Strategic Cloud Infrastructure and Security Management

Chapter 1: Introduction to Cloud Computing

IT and Cloud Technology are projected to be in an upward trend for the next 20 years.

Course Objectives

• Understand Cloud Computing technology and its growth trends.
• Analyze the relationship between IT and business.
• Develop high-demand job market skills.

Motivation and Career Vision

To get the most out of this course, consider your motivation: solving problems, career vision, or practical needs like job prospects and earning potential.

Key Assets of a Start-up

• Time: Short supply and highly valuable.
• Decision-making: Choosing the right directions quickly.
• Direction: Maintaining a clear vision.
• Money: Limited resources that require wise use.

The Build or Buy Concept

A crucial decision in cloud computing involves choosing between building custom solutions or buying existing services.

• Build: Set up and maintain systems yourself. Examples include owning a file server or an email tracking system.
• Buy: Use an existing service. Examples include Google Drive or Dropbox for storage, and Mailchimp or Constant Contact for email marketing.

Major Cloud Service Models

• Infrastructure as a Service (IaaS): Provides virtualized computing resources over the internet.
• Platform as a Service (PaaS): Offers hardware and software tools over the internet, typically for application development.
• Software as a Service (SaaS): Delivers software applications over the internet on a subscription basis.

Business Automation

Automation via cloud services reduces manual work, minimizes human error, and allows teams to focus on core activities. Examples include the adoption of DevOps and CI/CD.

Aspect 1: Investment in Infrastructure

• CapEx vs. OpEx: Cloud computing shifts IT expenses from Capital Expenditure (buying physical assets) to Operational Expenditure (paying for services as you use them).
• Total Cost of Ownership (TCO): Consider initial hardware, maintenance, energy, and personnel costs when comparing on-premise vs. cloud.
• Note: Cloud is not always cheaper, especially for stable, predictable workloads.
• Cost Optimization: Utilize Auto-scaling (adjusting resources based on demand) and Serverless computing (paying only for compute time).

Aspect 2: Area of Expertise

• Consider your core business focus and whether you have the in-house expertise to build.
• Money cannot buy time, but it can save time.
• Rules of Thumb for Build or Buy: Build when it is the core of your system, when no one can do it better, or when it creates greater long-term value.

Aspect 3: Scalability and Traffic Spikes

• Cloud: Handles traffic spikes without overprovisioning; pay only for resources used. Example: E-commerce sites during Black Friday.
• On-Premise: Requires upfront investment for peak capacity, risking over or under-provisioning.

Aspect 5: Cloud Security and SLA

Service Level Agreements (SLAs) are crucial for building trust and meeting regulatory expectations. Cloud providers offer high availability, uptime guarantees, and certifications like ISO 27001.

Aspect 6: Agility and Emerging Technologies

Cloud computing lowers the barrier to entry for new technologies, such as quantum computing, without requiring specialized hardware.

Excelling in a Cloud Career

• Fundamental Skills: Strong coding, logical thinking, architecture design, networking, and security principles.
• Mindset: Openness to new ideas, willingness to experiment, and a drive for innovation.
• Career Growth: Strive to be a builder, not just an operator. Stay current with trends and choose companies that invest in development.

Chapter 2: Cloud Fundamentals

Cloud computing is the on-demand delivery of IT resources over the internet with pay-as-you-go pricing. Instead of owning physical data centers, you access services like compute, storage, and databases from a provider.

Key Characteristics

• On-demand self-service.
• Broad network access.
• Resource pooling.
• Rapid elasticity.
• Measured service (monitored usage).

Evolution of Computing

Mainframe era → Client-server model → Web-based services → Modern cloud computing.

On-demand Cloud vs. Traditional On-premise

• Cloud: Instant provisioning, pay-per-use, and automatic scaling.
• On-premise: Provisioning takes weeks, requires upfront CapEx, and manual scaling.

Major Providers and History

AWS was founded in 2002 and launched public services like S3 and EC2 in 2006. As of 2024, the market leaders are AWS (32%), Microsoft Azure (23%), and Google Cloud Platform (11%).

Cloud Delivery Models Analogy

• IaaS: A fully equipped kitchen where you do the cooking (Full control).
• PaaS: A meal kit delivery where prep is done for you (Focus on code).
• SaaS: Ready-made meal delivery (Just enjoy the service).

Cloud Service Categories

Compute

Scalable resources including VMs (General Purpose, Compute Optimized, Memory Optimized, Storage Optimized), Containers, and Serverless.

