Intermediate concepts in Cloud Platforms
CapEx vs. OpEx: The Cloud's Financial Shift
Cloud computing shifts IT spending from buying assets upfront (CapEx) to paying for services as you use them (OpEx). Think buying a car vs. hailing a ride. This model lets you scale on demand, but the biggest mistake is assuming it's always cheaper.
Cloud Scalability vs. Elasticity: Planned Growth vs. Real-Time Reaction
Think of scalability as adding lanes to a highway for long-term growth. Elasticity is opening a reversible lane only during rush hour. Scalability handles predictable demand, like a product launch; elasticity manages unpredictable spikes, like a viral post.
High Availability: Designing Systems That Don't Go Down
High Availability (HA) means designing systems to survive failures by having redundant components ready to take over instantly. It's essential for services like payment gateways where downtime costs money and user trust.
Cloud Regions and AZs: Infrastructure Built for Failure
Think of a cloud region as a city and its availability zones (AZs) as independent power grids. If one AZ fails, your app runs in another. The footgun is deploying to a single AZ; this provides no protection against data center-level outages.
The Cloud's Shared Responsibility Model
Using the cloud means you share security duties with the provider. The split depends on the service: in IaaS, you manage the OS and up; in PaaS, just your app and data; in SaaS, mostly your data and users.
Cloud Load Balancer: Your App's Traffic Cop
A cloud load balancer is a traffic cop for your servers, distributing requests across a pool of machines to prevent overload. It's essential for scaling apps and ensuring high availability.
Auto Scaling Groups: Elasticity and Self-Healing
An Auto Scaling Group (ASG) is like a thermostat for your servers, automatically adding or removing instances to match demand and replacing any that fail. Use it for web apps with variable traffic or services that need to self-heal from instance failures.
AWS Reserved Instances: Commit to Compute, Save Big
Reserved Instances are like leasing a car instead of renting daily: commit to 1-3 years of compute for a steep discount. They're ideal for predictable, steady-state workloads. The footgun is buying inflexible Standard RIs when your needs might change.
User Data Scripts: Day-One Instance Configuration
User data scripts are your instance's "Day One" instructions, automatically running commands like package installs on first boot. Use it to set up a web server or install agents without manual SSH.
Data Durability vs. Availability: Lost vs. Unreachable
Availability is "can I reach my data right now?" while durability is "will my data still exist tomorrow?". Cloud storage systems are designed for both, but they solve different problems: network outages vs. data corruption.
Cloud Storage Tiers: Match Cost to Access Frequency
Storage tiers match data cost to access frequency. 'Hot' tiers are fast and expensive for active files; 'cold' tiers are cheap for archives. Use for data that cools over time, like logs. The footgun: retrieving cold data unexpectedly is slow and costly.
Block Storage Snapshots Are Incremental Backups
A snapshot is an incremental, point-in-time backup of a disk volume, saving only changed data blocks. Use it for disaster recovery to restore a volume's exact state. The footgun: deleting an older snapshot may not save money if a newer one needs its data.
Cross-Region Replication (CRR): Geographic Data Copying
Cross-Region Replication automatically copies data to another geographic region, like a live backup. Use it for disaster recovery, lower latency for global users, or compliance. The footgun: it only copies *new* objects, not what's already in the bucket.
Encryption at Rest: Securing Your Data When It's Not Moving
Encryption at rest is like locking your data in a safe when it's not moving. It protects raw files on disk if storage is stolen, a default on platforms like Google Cloud. The footgun: it doesn't stop a compromised app with valid keys from reading.
Managed Cloud DNS: Offload Your DNS Server Management
Managed Cloud DNS is DNS-as-a-service, letting you publish records without managing servers. Use it for public domains or private name resolution in your VPCs.
NAT Gateway: Your VPC's Outbound-Only Internet Door
A NAT Gateway is a one-way door for your private cloud resources. It lets instances in private subnets initiate outbound traffic to the internet—like for updates or API calls—but blocks unsolicited inbound connections.
Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.
VPC Peering: Connect Private Networks Securely
VPC peering connects two virtual networks as if they were one, letting them talk over private IPs. Use it to share files or access resources between VPCs across accounts or regions without going over the public internet.
Load Balancer Health Checks: Don't Route to Dead Servers
A load balancer uses health checks to ask backend servers "Are you alive?" before sending them traffic. This is essential for any high-availability setup, preventing users from being routed to a crashed or unresponsive instance.
Service Principal: Your App's Identity
A service principal is an application's identity in a specific security context, like a "robot user." It's the local instance that gets permissions, separate from the app's global blueprint. This is how CI/CD pipelines authenticate to cloud APIs.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles