Cloud Computing Lab (IT-704) - Unit 2 Short Notes

2.0 Introduction to Cloud Service Models & Deployment Types (Lab Perspective)

• Service Models:

  • IaaS (Infrastructure as a Service): Provides fundamental compute, network, and storage resources. Example Lab: Launching a VM (EC2/Compute Engine) and manually configuring OS and software.

  • PaaS (Platform as a Service): Provides a platform for developing, running, and managing applications without infrastructure management. Example Lab: Deploying code to Azure App Service or AWS Elastic Beanstalk.

  • SaaS (Software as a Service): Provides complete, ready-to-use applications over the internet. Example Lab: Using Google Workspace or Office 365; no infrastructure management by user.

• Deployment Models:

  • Public Cloud: Resources owned/operated by third-party providers (AWS, Azure, GCP). Lab: Using any provider's free tier.

  • Private Cloud: Resources used exclusively by a single organization. Lab: Setting up OpenStack or VMware on-prem.

  • Hybrid Cloud: Combination of public and private clouds. Lab: Connecting on-prem DC to AWS VPC via VPN/Direct Connect.

  • Multi-Cloud: Use of multiple public clouds from different providers. Lab: Storing data in S3, running compute in GCP.

[!TIP] Exam often asks to match an application requirement to the correct service model. Remember: Need full OS control? → IaaS. Want to focus only on code? → PaaS. Just need an email service? → SaaS.

2.1 Major Cloud Provider Ecosystems: Hands-On Onboarding

Amazon Web Services (AWS)

• Console & CLI: aws CLI for scripting. Management Console for GUI.

• Core Services Lab:

  • EC2: Virtual servers. Key concepts: AMIs (images), instance types, Security Groups (stateful firewall), key pairs (SSH).

  • S3: Object storage. Buckets (containers), objects, versioning, lifecycle policies, static website hosting.

  • VPC: Isolated virtual network. Subnets (public/private), Internet Gateway (IGW), route tables.

• IAM (Identity & Access Management): Users, Groups, Roles, Policies (JSON). Principle of Least Privilege. Lab: Creating an IAM role for an EC2 instance to access S3.

Microsoft Azure

• Portal & CLI/PowerShell: az CLI, Azure PowerShell. Resource Manager model.

• Core Services Lab:

  • Virtual Machines: Similar to EC2. Uses Resource Groups as logical containers.

  • Blob Storage: Object storage (like S3). Containers, access tiers.

  • Virtual Network (VNet): Subnets, Network Security Groups (NSG) (stateful), Azure Firewall.

• Azure Active Directory (AAD): Identity service. Role-Based Access Control (RBAC) assigns roles (e.g., Contributor, Reader) to users/groups at scope (subscription, RG, resource).

Google Cloud Platform (GCP)

• Console & CLI: gcloud CLI. Projects and folders for organization.

• Core Services Lab:

  • Compute Engine: VMs. Images, machine types, VPC networks (global) and subnets (regional).

  • Cloud Storage: Object storage. Buckets, classes (Standard, Nearline), IAM permissions.

• IAM: Unified across GCP. Service Accounts (for applications/VMs) and roles (primitive, predefined, custom). Lab: Assigning a service account to a VM.

Comparative Lab: Simple Web Server Deployment

[!TIP] Know the provider-specific terminology: AWS "Security Group" vs Azure "NSG" vs GCP "Firewall Rules". All are stateful except GCP's optional VPC firewall rules (which are stateful by default too).

2.2 Virtualization & Compute Deep Dive

Virtual Machines (VMs)

• Lab: Launching & Connecting:

  • AWS: aws ec2 run-instances, connect via SSH using key pair.

  • Azure: az vm create, connect via RDP/SSH using username/password or key.

  • GCP: gcloud compute instances create, connect via SSH.

• Lab: Images & Snapshots:

  • AMI (AWS) / Image (Azure/GCP): Template for launching VMs. Can be custom (created from a running VM).

  • Snapshot/Backup: Point-in-time copy of a volume/disk. Used for recovery or creating new images.

• Lab: Scaling:

  • Manual Scaling: Adjust instance count manually.

  • Auto-Scaling Groups (AWS) / VM Scale Sets (Azure) / Instance Groups (GCP): Automatically adjust count based on metrics (e.g., CPU > 70%).

    • Formula Concept: Desired Capacity = f(current metric, target metric, min/max bounds).

• Lab: High Availability:

  • Availability Zones (AZs): Isolated locations within a region. Distribute VMs across AZs.

  • Availability Sets (Azure) / Spread Placement Groups (AWS): Ensure VMs are isolated across fault domains (power, cooling) within an AZ.

Containers & Container Orchestration

• Docker Fundamentals:

  • Lab: Installing: apt-get install docker.io (Linux).

  • Lab: Images: docker pull nginx, docker build -t myapp . (from Dockerfile).

  • Lab: Running: docker run -d -p 80:80 nginx. -d (detached), -p (port mapping).

  • Dockerfile Basics: FROM, RUN, COPY, CMD.

• Kubernetes (K8s) Fundamentals:

  • Lab: Setup: Minikube (local), k3s (lightweight), or managed (EKS/AKS/GKE).

  • Core Concepts:

    • Pod: Smallest deployable unit (1+ containers).

    • Deployment: Declarative management of Pods (replicas, updates).

    • Service: Network endpoint to access Pods (ClusterIP, NodePort, LoadBalancer).

    • Namespace: Virtual cluster partition.

  • Lab: Multi-container App: Deploy a web Pod (nginx) and db Pod (postgres). Create a web-service (type: LoadBalancer) to expose the web app.

[!TIP] Docker vs. VM: Docker shares OS kernel; VM has full OS. K8s Pod vs. Container: Pod is an abstraction; can have multiple containers sharing network/storage.

2.3 Cloud Storage Solutions

[!TIP] Static Website Hosting: Only possible with Object Storage (S3/Blob/Cloud Storage). Configure bucket for static hosting, upload HTML/CSS/JS, access via bucket endpoint.

2.4 Cloud Networking Essentials

• VPC / VNet:

  • Lab: Design & Create:

    • Create VPC (e.g., 10.0.0.0/16).

    • Create public subnet (e.g., 10.0.1.0/24 with route to IGW) for web servers.

    • Create private subnet (e.g., 10.0.2.0/24 with route to NAT) for app/db servers.

  • Gateways:

    • Internet Gateway (IGW): Allows public subnet resources to access internet.

    • NAT Gateway: Allows private subnet resources to initiate outbound internet (for patches), but not inbound.

• Security Groups vs. Network ACLs:

  | Feature | Security Group | Network ACL (NACL) | | :--- | :--- | :--- | | Scope | Instance level | Subnet level | | Stateful | Yes (return traffic auto-allowed) | No (must explicitly allow return) | | Rules | Allow only (implicit deny) | Allow & Deny (explicit deny) | | Lab: Apply SG to EC2 allowing port 80/443 from 0.0.0.0/0. Apply NACL to subnet allowing same. |

• Load Balancing:

  • Lab: Application Load Balancer (ALB - AWS) / Azure Load Balancer: Distribute HTTP/HTTPS traffic to targets (EC2/VMs) in multiple AZs. Configure health checks.

  • Key: Target Group (AWS) / Backend Pool (Azure) defines the instances.

• Content Delivery Networks (CDN):

  • Lab: CloudFront (AWS) / Azure CDN: Cache static content (from S3/Blob) at edge locations. Reduce latency. Origin = S3 bucket, behaviors = cache settings.

[!TIP] Security Groups are your first line of defense for instances. NACLs are a second layer for the entire subnet. Default SG allows all outbound, denies all inbound.

2.5 Serverless Computing & Functions

• Function-as-a-Service (FaaS):

  • Lab: Create & Deploy:

    • AWS Lambda: Write function (Python/Node.js), set handler, runtime. Deploy via console or aws lambda create-function.

    • Azure Functions: Create Function App, write code in portal or VS Code.

    • GCP Cloud Functions: gcloud functions deploy.

  • Triggers: HTTP API (API Gateway/Function URL), object storage events (S3 → Lambda), schedule (CloudWatch Events/Cron), message queues (SQS).

  • Configuration: Memory (affects CPU & cost), timeout (max execution time), execution role (IAM role granting permissions).

• Backend-as-a-Service (BaaS) & Managed Services:

  • Managed Databases: RDS (AWS), Azure SQL Database, Cloud SQL (GCP). Provider manages OS, patching, backups. Lab: Create RDS MySQL instance, note endpoint for connection.

  • Message Queues: SQS (AWS), Service Bus (Azure), Pub/Sub (GCP). Decouple components. Lab: Send message to SQS queue from Lambda.

[!TIP] Serverless Cold Start: First invocation after period of inactivity has higher latency. Not an issue for always-warm apps. Stateless by design – store state in DB/cache.

2.6 Infrastructure as Code (IaC)

• Terraform Fundamentals:

  • Lab: Workflow:

    1. terraform init - Initialize working directory.

    2. terraform plan - Show execution plan (what will be created/changed).

    3. terraform apply - Create/update resources.

    4. terraform destroy - Tear down all managed infrastructure.

  • HCL Syntax (Hashicorp Configuration Language):

    
    resource "aws_instance" "web_server" {
    
      ami           = "ami-0c55b159cbfafe1f0"
    
      instance_type = "t2.micro"
    
      tags = {
    
        Name = "WebServer"
    
      }
    
    }
    
    

  • State File (terraform.tfstate): JSON file tracking real-world resources. Must be stored securely (remote backend like S3).

• Cloud-Native IaC Tools:

  • AWS CloudFormation: Uses JSON/YAML templates. aws cloudformation create-stack.

  • Azure Resource Manager (ARM) Templates: JSON templates. az deployment group create.

  • Google Deployment Manager: Uses YAML/JSON/Python templates.

• Comparison: Terraform is multi-cloud and declarative. Ansible is primarily configuration management (imperative) but can also provision. Lab: Write a Terraform config to create an AWS VPC, subnet, and EC2 instance.

[!TIP] Idempotency is key. Running terraform apply twice with same config should not create duplicate resources. Use resource attributes (like id) to reference.

2.7 Monitoring, Logging, & Management

• Cloud Monitoring & Metrics:

  • AWS CloudWatch: Metrics (CPUUtilization, NetworkIn), Alarms, Dashboards.

  • Azure Monitor: Metrics, Alerts, Application Insights (for apps).

  • GCP Cloud Monitoring: Metrics, Uptime checks, Alerting.

  • Lab: Create alarm on EC2 CPU > 80% for 5 minutes → send SNS/email.

• Centralized Logging:

  • AWS CloudWatch Logs: Agent on VM sends logs to log groups. Query with CloudWatch Logs Insights.

  • Azure Monitor Logs: Log Analytics workspace. Query with Kusto Query Language (KQL).

  • GCP Cloud Logging: Logs-based metrics, advanced queries.

  • Lab: Install CloudWatch Agent on EC2, send /var/log/messages to CloudWatch Logs. Query for "ERROR".

• Cost Management & Billing:

  • Lab: Use provider's Cost Calculator (AWS Pricing Calculator, Azure Pricing Calculator) pre-deployment.

  • Budgets & Alerts: Set monthly budget (e.g., $50), alert at 80%.

  • Cost Allocation Tags: Apply tags (e.g., Project=WebApp, Environment=Prod) to resources for granular cost reporting.

[!TIP] Monitoring vs. Logging: Metrics are numerical data points (CPU %). Logs are timestamped event records (application output). Use both for full observability.

2.8 Security & Compliance in the Cloud (Lab Focus)

• Shared Responsibility Model:

  | Cloud Provider Responsible For | Customer Responsible For | | :--- | :--- | | Physical security, network fabric, hypervisor | IaaS: OS, network config (SG/NACL), apps, data | | | PaaS: Apps, data, some config | | | SaaS: User data, access management |

• Encryption:

  • At Rest: Data stored on disks/buckets.

    • Lab (AWS): Enable S3 default encryption (AES-256 or AWS-KMS). Enable EBS encryption on volume creation.

  • In Transit: Data moving between client/service or between services.

    • Lab: Use HTTPS (TLS) for web servers. For S3, use https:// endpoints or enforce SSL/TLS in bucket policy.

• Key Management Services (KMS):

  • AWS KMS / Azure Key Vault / GCP Cloud KMS: Create and manage Customer Managed Keys (CMKs). Control who can use keys for encryption/decryption.

  • Lab: Create KMS key, use it to encrypt S3 bucket. Grant EC2 role permission to use key.

• Secrets Management:

  • AWS Secrets Manager / Azure Key Vault (secrets) / GCP Secret Manager: Store database passwords, API keys. Never in code/config files.

  • Lab: Store DB password in Secrets Manager. Lambda function retrieves secret at runtime using IAM role.

• Compliance & Auditing:

  • AWS CloudTrail / Azure Activity Log / GCP Cloud Audit Logs: Record all API calls (management events). Immutable logs.

  • Lab: Enable CloudTrail to S3 bucket. Query for eventName=StopInstances to see who stopped an EC2.

[!TIP] Encryption Defaults: Most cloud storage (S3, Blob) is encrypted at rest by default (provider-managed keys). For compliance (e.g., HIPAA, PCI-DSS), you often need customer-managed keys (CMK).

2.9 Capstone Integration Lab: 3-Tier Application

Scenario: Deploy a web app (e.g., WordPress: PHP front-end + MySQL DB).

Step-by-Step Integration Approach:

1. IaC Provisioning (Terraform):

   • Define VPC with public (web) and private (app, db) subnets across 2 AZs.

   • Create Security Groups: Web SG (allow 80/443 from internet), App SG (allow 8080 from Web SG), DB SG (allow 3306 from App SG).

   • Launch EC2 instances in public subnet for web tier (use auto-scaling group).

   • Launch EC2 instances in private subnet for app tier.

   • Create RDS MySQL instance in private subnet (multi-AZ for HA).

2. Containerization & Orchestration (Kubernetes):

   • Alternative to EC2 for app tier: Use EKS/AKS/GKE.

   • Containerize app code into Docker image, push to ECR/ACR/GCR.

   • Write K8s Deployment for app pods, Service (ClusterIP) for internal access.

   • Write K8s Deployment for database (or use managed RDS).

3. Load Balancing & Auto-Scaling:

   • Create ALB/AGIC targeting web tier (EC2 ASG or K8s Service of type LoadBalancer).

   • Configure Auto-Scaling Policy for web tier: desired_capacity = current_capacity ± (metric - threshold) * scaling_factor.

4. Security Implementation:

   • Apply least-privilege IAM roles: Web EC2 role (read S3), App EC2 role (access RDS secrets from Secrets Manager).

   • Enable EBS encryption (KMS), S3 encryption.

   • Enable VPC Flow Logs and CloudTrail for auditing.

5. Monitoring & Logging:

   • Install CloudWatch Agent on EC2s, send logs to CloudWatch Logs.

   • Create CloudWatch Dashboard showing ALB request count, EC2 CPU, RDS connections.

   • Set CloudWatch Alarm on ALB 5xx errors > 5%.

6. Cost Tracking:

   • Apply cost allocation tags (Tier=Web, Tier=App, Tier=DB) to all resources.

   • Use AWS Cost Explorer / Azure Cost Management to view spend by tag.

[!TIP] Capstone Exam Questions often focus on design choices: "Why use a private subnet for DB?" (Security). "Why use managed RDS over EC2 MySQL?" (Reduced ops overhead, automated backups). "How to securely provide DB password to app?" (Secrets Manager).