Storage

• Object Storage: For large unstructured data (e.g., S3). Highly scalable but higher latency.
• Block Storage: High-performance volumes for VMs (e.g., EBS). Low latency but limited scalability.
• File Storage: Shared file systems for collaborative workflows (e.g., EFS).

Databases

• Relational (SQL): Amazon RDS.
• Non-Relational (NoSQL): Amazon DynamoDB (for massive scale).
• In-Memory: Amazon ElastiCache (for fast session management).

Global Infrastructure

• Regions: Geographical areas with clustered data centers, independent for fault tolerance.
• Availability Zones (AZs): Distinct, physically separated locations within a region with low-latency connectivity.
• Edge Locations: Data centers for Content Delivery Networks (CDN) like CloudFront to reduce latency.

Chapter 3: Learning from a Scenario

AWS Management Console

A centralized interface for managing resources, monitoring costs, and implementing security. It is vital to secure the console using Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC).

Virtual Machine Costs

• Instance Types: Pricing varies by CPU, memory, and storage.
• Region: Costs differ significantly; US East (N. Virginia) is often the cheapest.
• Usage Models:
  • On-Demand: Pay by the hour/second.
  • Reserved Instances (RIs): Discounts for 1 or 3-year commitments.
  • Spot Instances: Spare capacity at up to 90% off.

Creating and Connecting to VMs

• Images: Choose between Base OS Images or Pre-packaged Images (e.g., WordPress).
• Connecting: Use SSH for Linux (Port 22) and RDP for Windows (Port 3389).
• Security Groups: Act as virtual firewalls to control inbound and outbound traffic.

Chapter 4: Designing Resilient Cloud Architectures

High Availability (HA)

HA ensures systems operate continuously with minimal downtime. Aim for "five nines" (99.999%), which allows only 26.3 seconds of downtime per month.

Core Components of HA

• Redundancy: Duplicating resources to avoid single points of failure.
• Load Balancing: Distributing traffic across healthy instances (e.g., AWS ELB).
• Failover: Automatically shifting workloads to backup systems during failure.

Load Balancer Types

• Application Load Balancer (ALB): Operates at Layer 7 (HTTP/HTTPS) for URL-based routing.
• Network Load Balancer (NLB): Operates at Layer 4 (TCP/UDP) for high-throughput, low-latency needs.

Scaling Strategies

• Horizontal Scaling: Adding or removing instances (Scaling Out/In).
• Vertical Scaling: Increasing the power of an existing instance (Scaling Up/Down).
• Triggers: Scaling based on CPU, memory, or scheduled patterns.

Chapter 5: Cloud Architecture Design and Cost Modeling

Migration Strategy: TechMart Case Study

• Phase 1: Planning and assessment.
• Phase 2: Migrating non-critical systems.
• Phase 3: Database migration (Amazon RDS).

Architecture Components

• VPC: Isolated network.
• S3: Durable object storage for static content.
• CloudFront: Global content delivery.
• RDS Multi-AZ: Synchronous data replication for failover.

Cost Optimization Plan

Use Reserved Instances for predictable application and database loads, and Spot Instances for interruptible analytics tasks.

Chapter 6: Cloud Security Essentials

Shared Responsibility Model

• AWS: Responsible for security of the cloud (Physical hardware, global infrastructure).
• Customer: Responsible for security in the cloud (Data, IAM, encryption, network configuration).

Identity and Access Management (IAM)

• Users: Individual entities.
• Groups: Collections of users with shared permissions.
• Policies: JSON documents defining allowed actions.
• Principle of Least Privilege: Granting only the minimum necessary permissions.

Data Protection Mechanisms

• Data-at-Rest: Encryption for stored data (EBS, S3, RDS).
• Data-in-Transit: Encryption for moving data using SSL/TLS certificates.

Chapter 7: Cloud Security – ISO 27001 and ISMS

ISO 27001 is a global standard for Information Security Management Systems (ISMS). It helps identify and mitigate risks to ensure confidentiality, integrity, and availability.

Implementation Steps for ISMS

• Leadership Commitment: Management support and resource allocation.
• Context Assessment: Identifying internal and external security factors.
• Risk Management: Identifying, analyzing, and prioritizing threats.
• Security Policies: Drafting rules for data handling and IT use.
• Asset Management: Inventorying and classifying information assets.
• Access Control: Implementing strong authentication and RBAC.
• Incident Management: Defining response procedures for breaches.
• Continuous Improvement: Regular audits and updates to remain adaptable.