🌙
☀️ Dark
PART 29

Cloud Engineering

VPC, IAM, serverless, managed databases.

Advanced 45 min read
PART 29 — CLOUD ENGINEERING

Revision Sheet

  • Compute: EC2 (VMs), Lambda (Serverless), ECS/EKS (Containers).
  • Storage: S3 (Object/Files), EBS (Block/Disk), EFS (Shared File System).
  • Database: RDS (SQL), DynamoDB (NoSQL), ElastiCache (Redis).
  • Networking: VPC, Subnets, Internet Gateway, NAT Gateway, Security Groups.
  • Scaling: Load Balancers distribute traffic; Auto Scaling adds/removes instances.
  • Security: IAM (Identity & Access Management) controls permissions. Secrets Manager stores passwords.

Connections

In Part 28, we built our containerized Node.js and PostgreSQL backend. Here in Part 29, we learned how to provision the cloud infrastructure to host those containers securely. Next, in Part 30 — CI/CD and GitOps, we will automate the deployment process so that every `git push` automatically tests and deploys our code into this cloud environment.

PreviousVolume 28 🏠 Curriculum NextVolume 30
🏠 Curriculum NextVolume 2

Mini Project (20-30 min)

▶ View Solution

Goal: Deploy a Serverless Function.

Create an AWS Lambda function (or equivalent) in Node.js that triggers whenever a file is uploaded to an S3 bucket. The function should read the file, resize the image using a library like Sharp, and save the thumbnail to a different bucket.

Bigger Project (1-2 hours)

Apply all concepts from this volume to build a comprehensive feature.

▶ View Solution
typescript 
// Example project code here

Interview Questions

Easy: What is the difference between Object Storage (S3) and Block Storage (EBS)?

Object storage is a flat namespace for files accessed via HTTP APIs (ideal for images, backups). Block storage is a virtual hard drive attached to a specific VM (ideal for running an OS or database).

Medium: What is a VPC and why do we use Public and Private subnets?

A VPC is a logically isolated network in the cloud. Public subnets have direct internet access (via Internet Gateway) used for Load Balancers. Private subnets have no direct internet access, used for application servers and databases to shield them from external attacks.

Hard: How does a server in a private subnet download software updates from the internet without exposing itself to inbound internet traffic?

It uses a NAT (Network Address Translation) Gateway located in the public subnet. The private server routes its outbound traffic to the NAT Gateway, which translates the private IP to a public IP, fetches the update, and returns the response. The NAT Gateway blocks any unrequested inbound connections.

Senior: Architect a highly available, multi-region web application that can withstand a complete region failure.

Use DNS-level routing (Route53) with failover or latency-based routing pointing to Load Balancers in two different regions (e.g., us-east-1 and eu-west-1). Deploy stateless compute clusters in both regions. For state, use a globally distributed database (like DynamoDB Global Tables or Aurora Global Database) that asynchronously replicates data across regions. Ensure CDNs are caching content globally.