application Development:PaaS is designed for developers. It streamlines
development by providing:
○ Managed databases (e.g., PostgreSQL, MySQL).
○ Automatic scaling.
○ Simple deployment, often via git push .
● PaaS Application Frameworks:PaaS environments are often optimized for specific
programming languages or frameworks (e.g., Heroku for Ruby/[Link], Google App
Engine for Python/Go, Netlify for JAMstack).
3. Use of Google Web Services (Google Cloud Platform)
● Google Applications Portfolio:
○ Indexed Search:Google's core search engine.
○ Dark Web:In this context, this likely refers to the "Deep Web"—the massive
amount of data Google has that isnotpublicly indexed (e.g., your private Gmail
data, Google Docs, etc.), not the "Dark Web" (Tor network).
10
○ A ggregation:Collecting and organizing information from many sources (e.g.,
Google News, Google Flights).
○ Disintermediation:Removing the "middleman." (e.g., Google Flights lets you
book directly, bypassing traditional travel agents).
○ Productivity Applications:Google Workspace (Gmail, Docs, Sheets, Drive).
○ Adwords, Google Analytics, Google Translate:Key business and user
services.
● Google Toolkit (APIs):A collection of APIs (Application Programming Interfaces) that
let developers build Google's services into their own apps (e.g., using the Google Maps
API on a company's website).
Google App Engine (GAE):Google's originalPaaSoffering.
●
○ Major Features:Fully managed, serverless (scales to zero), pay-per-use,
supports multiple languages (Python, Go, Java, [Link]), and has built-in
services like databases and caching.
4. Use of Amazon Web Services (AWS)
● AWS Components and Services (The Core 4):
○ Amazon EC2 (Elastic Compute Cloud):This is the primaryIaaSservice. It
provides resizablevirtual servers(VMs) in the cloud. You have full control over
the OS.
○ Amazon S3 (Simple Storage System):This isobject storage. It's used for
storing files (images, videos, backups, documents). It's infinitely scalable and
highly durable.
○ Amazon EBS (Elastic Block Store):This isblock storage. Think of it as a
virtual hard drivethat you attach to your EC2 instance. The EC2 instance's
operating system runs on an EBS volume.
○ Amazon SimpleDB:Anolder, flexibleNoSQL database. It was simple but has
been largely replaced byAmazon DynamoDB.
○ Amazon RDS (Relational Database Service):This is aPaaSservice. It's a
managedrelational database. You choose an engine (like MySQL, PostgreSQL,
or SQL Server), and AWS handles the patching, backups, and maintenance.
11
5. Use of Microsoft Cloud Services (Azure)
● Windows Azure Platform:(Now simply calledMicrosoft Azure).
○ Approach/Architecture:Microsoft's vision is a "Cloud OS" that seamlessly
extends a company's private datacenter into the public cloud (a strong focus on
hybrid cloud).
○ Main Elements:
■ Compute:(e.g., Azure Virtual Machines, Azure App Service).
■ Storage:(e.g., Azure Blob Storage, Azure Disk Storage).
■ Networking:(e.g., Azure Virtual Network).
● Windows Azure AppFabric:Anoldermiddleware service. Its components have been
integrated into modern Azure services.
○ Service Bus:NowAzure Service Bus(a message queue system).
○ Access Control:Now part ofAzure Active Directory (Azure AD).
● Content Delivery Network (CDN):A service that caches your application's content (like
images and videos) in "edge locations" (data centers) all over the world. This makes
your site load much faster for global users.
● SQL Azure:(Now calledAzure SQL Database). Microsoft'sPaaSmanaged relational
database service. It is the Azure equivalent of AWS RDS.
● Windows Live Services:Anoldersuite of consumer-facing services (like Hotmail,
Messenger). These have been retired or evolved into modern Microsoft consumer
services (like [Link], Skype, and OneDrive).
12
Module 3: Cloud Infrastructure
Types of Services Required in Implementation
hen an organization decides to move to the cloud, they don't just "buy cloud." They typically
W
engage with a provider or partner for a range of professional services:
● C onsulting:This is the"what" and "why"phase. Experts (consultants) analyze the
business's needs, assess their current IT-Setup, and create a high-level cloud strategy.
○ Examples:Recommending a public vs. hybrid model, performing a Total Cost of
Ownership (TCO) analysis, creating a migration roadmap, and identifying which
applications to move first.
● Configuration:This is the"setup"phase. It involves the technical, hands-on work of
setting up the new cloud environment according to the plan.
○ Examples:Setting up the virtual private cloud (VPC), configuring network routes
and firewalls, creating user accounts and permissions (IAM), and installing the
base operating systems on VMs.
● Customization:This is the"tuning"phase. It involves modifying cloud services or
building new components to fit the company'sspecificbusiness logic, which isn't
available "out of the box."
○ Examples:Writing scripts to automate a complex deployment (Infrastructure as
Code), integrating the cloud's identity system with the company's on-premise
Active Directory, or building a custom dashboard to monitor a specific business
process.
● Support:This is the"day-to-day"phase, after the setup is complete. It involves
ongoing help to keep the system running smoothly.
○ Examples:24/7 helpdesk for when things break, performance monitoring and
optimization, applying security patches, and managing backups.
1. Cloud Management
his is the set of tools and processes used to manage all cloud resources, including
T
performance, cost, and security.
Network Management Systems
● O verview:These are tools that help administrators manage, monitor, and secure the
cloud's virtual network. In the cloud, the "network" is software-defined.
● Key Features:
○ Logical Isolation:Creating private, isolated network segments (like a VPC).
○ Firewall Control:Defining rules for what traffic can enter or leave the network
(Security Groups, ACLs).
13
○ R outing:Directing traffic between subnets, to the internet, or back to an
on-premise data center.
○ Load Balancing:Distributing traffic across multiple servers.
Vendor Products:
●
○ AWS:Amazon Virtual Private Cloud (VPC)
○ Azure:Azure Virtual Network (VNet)
○ Google Cloud:Virtual Private Cloud (VPC)
Monitoring of an Entire Cloud Computing Deployment Stack
● O verview:You can't just monitor if a server is "on."Full-stack monitoringmeans
watching every layer of the deployment, from the underlying infrastructure up to the
application's user experience.
● Layers to Monitor:
○ Infrastructure:Is the VM CPU high? Is the disk full? (Metrics)
○ Application:Is the application code throwing errors? (Logs)
○ User Experience:Is the website slow for users in Japan? (Real-User Monitoring)
● Vendor Products:
○ AWS:Amazon CloudWatch
○ Azure:Azure Monitor
○ Google Cloud:Google Cloud Operations (formerly Stackdriver)
○ Third-Party:Datadog, New Relic
Lifecycle Management of Cloud Services
This is the six-stage process of managing a cloud service from its idea to its retirement.
1. S ervice Strategy:Define thevision and goals. (e.g., "We need a new service to
reduce customer wait times.")
2. Service Design:Create theblueprint. (e.g., "It will be a hybrid cloud app using AWS for
compute and our private cloud for the database. Here is the architecture diagram.")
3. Service Transition:Build, test, and deploythe service. This is the migration and
"go-live" phase.
4. Service Operation:Run and maintainthe live service. This includes daily tasks like
monitoring, incident response, and user support.
5. Service Improvement:Iterate and optimize. Analyze performance metrics and user
feedback to make the service faster, cheaper, or more reliable.
6. Service Retirement:Decommissionthe service when it's no longer needed. This
involves archiving data, deleting resources (to stop paying for them), and updating
documentation.
Strategy → Design →Transition → Operation → Improvement → Retirement
14
2. Concepts of Cloud Security
Cloud Security Concerns
The primary concerns are different from on-premise security. They include:
● M isconfiguration:The#1 risk. Accidentally leaving a storage bucket public or a
database open to the internet.
● Insecure APIs:Weak or unprotected APIs that allow attackers to control cloud
resources.
● Data Breaches:Unauthorized access to or theft of sensitive data.
● Identity & Access Issues:Poorly managed user permissions, allowing a user to access
more than they should (failure of "least privilege").
● Shared Tenancy Risks:The (very small) risk that another customer on the same
physical hardware could "break out" of their virtual machine and access yours.
Security Boundary vs. Security Service Boundary
● S ecurity Boundary:Alogical perimeteryou draw around a group of resources (like a
VPC, or a specific application). You declare that everythinginsidethis boundary is
trusted and must be protected from everythingoutsideof it.
● Security Service Boundary:This defines theShared Responsibility Modelfor a
specific service. It's the line that separatesyoursecurity responsibilities from thecloud
provider's.
○ Example (IaaS):For an EC2 virtual machine, the provider's responsibilitystops
at the hypervisor. You are responsible for everythinginsidethe VM: the OS,
patching, firewalls, and your data. The "service boundary" is the VM itself.
○ Example (SaaS):For Gmail, the provider manages almost everything. Your
responsibility is just to manage your user accounts and not fall for phishing. The
"service boundary" is the login page.
Security of Data
● B rokered Cloud Storage Access:A pattern where you don't let users access storage
(like an S3 bucket) directly. Instead, they go through an intermediary application or
service (the "broker"). This broker enforces security rules, logs all access, and can even
encrypt/decrypt data.
○ ACloud Access Security Broker (CASB)is a common tool for this.
● Storage Location and Tenancy:
○ Location (Data Sovereignty):Where is your data physically located? For
legal/compliance reasons (like GDPR), you may be required to keep data within
a specific country.
○ Tenancy:Who is on the same hardware as you? In amulti-tenant(public cloud)
environment, you share hardware. In asingle-tenant(private cloud or
"Dedicated Host") environment, the hardware is all yours.
15
● Encryption:
○ At Rest:Encrypting data that is sitting on a hard drive (e.g., encrypting an S3
bucket or a database).
○ In Transit:Encrypting data as it moves over the network (e.g., usingTLS/SSL,
which is what HTTPS does).
● Auditing and Compliance:The ability to track and prove that you are following security
rules. This relies on detailedlogsthat showwhoaccessedwhatdata andwhen(e.g.,
using AWS CloudTrail).
Identity Management
● C oncept:Also known asIdentity and Access Management (IAM). This is the
framework that controlswho(identity) can dowhat(access). It is the "master control
panel" for all permissions.
● Identity Protocol Standards:These are the open standards that let different systems
securely share identity information (i.e., they enableSingle Sign-On - SSO).
○ SAML (Security Assertion Markup Language):The "older" standard,
XML-based. Primarily used for enterprise web applications (e.g., logging into
Salesforce with your company Google account).
○ OAuth 2.0 (Open Authorization):This is forauthorization(granting
permissions), not authentication. It's the standard that lets an application "act on
your behalf" (e.g., when a website asks for permission to "view your Google
contacts" or "post to your Twitter feed").
○ OIDC (OpenID Connect):This is the "modern" standard forauthentication
(proving who you are). It is a layer builton topof OAuth 2.0. It's widely used by
mobile and modern web apps (e.g., "Log in with Google" or "Log in with
Facebook").
16
Module 4: Concepts of Services and Applications
1. Service Oriented Architecture (SOA)
OA is a software design approach where applications are built by combining loosely coupled,
S
independent, and interoperable "services." These services communicate with each other over a
network.
● M essage-Based Transactions:In SOA, services are not tightly linked. They
communicate by sending messages (typically XML-based).
○ This isasynchronousandloosely coupled. Service A sends a message (e.g.,
"Check inventory for product X") and doesn't have to "wait" for an immediate
reply. It can do other work. Service B will process the message and send anew
message back (e.g., "Inventory for X is 100").
○ This makes the system resilient. If Service B is down, Service A isn't stuck; the
message can just wait in a queue.
● Protocol Stack for an SOA Architecture:This refers to the classic "Web Services"
(WS-*) stack:
○ SOAP (Simple Object Access Protocol):The protocol that defines theformat
of the XML message. It's the "envelope" for the message.
○ WSDL (Web Services Description Language):An XML file that acts as the
"instruction manual" for a service. It describeswhatthe service does,what
messages it accepts, andhowto call it.
○ UDDI (Universal Description, Discovery, and Integration):A "yellow pages" or
directory where services were published. Other applications could search UDDI
to find services they needed. (Largely replaced by modern API gateways).
17
● E
vent-Driven SOA:A more dynamic version of SOA where services don't call each
other directly. Instead, they react toevents.
○ Example:When a customer places an order, the "Order Service" doesn't call the
"Shipping Service." It just publishes an "OrderPlaced" event.
○ The "Shipping Service" (and any other interested service, like "Inventory") is
subscribedto this event and reacts accordingly. This is highly decoupled.
● E nterprise Service Bus (ESB):A central piece of middleware (a "bus") that manages
all communication between services. Instead of services talking directly to each other (a
"spider web"), they all send messages to the ESB. The ESB handles:
○ Routing:Sending the message to the correct destination.
○ Transformation:Converting data from one format (e.g., XML) to another (e.g.,
JSON).
○ Orchestration:Managing a complex, multi-step business process (e.g., a new
user signup that requires creating an account, sending an email, and updating
the CRM).
● Service Catalogs:A simple directory or portal that lists all the available services in an
organization. It provides documentation, explains what each service does, and tells
developers how to use it.
2. Applications in the Cloud
● C loud Transactions:Traditional transactions (like in a single database) areACID
(Atomic, Consistent, Isolated, Durable). In the cloud, transactions are oftendistributed
across many microservices.
○ This leads to a new model:BASE(Basically Available, Soft state, Eventually
consistent).
○ Eventually Consistentis the key idea: The system might be briefly inconsistent
(e.g., User A sees the old data, User B sees the new), but it willeventually
resolve and become consistent for everyone.
● Functionality Mapping:The process of decidingwhichcloud service model (IaaS,
PaaS, SaaS) is the best fit for eachfunctionof your application.
○ Example:For a new e-commerce app, you mightmapthe...
18
F
■ rontend:to a PaaS (like Netlify or AWS Elastic Beanstalk).
■ Product Database:to a managed database service (PaaS, like AWS
RDS).
■ Payment Processing:to a third-party SaaS (like Stripe).
■ Custom Logging Service:to a VM on IaaS (like AWS EC2).
● Application Attributes:The qualities a well-designedcloud-nativeapplication should
have.
○ Scalability & Elasticity:Can scale horizontally (add more machines) to handle
load.
○ Resiliency:Designed to expect and handle failure (e.g., if one VM crashes, the
app continues to run).
○ Observability:Emits logs and metrics so you can easily monitor its health and
performance.
● Cloud Service Attributes:The 5 essential characteristics of cloud services (from the
NIST model):
○ On-demand self-service
○ Broad network access
○ Resource pooling
○ Rapid elasticity
○ Measured service
● System Abstraction and Cloud Bursting:
○ System Abstraction:This is the core value of the cloud. The cloud provider
abstractsthe complex physical hardware (servers, disks, networks) into simple,
API-callable services.
○ Cloud Bursting:Ahybrid cloudmodel.
■ An application runs day-to-day in aprivate cloud(on-premise).
■ When it experiences a sudden "burst" in traffic (e.g., a Black Friday sale),
it automatically provisionsadditionalresources from apublic cloud(like
AWS or Azure) to handle the extra load.
■ When the burst is over, the public cloud resources are shut down.
■ Benefit:You get the security/control of a private cloud with the "infinite"
scalability of a public cloud.
● Applications and Cloud APIs:Modern cloud applications areAPI-first.
○ TheAPI (Application Programming Interface)is the "front door" to a service.
The mobile app, the website, and other services all interact with the application
by "calling" its API.
○ All cloud services (EC2, S3, etc.) are themselves controlled by APIs.
19
3. Cloud-based Storage
● C loud Storage Definition:A service model where data is stored, managed, and backed
up remotely (in the cloud) and made available to users over a network (usually the
internet).
○ Examples:AWS S3 (Object), AWS EBS (Block), AWS EFS (File), Google Cloud
Storage, Dropbox.
● Manned and Unmanned Storage:These are slightly older terms describing the level of
management.
○ Manned Storage:Refers to traditional, on-premise storage that requires active,
"hands-on" human management. Administrators are responsible for managing
physical disks, provisioning space, configuring RAID, and changing backup
tapes.
○ Unmanned Storage:This is the cloud storage model (e.g., AWS S3). It is fully
automated and abstracted. The user just "puts" and "gets" data via an API. All
the underlying complexity (redundancy, scaling, hardware replacement) is
handled by the provider's software. From the user's perspective, it requires no
human management.
4. Webmail Services
● C loud Mail Services:These are the most common and recognizable examples ofSaaS
(Software as a Service).
○ The user accesses the service through a web browser or mobile app.
○ The provider manages everything: the mail servers, massive storage, spam
filtering, security, and the user interface.
○ Examples:Google Gmail, Mail2Web (a service to access other POP3/IMAP
accounts via the web), Windows Live Hotmail (now [Link]), Yahoo Mail.
● Concepts of Syndication Services:
○ Syndicationis the process of making your content (e.g., blog posts, news
articles) available for other sites or applications to read and republish.
○ The technology that enables this is typicallyRSS (Really Simple Syndication)
orAtom.
○ A website provides an "RSS feed," which is a special XML file containing its
latest content. Users can use an "RSS Reader" to subscribe to feeds from
hundreds of sites and read all their news in one consolidated place.
20