Cloud Platforms: AWS, Azure, GCP

Cloud Platforms: AWS, Azure, GCP

Cloud Platform Selection

AWS (Amazon Web Services)

• Strengths: Market leader, most services, mature ecosystem
• Best for: Enterprise, startups, wide service selection
• Key Services: EC2, EKS, RDS, S3, Lambda, CloudFormation

Azure (Microsoft Azure)

• Strengths: Enterprise integration, hybrid cloud, Microsoft stack
• Best for: Windows workloads, hybrid scenarios, Microsoft shops
• Key Services: VMs, AKS, SQL Database, Blob Storage, ARM Templates

GCP (Google Cloud Platform)

• Strengths: Kubernetes-native, ML/AI, data analytics
• Best for: Kubernetes, data processing, ML workloads
• Key Services: Compute Engine, GKE, Cloud SQL, Cloud Storage, Deployment Manager

AWS Architecture Patterns

Multi-Tier Web Application

Internet
    │
    ▼
┌─────────────────┐
│  CloudFront     │ CDN
│  (Global)       │
└────────┬────────┘
         │
    ┌────▼────┐
    │   ALB   │ Load Balancer
    └────┬────┘
         │
    ┌────▼──────────┐
    │   ECS/EKS     │ Application Layer
    │  (Multi-AZ)   │
    └────┬──────────┘
         │
    ┌────▼────┐
    │   RDS   │ Database Layer
    │ (Multi-AZ)│
    └─────────┘

AWS Well-Architected Framework Pillars

1. Operational Excellence

• IaC (Terraform/CloudFormation)
• CI/CD automation
• Monitoring and observability

2. Security

• IAM least privilege
• Encryption at rest and in transit
• Network segmentation (VPC, Security Groups)

3. Reliability

• Multi-AZ deployment
• Auto Scaling
• Backup and disaster recovery

4. Performance Efficiency

• Right-sizing instances
• CloudFront for content delivery
• ElastiCache for caching

5. Cost Optimization

• Reserved Instances
• Spot Instances
• Auto Scaling based on demand

6. Sustainability

• Region selection for renewable energy
• Right-sizing to minimize waste

AWS Core Services

Compute

# EC2 Instance
resource "aws_instance" "app" {
  ami           = data.aws_ami.amazon_linux_2.id
  instance_type = "t3.medium"

  vpc_security_group_ids = [aws_security_group.app.id]
  subnet_id              = aws_subnet.private[0].id

  iam_instance_profile = aws_iam_instance_profile.app.name

  user_data = <<-EOF
              #!/bin/bash
              yum update -y
              yum install -y docker
              systemctl start docker
              EOF

  tags = {
    Name = "${var.name_prefix}-app-server"
  }
}

# ECS Fargate
resource "aws_ecs_service" "app" {
  name            = "${var.name_prefix}-service"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = 3

  launch_type = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.private[*].id
    security_groups  = [aws_security_group.app.id]
    assign_public_ip = false
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app.arn
    container_name   = "app"
    container_port   = 8080
  }
}

# Lambda Function
resource "aws_lambda_function" "processor" {
  filename      = "lambda.zip"
  function_name = "${var.name_prefix}-processor"
  role          = aws_iam_role.lambda.arn
  handler       = "index.handler"
  runtime       = "nodejs20.x"

  environment {
    variables = {
      ENV = var.environment
    }
  }
}

Storage

# S3 Bucket
resource "aws_s3_bucket" "data" {
  bucket = "${var.name_prefix}-data-bucket"
}

resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
  }
}

# EBS Volume
resource "aws_ebs_volume" "data" {
  availability_zone = var.availability_zone
  size              = 100
  type              = "gp3"
  encrypted         = true
  kms_key_id        = aws_kms_key.ebs.arn

  tags = {
    Name = "${var.name_prefix}-data-volume"
  }
}

# EFS File System
resource "aws_efs_file_system" "shared" {
  encrypted = true
  kms_key_id = aws_kms_key.efs.arn

  lifecycle_policy {
    transition_to_ia = "AFTER_30_DAYS"
  }

  tags = {
    Name = "${var.name_prefix}-efs"
  }
}

Database

# RDS PostgreSQL
resource "aws_db_instance" "main" {
  identifier = "${var.name_prefix}-db"

  engine         = "postgres"
  engine_version = "15.4"
  instance_class = "db.t3.medium"

  allocated_storage     = 100
  max_allocated_storage = 1000
  storage_type          = "gp3"
  storage_encrypted     = true

  multi_az               = true
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.db.id]

  backup_retention_period = 7
  backup_window          = "03:00-04:00"
  maintenance_window     = "sun:04:00-sun:05:00"

  enabled_cloudwatch_logs_exports = ["postgresql"]

  deletion_protection = var.environment == "prod"
}

# DynamoDB Table
resource "aws_dynamodb_table" "sessions" {
  name           = "${var.name_prefix}-sessions"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "session_id"

  attribute {
    name = "session_id"
    type = "S"
  }

  ttl {
    attribute_name = "ttl"
    enabled        = true
  }

  point_in_time_recovery {
    enabled = true
  }

  server_side_encryption {
    enabled = true
  }
}

Azure Architecture Patterns

Multi-Tier Application on Azure

Internet
    │
    ▼
┌─────────────────┐
│  Azure Front    │ CDN + WAF
│     Door        │
└────────┬────────┘
         │
    ┌────▼────────┐
    │   App GW    │ Load Balancer
    └────┬────────┘
         │
    ┌────▼──────────┐
    │     AKS       │ Application Layer
    │ (Multi-Zone)  │
    └────┬──────────┘
         │
    ┌────▼──────────┐
    │ Azure SQL DB  │ Database Layer
    │ (Geo-Replica) │
    └───────────────┘

Azure Core Services

Compute

# Virtual Machine
resource "azurerm_linux_virtual_machine" "app" {
  name                = "${var.name_prefix}-vm"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_D2s_v3"

  network_interface_ids = [
    azurerm_network_interface.app.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-focal"
    sku       = "20_04-lts"
    version   = "latest"
  }

  admin_username = "azureuser"
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }
}

# AKS Cluster
resource "azurerm_kubernetes_cluster" "main" {
  name                = "${var.name_prefix}-aks"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  dns_prefix          = var.name_prefix

  default_node_pool {
    name            = "default"
    node_count      = 3
    vm_size         = "Standard_D2s_v3"
    os_disk_size_gb = 100
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin = "azure"
    network_policy = "calico"
  }
}

# Azure Functions
resource "azurerm_linux_function_app" "processor" {
  name                = "${var.name_prefix}-func"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location

  storage_account_name       = azurerm_storage_account.func.name
  storage_account_access_key = azurerm_storage_account.func.primary_access_key
  service_plan_id            = azurerm_service_plan.func.id

  site_config {
    application_stack {
      node_version = "20"
    }
  }
}

GCP Architecture Patterns

Multi-Tier Application on GCP

Internet
    │
    ▼
┌─────────────────┐
│  Cloud CDN      │
└────────┬────────┘
         │
    ┌────▼────────┐
    │  Cloud LB   │ Global Load Balancer
    └────┬────────┘
         │
    ┌────▼──────────┐
    │     GKE       │ Application Layer
    │ (Multi-Zone)  │
    └────┬──────────┘
         │
    ┌────▼──────────┐
    │  Cloud SQL    │ Database Layer
    │   (HA)        │
    └───────────────┘

GCP Core Services

Compute

# Compute Engine Instance
resource "google_compute_instance" "app" {
  name         = "${var.name_prefix}-vm"
  machine_type = "e2-medium"
  zone         = var.zone

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2004-lts"
      size  = 50
      type  = "pd-ssd"
    }
  }

  network_interface {
    network    = google_compute_network.vpc.name
    subnetwork = google_compute_subnetwork.private.name

    access_config {
      // Ephemeral public IP
    }
  }

  metadata_startup_script = file("startup.sh")

  service_account {
    scopes = ["cloud-platform"]
  }
}

# GKE Cluster
resource "google_container_cluster" "main" {
  name     = "${var.name_prefix}-gke"
  location = var.region

  # Remove default node pool
  remove_default_node_pool = true
  initial_node_count       = 1

  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.private.name

  ip_allocation_policy {
    cluster_ipv4_cidr_block  = "/16"
    services_ipv4_cidr_block = "/22"
  }

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }
}

resource "google_container_node_pool" "main" {
  name       = "main-pool"
  location   = var.region
  cluster    = google_container_cluster.main.name
  node_count = 1

  autoscaling {
    min_node_count = 1
    max_node_count = 10
  }

  node_config {
    machine_type = "e2-medium"
    disk_size_gb = 100
    disk_type    = "pd-standard"

    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]

    workload_metadata_config {
      mode = "GKE_METADATA"
    }
  }
}

Multi-Cloud Strategy

When to Use Multi-Cloud

✓ Avoid vendor lock-in ✓ Leverage best-of-breed services ✓ Geographic requirements ✓ Disaster recovery

Multi-Cloud Challenges

✗ Increased complexity ✗ Higher operational overhead ✗ Different APIs and tools ✗ Data transfer costs

Multi-Cloud Tools

• Terraform: Unified IaC across clouds
• Kubernetes: Consistent compute layer
• Service Mesh: Unified networking
• OpenTelemetry: Unified observability

Cost Optimization Strategies

AWS Cost Optimization

# Savings Plans / Reserved Instances
# Purchase via AWS Console or API

# Spot Instances
resource "aws_autoscaling_group" "app" {
  mixed_instances_policy {
    instances_distribution {
     
     
      spot_allocation_strategy                 = "capacity-optimized"
    }

    launch_template {
      launch_template_specification {
        launch_template_id = aws_launch_template.app.id
      }

      override {
        instance_type = "t3.medium"
      }
      override {
        instance_type = "t3a.medium"
      }
    }
  }
}

# S3 Lifecycle Policy
resource "aws_s3_bucket_lifecycle_configuration" "data" {
  bucket = aws_s3_bucket.data.id

  rule {
    id     = "archive-old-data"
    status = "Enabled"

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 90
      storage_class = "GLACIER"
    }

    expiration {
      days = 365
    }
  }
}

Cost Monitoring

# AWS Budget
resource "aws_budgets_budget" "monthly" {
  name         = "monthly-budget"
  budget_type  = "COST"
  limit_amount = "1000"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["devops@example.com"]
  }
}

Disaster Recovery

RTO/RPO Targets

• RTO (Recovery Time Objective): Maximum acceptable downtime
• RPO (Recovery Point Objective): Maximum acceptable data loss

DR Strategies (Lowest to Highest Cost)

1. Backup & Restore (RPO: hours, RTO: hours)

• Regular backups to cloud storage
• Restore when needed

2. Pilot Light (RPO: minutes, RTO: hours)

• Minimal infrastructure always running
• Scale up when needed

3. Warm Standby (RPO: seconds, RTO: minutes)

• Scaled-down version running
• Scale up for failover

4. Multi-Site Active/Active (RPO: none, RTO: none)

• Full capacity in multiple regions
• Traffic distributed across sites

Multi-Region Setup (AWS)

provider "aws" {
  alias  = "primary"
  region = "us-east-1"
}

provider "aws" {
  alias  = "dr"
  region = "us-west-2"
}

# Primary region resources
module "vpc_primary" {
  source = "./modules/vpc"
  providers = {
    aws = aws.primary
  }
}

# DR region resources
module "vpc_dr" {
  source = "./modules/vpc"
  providers = {
    aws = aws.dr
  }
}

# Route53 health check and failover
resource "aws_route53_health_check" "primary" {
  fqdn              = aws_lb.primary.dns_name
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = "3"
  request_interval  = "30"
}

resource "aws_route53_record" "app" {
  zone_id = aws_route53_zone.main.id
  name    = "app.example.com"
  type    = "A"

  set_identifier = "primary"
  failover_routing_policy {
    type = "PRIMARY"
  }

  alias {
    name                   = aws_lb.primary.dns_name
    zone_id                = aws_lb.primary.zone_id
    evaluate_target_health = true
  }

  health_check_id = aws_route53_health_check.primary.id
}

resource "aws_route53_record" "app_dr" {
  zone_id = aws_route53_zone.main.id
  name    = "app.example.com"
  type    = "A"

  set_identifier = "secondary"
  failover_routing_policy {
    type = "SECONDARY"
  }

  alias {
    name                   = aws_lb.dr.dns_name
    zone_id                = aws_lb.dr.zone_id
    evaluate_target_health = true
  }
}

Best Practices Summary

AWS

• Use IAM roles, not access keys
• Enable CloudTrail in all regions
• Encrypt everything (S3, EBS, RDS)
• Use VPC for network isolation
• Tag all resources for cost allocation

Azure

• Use Managed Identities
• Enable Azure Policy for governance
• Use Azure Key Vault for secrets
• Implement RBAC
• Use Resource Groups for organization

GCP

• Use Service Accounts with least privilege
• Enable Cloud Audit Logs
• Use VPC Service Controls
• Implement Organization Policies
• Use Labels for resource management

Cloud Service Comparison