Cloud Computing Quick Reference

Service Models

• IaaS (Infrastructure as a Service): provider manages hardware/virtualization; customer manages OS, runtime, and app — e.g. AWS EC2, Azure VMs
• PaaS (Platform as a Service): provider also manages OS and runtime; customer manages just app code and data — e.g. AWS Elastic Beanstalk, Heroku
• SaaS (Software as a Service): provider manages the entire application; customer only uses it — e.g. Gmail, Salesforce
• FaaS (Function as a Service / serverless): provider manages everything except the function code and its trigger — e.g. AWS Lambda

Deployment Models

• Public cloud: shared infrastructure owned by a third-party provider, accessible over the internet
• Private cloud: dedicated infrastructure used by a single organization, on-prem or hosted
• Hybrid cloud: a combination of public and private cloud with orchestration between them
• Multi-cloud: using more than one public cloud provider simultaneously, often for redundancy or best-of-breed services

The Shared Responsibility Model

• Provider responsibility: physical data centers, host hardware, network infrastructure, the virtualization/hypervisor layer
• Customer responsibility: data, identity and access management, encryption configuration, OS and application patching (varies by service model), network configuration
• The customer's share of responsibility shrinks as you move from IaaS to PaaS to SaaS

The 6 Rs of Cloud Migration

• Retire: decommission the application entirely because it is no longer needed
• Retain: keep the application as-is on-premises for now (not migrated)
• Rehost ('lift and shift'): move the application to the cloud with minimal changes
• Replatform ('lift, tinker, and shift'): make small optimizations during the move, e.g. swapping to a managed database
• Repurchase: replace the application with a SaaS alternative
• Refactor / re-architect: redesign the application to be cloud-native, e.g. breaking a monolith into microservices

RPO vs RTO

• RPO (Recovery Point Objective): maximum acceptable amount of data loss, measured as a time window — drives backup/replication frequency
• RTO (Recovery Time Objective): maximum acceptable downtime before service is restored — drives failover strategy and standby readiness
• Near-zero RPO/RTO typically requires active-active multi-region architecture; looser targets can use backups plus pilot-light or warm-standby recovery

Storage Types

• Object storage: stores data as objects with metadata in a flat namespace, accessed via API — ideal for unstructured data like images, backups, and static assets (e.g. Amazon S3)
• Block storage: raw storage volumes attached to a single instance, addressed in fixed-size blocks — ideal for databases and OS boot volumes (e.g. AWS EBS)
• File storage: a shared, hierarchical file system accessible by multiple instances concurrently — ideal for shared application data (e.g. AWS EFS)

Compute Scaling

• Vertical scaling (scale up): increase CPU/RAM/disk on an existing instance; simple but has a hardware ceiling and often needs downtime
• Horizontal scaling (scale out): add more instances behind a load balancer; effectively unlimited and improves fault tolerance
• Auto-scaling: automatically adjusts instance count based on metrics like CPU utilization or request count

Database Choices

• SQL (relational): fixed schema, strong ACID transactions, scales primarily via read replicas or vertical scaling — best for structured, relational data
• NoSQL (key-value, document, wide-column, graph): flexible schema, scales horizontally, often trades strict consistency for throughput — best for high-velocity or semi-structured data
• Managed database services (e.g. AWS RDS, DynamoDB) offload patching, backups, and failover to the provider

Core Security Terms

• IAM (Identity and Access Management): controls who (identity) can do what (permissions) on which resources
• Principle of least privilege: grant only the minimum permissions needed to perform a task
• Encryption at rest: data encrypted while stored on disk
• Encryption in transit: data encrypted while moving across a network, typically via TLS
• VPC (Virtual Private Cloud): an isolated, logically separated network within a public cloud provider

• Service models (IaaS/PaaS/SaaS/FaaS) differ by how much the provider manages for you
• The shared responsibility model always leaves data, access, and configuration with the customer
• RPO governs acceptable data loss; RTO governs acceptable downtime — they drive different design choices
• Object, block, and file storage each map to a distinct access pattern, not a preference
• Horizontal scaling plus multi-AZ redundancy is the default pattern for cloud-native high availability