Library
00/07 · ~34 min
GUIDEDECK · renting computers by the second

Cloud
Fundamentals
without the hand-waving.

A 34-minute working session on what "the cloud" actually is — the service models, the building blocks (compute, storage, networking), who's responsible for security, how the bill really adds up, and how the big three providers compare when you have to choose.

~34 MINBEGINNER → INTERMEDIATEPROVIDER-AGNOSTIC
SCROLL
01 · What the cloud is — IaaS vs PaaS vs SaaS 4 min

Someone else's computers,
rented by the second.

Strip away the marketing and the cloud is a simple trade: instead of buying servers and running a room full of them, you rent capacity from a provider over the internet and pay only for what you use. The real question isn't whether to use it — it's how much of the stack you want to manage yourself.

Cloud computing on-demand access to computing resources (servers, storage, networking, databases) over the internet, billed for usage rather than owned. The provider runs the physical hardware in data centers; you provision what you need through an API or console in minutes, and hand it back when you're done.

Why teams move to it

  • No capital up front — swap a big hardware purchase for a monthly bill that tracks real usage (capex → opex).
  • Elastic — scale up for a launch, scale back down at night; you rent peak capacity only while you need it.
  • Fast — a new server is an API call, not a six-week purchase order.
  • Global — deploy near your users in any region without building a data center there.

The catch: convenience has a price, lock-in is real, and a careless configuration can run up a bill or leak data. Everything ahead is about spending that trade wisely.

On-prem IaaS PaaS SaaS Application Application Application Application Runtime Runtime Runtime Runtime OS OS OS OS Virtualization Virtualization Virtualization Virtualization Servers + Network Servers + Network Servers + Network Servers + Network you manage provider manages

Move right and the provider takes over more of the stack. You always keep the work that's actually your business.

The three service models

IaaS

Infrastructure as a Service

You rent raw building blocks — virtual machines, disks, networks — and manage the OS and everything above it. Maximum control, maximum responsibility.

Like leasing an empty apartment: walls and plumbing provided, you furnish it.

PaaS

Platform as a Service

You push code; the platform runs it — handling the OS, runtime, patching, and scaling. Less control, far less ops.

Like a serviced apartment: you just move in and live there.

SaaS

Software as a Service

You just use finished software over the web — Gmail, Slack, Salesforce. The provider runs all of it; you only manage your data and users.

Like a hotel: someone else owns and runs everything.

02 · Compute — VMs, containers, serverless 6 min

Three ways to run code,
from a whole machine to one function.

Compute is where your code actually executes. The cloud gives you a spectrum: rent a whole virtual machine and manage it yourself, package your app into a lightweight container, or hand the provider a single function and forget servers entirely. Each step right means less control but less to operate.

Compute the processing capacity (CPU + memory) that runs your application code. The three common shapes are virtual machines (a full simulated computer), containers (your app plus its dependencies, isolated but sharing the host OS), and serverless functions (code the provider runs on demand). For the depth on the middle two, see Docker & Containers and Kubernetes.
more control · you operate it less ops · provider operates it Virtual machine full OS · you patch & scale it guest OS your app minutes to boot Container shares host OS · ships fast app app app seconds to start Serverless one function · scales to zero fn fn fn milliseconds · pay per call

Same code can run on any of these — the choice is how much of the machine you want to think about.

The honest trade-off

  • VMs— total control of the OS, any software, predictable performance. You own patching, scaling, and the idle cost when it's underused.
  • Containers — package once, run anywhere; start in seconds, pack many per host. The sweet spot for most modern apps — usually orchestrated by Kubernetes.
  • Serverless — zero servers to mind, scales to zero, pay per request. Pays for spiky or low traffic; cold starts and execution limits bite steady high-volume workloads.
// serverless: you ship ONLY this — no server, no OS export async function handler(event) { const name = event.query.name ?? "world" return { status: 200, body: `hello, ${name}`, } } // idle? it scales to zero. spike? the platform adds copies.

No main(), no port to bind, no fleet to size — the provider runs this on demand and bills per invocation.

Reach for a VM when

You need a specific OS or kernel, legacy software, GPUs, or steady predictable load where always-on is cheapest.

Reach for containers when

You want portability, fast deploys, and dense packing — the default for microservices and most web backends today.

Reach for serverless when

Traffic is spiky or low, or it's glue: webhooks, cron jobs, event handlers, lightweight APIs at the edge.

03 · Storage — object, block, file 4 min

Three storage shapes for
three different jobs.

Not all storage is the same. Picking the wrong kind is a common, costly mistake — so it's worth knowing the three primitives every cloud offers and exactly what each is for: object for files at scale, block for disks, and file for shared folders.

The three primitives object storage holds whole files addressed by a key, block storage is a raw virtual disk attached to a machine, and file storage is a shared filesystem mounted by many machines. Databases are a layer on top of these; analytics warehouses (covered in the data decks) read columnar files straight out of object storage.
Object

Files at internet scale

bucket img/cat.png backups/db.sql.gz video/intro.mp4

Cheap, effectively infinite, reached over HTTP by key. No editing in place — you replace the whole object.

