Intermediate concepts in Cloud Platforms, page 2
Key Management Service (KMS): Don't Roll Your Own Crypto
A KMS is a secure vault for your cryptographic keys. Instead of storing secrets in code or config, you ask the KMS to perform cryptographic operations for you. It's used for encrypting database fields, signing data, and managing secrets for microservices.
Web Application Firewall (WAF): Your App's HTTP Bodyguard
A Web Application Firewall (WAF) is a specialized bodyguard for your web app, inspecting all HTTP traffic for malicious requests. It blocks common attacks like SQL injection and XSS by matching traffic against known patterns.
Single Sign-On (SSO): One Login, Many Apps
Single Sign-On (SSO) lets you log in once to access multiple apps. Instead of juggling passwords for Slack and Jira, you authenticate with one central service. This simplifies corporate IT access management.
Cloud Audit Trail: The 'Who Did What' Record
Think of a cloud audit trail as security camera footage for your infrastructure, recording who did what, where, and when. It's essential for investigating security incidents, proving compliance, and debugging operational issues.
Identity Federation: One Login for Many Services
Identity federation lets one trusted system vouch for a user's identity to many apps, like using a driver's license at multiple venues. This powers "Sign in with Google" and corporate SSO, but don't confuse it with simple user directory syncing.
DDoS Mitigation: Surviving Traffic Floods
DDoS mitigation acts like a smart bouncer, learning your app's normal traffic to block malicious floods. It's used for any public internet endpoint, filtering attacks at the network and transport layers (L3/L4).
Database Multi-AZ: High Availability vs. Read Scaling
Multi-AZ deployment is like a hot spare database in another datacenter for automatic failover. It's for critical systems where downtime is costly. The footgun is assuming all standbys serve reads; only the 'cluster' type does, not the 'instance' type.
Managed Key-Value Databases: Scaling Without Server Chores
A managed key-value database is like an outsourced dictionary. You give it a key, it returns a value, and the cloud provider handles all scaling and server management. It's used for session stores or user profiles where you need fast lookups by a known ID.
Managed Document Databases: Your Data, Their Ops
A managed document database is like a fully-staffed warehouse for your data. You store JSON-like objects, and the provider handles security, maintenance, and scaling. It's the default for cloud apps, but the convenience isn't free—watch for surprise bills.
Managed In-Memory Data Store: Speed Without the Sysadmin
A managed in-memory store is a high-speed valet for your data, sitting between your app and database to serve requests at microsecond latency. Use it for database acceleration or session stores. The footgun is treating it as a permanent database.
The Twelve-Factor App: A Blueprint for Portable Cloud Apps
The Twelve-Factor App is a blueprint for building portable, resilient cloud apps. It's used for microservices or apps on platforms like Kubernetes, ensuring they can be easily deployed and scaled. The footgun is treating it as dogma, not a guide.
AWS CodePipeline: Your CI/CD Orchestrator
AWS CodePipeline is an orchestrator for your software release workflow, connecting source, build, and deploy stages. It's used to automate continuous delivery, triggering actions on every code change. The footgun: it only *manages* the pipeline.
AWS CodeBuild: Managed Builds Without the Servers
Think of AWS CodeBuild as an on-demand build server you don't manage. It's used in CI/CD to compile code, run tests, and create artifacts. The main footgun is thinking it's a full CI/CD platform; it's just the 'build' step, needing an orchestrator.
AWS CodeDeploy: Automated, Safe Application Updates
AWS CodeDeploy automates pushing your application to servers, Lambda, or ECS. It handles complex updates across many targets, letting you release new features rapidly while minimizing downtime.
Rolling Updates: Deploying Code Without Downtime
A rolling update deploys new code by gradually replacing old application instances with new ones, ensuring zero downtime. It's the default for stateless services in orchestrators like Kubernetes.
Promoting Code with Pipeline Stages
Think of pipeline stages as quality gates. Code must pass one gate, like 'build', before being promoted to the next, like 'deploy to staging'. This is core to CI/CD, moving code safely from dev to production. The footgun is making later stages less strict.
Kubernetes Control Plane: The Cluster's Brain
The Kubernetes control plane is the cluster's brain, making all global decisions like scheduling pods and responding to events. You interact with it via kubectl to manage your applications. The footgun: never run your own workloads on control plane nodes.
Kubernetes Node: The Cluster's Worker Machine
A Kubernetes Node is a worker machine that runs your applications. Think of it as an employee receiving tasks (Pods) from the control plane manager. The common footgun is confusing the Node with the Pod; a Node is the server, while a Pod is the.
Persistent Volume and Persistent Volume Claim
Kubernetes separates storage provisioning from consumption. A PersistentVolume is a cluster storage resource an admin or driver provisions; a PersistentVolumeClaim is a pod's request for storage.
Kubernetes StatefulSet: Pods with Stable Identity
A StatefulSet gives Kubernetes pods a stable identity and dedicated storage, like assigning a permanent desk and locker to an employee. Use it for databases or clustered apps where nodes need to find each other and retain data across restarts.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles