Intermediate everything in DevOps & Cloud, page 24
Managed Document Databases: Your Data, Their Ops
A managed document database is like a fully-staffed warehouse for your data. You store JSON-like objects, and the provider handles security, maintenance, and scaling. It's the default for cloud apps, but the convenience isn't free—watch for surprise bills.
Managed Key-Value Databases: Scaling Without Server Chores
A managed key-value database is like an outsourced dictionary. You give it a key, it returns a value, and the cloud provider handles all scaling and server management. It's used for session stores or user profiles where you need fast lookups by a known ID.
Database Multi-AZ: High Availability vs. Read Scaling
Multi-AZ deployment is like a hot spare database in another datacenter for automatic failover. It's for critical systems where downtime is costly. The footgun is assuming all standbys serve reads; only the 'cluster' type does, not the 'instance' type.
DDoS Mitigation: Surviving Traffic Floods
DDoS mitigation acts like a smart bouncer, learning your app's normal traffic to block malicious floods. It's used for any public internet endpoint, filtering attacks at the network and transport layers (L3/L4).
Identity Federation: One Login for Many Services
Identity federation lets one trusted system vouch for a user's identity to many apps, like using a driver's license at multiple venues. This powers "Sign in with Google" and corporate SSO, but don't confuse it with simple user directory syncing.
Cloud Audit Trail: The 'Who Did What' Record
Think of a cloud audit trail as security camera footage for your infrastructure, recording who did what, where, and when. It's essential for investigating security incidents, proving compliance, and debugging operational issues.
Single Sign-On (SSO): One Login, Many Apps
Single Sign-On (SSO) lets you log in once to access multiple apps. Instead of juggling passwords for Slack and Jira, you authenticate with one central service. This simplifies corporate IT access management.
Web Application Firewall (WAF): Your App's HTTP Bodyguard
A Web Application Firewall (WAF) is a specialized bodyguard for your web app, inspecting all HTTP traffic for malicious requests. It blocks common attacks like SQL injection and XSS by matching traffic against known patterns.
Key Management Service (KMS): Don't Roll Your Own Crypto
A KMS is a secure vault for your cryptographic keys. Instead of storing secrets in code or config, you ask the KMS to perform cryptographic operations for you. It's used for encrypting database fields, signing data, and managing secrets for microservices.
Service Principal: Your App's Identity
A service principal is an application's identity in a specific security context, like a "robot user." It's the local instance that gets permissions, separate from the app's global blueprint. This is how CI/CD pipelines authenticate to cloud APIs.
Load Balancer Health Checks: Don't Route to Dead Servers
A load balancer uses health checks to ask backend servers "Are you alive?" before sending them traffic. This is essential for any high-availability setup, preventing users from being routed to a crashed or unresponsive instance.
VPC Peering: Connect Private Networks Securely
VPC peering connects two virtual networks as if they were one, letting them talk over private IPs. Use it to share files or access resources between VPCs across accounts or regions without going over the public internet.
Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.
NAT Gateway: Your VPC's Outbound-Only Internet Door
A NAT Gateway is a one-way door for your private cloud resources. It lets instances in private subnets initiate outbound traffic to the internet—like for updates or API calls—but blocks unsolicited inbound connections.
Managed Cloud DNS: Offload Your DNS Server Management
Managed Cloud DNS is DNS-as-a-service, letting you publish records without managing servers. Use it for public domains or private name resolution in your VPCs.
Encryption at Rest: Securing Your Data When It's Not Moving
Encryption at rest is like locking your data in a safe when it's not moving. It protects raw files on disk if storage is stolen, a default on platforms like Google Cloud. The footgun: it doesn't stop a compromised app with valid keys from reading.
Cross-Region Replication (CRR): Geographic Data Copying
Cross-Region Replication automatically copies data to another geographic region, like a live backup. Use it for disaster recovery, lower latency for global users, or compliance. The footgun: it only copies *new* objects, not what's already in the bucket.
Block Storage Snapshots Are Incremental Backups
A snapshot is an incremental, point-in-time backup of a disk volume, saving only changed data blocks. Use it for disaster recovery to restore a volume's exact state. The footgun: deleting an older snapshot may not save money if a newer one needs its data.
Cloud Storage Tiers: Match Cost to Access Frequency
Storage tiers match data cost to access frequency. 'Hot' tiers are fast and expensive for active files; 'cold' tiers are cheap for archives. Use for data that cools over time, like logs. The footgun: retrieving cold data unexpectedly is slow and costly.
Data Durability vs. Availability: Lost vs. Unreachable
Availability is "can I reach my data right now?" while durability is "will my data still exist tomorrow?". Cloud storage systems are designed for both, but they solve different problems: network outages vs. data corruption.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles