Cloud Architecture: AWS, Azure and Google Cloud

Why it matters: The three big clouds use different names for the same ideas. Learn the ideas once, then translate to any provider, and design with identity, exposure, and recovery in mind from the start.

By the end you can:

• Name the shared building blocks of cloud platforms
• Map concepts across AWS, Azure, and Google Cloud
• Explain shared responsibility
• Sketch a simple architecture with trust boundaries

Learn (15 min)

1. Shared building blocks (5 min)

2. Shared responsibility (5 min)

The provider secures the underlying cloud; you secure what you configure: identities, data access, network exposure, retention, backups. Managed services reduce maintenance but not your responsibility for configuration. Read each provider's current responsibility model for the services you use.

3. Design for least privilege and recovery (5 min)

Start with the workload: users, data sensitivity, traffic, recovery targets (how much downtime and data loss you can tolerate), and who operates it. Then: private storage by default; workload identities instead of embedded keys; encrypted data; logs on key actions; tested restores. A backup in the same failure domain isn't enough.

Apply (15 min)

Worked example (3 min). Internal document portal.

Users → (SSO login) → Web app (public endpoint, HTTPS only)
                       │ uses workload identity
                       ▼
                Private storage (no public access) ← files
                       │
                Logs + alerts → owner;  Nightly backup → second region

Questions answered: Public = web endpoint only. Storage identity = the app's role with read/write to one container. Secrets = vault. Recovery = restore test quarterly.

Lab (7 min): Draw and translate.

1. Sketch an architecture for a simple client file-sharing portal (users, web tier, storage, logs, backup).
2. Mark trust boundaries and the one public entry point.
3. Translate each component to your chosen provider's service names.
4. Write the restore-test question: "How would we prove we can recover within X hours?"

Deliverable: A diagram with a translation table. You're done when: Only intended components are public.

Check yourself (5 min)

1. Name four cloud building blocks.
2. Does a managed service remove your security responsibilities?
3. How should an app access another cloud resource?
4. Scenario: A storage bucket is "public by accident." Which design habit prevents it?
5. Why test a restore?

Reference

Common mistakes

Cheat sheet: Who uses it? What data? What's public? Which identity touches each resource? How is it monitored? What if a component or region fails? How do we restore?

Key terms: region, zone, IAM, shared responsibility, workload identity, trust boundary.

Interview prompts: Sketch a secure architecture for a file portal on any cloud.

Go deeper: AWS Well-Architected · Azure Well-Architected · Google Cloud Architecture Framework

Next: Lesson 49 — containers.