Cloud Architecture
Design scalable, cost-effective, secure cloud infrastructure on AWS, GCP, or Azure.
Context
You are designing cloud infrastructure. Select services, plan scaling, networking, security, and cost. Read requirements, existing infrastructure, regulatory constraints, and team cloud maturity.
Domain Context
Based on cloud architecture best practices (AWS Well-Architected Framework, Google Cloud Architecture Framework):
- Compute: Servers (EC2/Compute Engine), containers (ECS/GKE), functions (Lambda/Cloud Functions), management burden increases
- Storage: Object storage (S3), databases (RDS/Cloud SQL), data warehouses (Redshift/BigQuery)
- Networking: VPC isolation, subnets, security groups, load balancing, DNS
- Observability: Metrics, logs, traces; CloudWatch, Stackdriver, DataDog
- Compliance: Shared responsibility; you manage application, cloud owns infrastructure
Instructions
Select Core Services: What workloads? Web app → App Engine/Elastic Beanstalk. Data processing → Spark on Kubernetes. Database → RDS PostgreSQL. Data warehouse → BigQuery.
Design Resilient Architecture: Multi-AZ (availability zone) for redundancy. Health checks and auto-recovery. Load balancing across instances. Plan RPO/RTO requirements.
Plan Networking: VPC with public and private subnets. Bastion for private access. Security groups restrict traffic. NAT Gateway for outbound access. CloudFlare or WAF for DDoS.
Implement Security: IAM roles (principle of least privilege). Encrypt data at rest (KMS) and in transit (TLS). Secrets management (Secrets Manager/Vault). Regular patching.
Cost Optimize: Reserved instances for predictable workloads (30-70% discount). Spot instances for batch/non-critical (70% discount). Right-size instances; monitor utilization. Use managed services to reduce operational overhead.
Anti-Patterns
- Lift-and-Shift Without Optimization: Move VMs to cloud as-is. Result: expensive, not cloud-native. Guard: Rearchitect for cloud; use managed services where appropriate.
- Single-AZ for Critical Services: Cut costs by using single availability zone. Result: outage when AZ fails. Guard: Multi-AZ for production; single-AZ acceptable for non-critical dev.
- Ignoring Cloud-Native Patterns: Treat cloud like traditional datacenter. Result: underutilize auto-scaling, caching, global distribution. Guard: Design for elasticity; use services like CDN, auto-scaling groups.
- No Cost Monitoring: Assume cloud is cheaper than on-prem. Result: bill shock. Guard: Set up cost alerts; monitor per-service usage; optimize continuously.
Further Reading
- AWS Well-Architected Framework — foundational cloud design principles
- Building Microservices on AWS — cloud-native architecture patterns
- Cloud Security Best Practices — security architecture for cloud
1---2name: cloud-architecture3description: Design cloud infrastructure for AWS, GCP, or Azure. Plan compute, storage, networking, and compliance. Use when architecting cloud systems or migrating to cloud.4---56# Cloud Architecture78Design scalable, cost-effective, secure cloud infrastructure on AWS, GCP, or Azure.910## Context1112You are designing cloud infrastructure. Select services, plan scaling, networking, security, and cost. Read requirements, existing infrastructure, regulatory constraints, and team cloud maturity.1314## Domain Context1516Based on cloud architecture best practices (AWS Well-Architected Framework, Google Cloud Architecture Framework):1718- **Compute**: Servers (EC2/Compute Engine), containers (ECS/GKE), functions (Lambda/Cloud Functions), management burden increases19- **Storage**: Object storage (S3), databases (RDS/Cloud SQL), data warehouses (Redshift/BigQuery)20- **Networking**: VPC isolation, subnets, security groups, load balancing, DNS21- **Observability**: Metrics, logs, traces; CloudWatch, Stackdriver, DataDog22- **Compliance**: Shared responsibility; you manage application, cloud owns infrastructure2324## Instructions25261. **Select Core Services**: What workloads? Web app → App Engine/Elastic Beanstalk. Data processing → Spark on Kubernetes. Database → RDS PostgreSQL. Data warehouse → BigQuery.27282. **Design Resilient Architecture**: Multi-AZ (availability zone) for redundancy. Health checks and auto-recovery. Load balancing across instances. Plan RPO/RTO requirements.29303. **Plan Networking**: VPC with public and private subnets. Bastion for private access. Security groups restrict traffic. NAT Gateway for outbound access. CloudFlare or WAF for DDoS.31324. **Implement Security**: IAM roles (principle of least privilege). Encrypt data at rest (KMS) and in transit (TLS). Secrets management (Secrets Manager/Vault). Regular patching.33345. **Cost Optimize**: Reserved instances for predictable workloads (30-70% discount). Spot instances for batch/non-critical (70% discount). Right-size instances; monitor utilization. Use managed services to reduce operational overhead.3536## Anti-Patterns3738- **Lift-and-Shift Without Optimization**: Move VMs to cloud as-is. Result: expensive, not cloud-native. **Guard**: Rearchitect for cloud; use managed services where appropriate.39- **Single-AZ for Critical Services**: Cut costs by using single availability zone. Result: outage when AZ fails. **Guard**: Multi-AZ for production; single-AZ acceptable for non-critical dev.40- **Ignoring Cloud-Native Patterns**: Treat cloud like traditional datacenter. Result: underutilize auto-scaling, caching, global distribution. **Guard**: Design for elasticity; use services like CDN, auto-scaling groups.41- **No Cost Monitoring**: Assume cloud is cheaper than on-prem. Result: bill shock. **Guard**: Set up cost alerts; monitor per-service usage; optimize continuously.4243## Further Reading4445- _AWS Well-Architected Framework_ — foundational cloud design principles46- _Building Microservices on AWS_ — cloud-native architecture patterns47- _Cloud Security Best Practices_ — security architecture for cloud
sethdford