Use — images, video, backups, logs, static sites, data lakes.

S3 · Cloud Storage · Azure Blob

Block

A raw disk for one machine

VMinstance volume/dev/sda attach

Behaves like a physical hard drive: format it, mount it, read and write blocks. Attached to one instance at a time.

Use— a VM's boot disk, databases, anything needing low-latency random writes.

EBS · Persistent Disk · Azure Disk

File

A shared folder for many

share/mnt/data VM VM VM

A managed network filesystem (NFS / SMB) many machines mount at once, sharing the same directory tree.

Use — shared assets, lift-and-shift apps that expect a POSIX path, content directories.

EFS · Filestore · Azure Files

One rule of thumb

Default to object storage— it's the cheapest and scales without limit. Reach for block only when a single machine needs a disk (a database, a boot volume), and file only when several machines must share one filesystem. Storage also comes in tiers: hot for frequent access, cold/archive for data you rarely read — moving stale data to a colder tier is one of the easiest ways to cut a bill.

04 · Networking — regions, zones, VPCs, load balancing 5 min

Where your servers live,
and how traffic finds them.

Cloud resources live somewhere physical and talk over a virtual network you control. Four ideas cover almost everything: regions and availability zones (geography), the VPC (your private network), and the load balancer (the traffic cop). The wire-level primitives are in Networking.

Region & availability zone a region is a geographic area (e.g. Frankfurt); an availability zone is one isolated data center within it, with its own power and cooling. You spread instances across multiple zones so a single data-center failure can't take you down — the bedrock of high availability.
Region · eu-central-1 VPC · 10.0.0.0/16 load balancer Zone A · subnet app app data center 1 Zone B · subnet app app data center 2

One VPC spanning two zones. The load balancer spreads requests across both, so losing a whole data center just removes half the targets.

Read the picture

  • VPC (Virtual Private Cloud) — your own isolated network in the cloud, with a private IP range you choose. Nothing gets in or out except through rules you set.
  • Subnets slice the VPC per zone. Public subnets can reach the internet; private ones hold databases and stay hidden.
  • Security groupsare per-instance firewalls — "allow 443 from anywhere, 5432 only from the app tier."
  • Load balancer — one stable address that health-checks your instances and spreads traffic across the healthy ones.
Availability

Run across ≥2 zones behind a load balancer and a single data center failing is a non-event. This is the cheapest reliability win in the cloud.

Latency

Put compute in the region closest to your users. A CDN caches static content at edge locations worldwide so it loads from nearby.

Don't click it by hand

Networks get complex fast. Define them as code with Infrastructure as Code so they're reviewable and repeatable.

05 · Security & the shared-responsibility model — IAM 5 min

The cloud is secure.
Your part of it is on you.

The single most important security idea in the cloud is knowing where the provider's job ends and yours begins. Get that line wrong and you leave the door open. The tool you use to lock things down is IAM — and the rule there is one word: least privilege.

Shared-responsibility model the provider secures the cloud (hardware, data centers, virtualization); you secure what you put in it (your data, access, configuration, and code). Almost every cloud breach is a customer-side misconfiguration — a public storage bucket, a leaked key, an over-permissive role — not the provider being hacked.
YOU secure your data identity & access (IAM) app code & config network rules · encryption in the cloud PROVIDER secures physical data centers host OS & virtualization network hardware global infrastructure of the cloud

The exact line shifts by service — more managed (PaaS, SaaS) moves more onto the provider — but your data and access are always yours to protect.

IAM, in one breath

IAMIdentity and Access Management — controls who (a principal: user, group, or role) can do what (an action) on which resource. A policy is the document that grants it.
principaluser / role policyallow action resourcebucket / db
Over-permissive — the classic breach
{ "Effect": "Allow", "Action": "*", // every action… "Resource": "*" // …on every resource } // one leaked key now owns the whole account.
Least privilege — grant only what's needed
{ "Effect": "Allow", "Action": ["s3:GetObject"], // read only "Resource": "arn:aws:s3:::reports/*" // one bucket } // a leak here exposes one bucket's reports, nothing else.
Least privilege

Grant the minimum, widen only when something genuinely breaks. Start from deny, not allow all.

Roles, not keys

Give workloads short-lived role credentials instead of long-lived access keys baked into code.

MFA + encryption

Multi-factor on every human login; encrypt data at rest and in transit — usually a single toggle.

Audit by default

Turn on access logging early. You can't investigate an incident you never recorded.

06 · How cloud pricing actually works 5 min

Pay-as-you-go is simple.
The surprises are in the details.

Cloud billing is usage-based: you pay for compute by the second, storage by the gigabyte-month, and — the part that ambushes everyone — data transfer out by the gigabyte. Knowing the four ways to buy compute, and where the hidden charges hide, is how you keep the bill sane.

Egress the charge for data leaving the provider's network toward the internet or another region. Data in (ingress) is almost always free; data outcosts real money. It's the line item that turns a cheap-looking architecture into an expensive one — so move bytes thoughtfully and cache at the edge.
# a rough monthly bill — note where the money goes compute = 730 h × $0.04 # one small on-demand VM storage = 100 GB × $0.023 # object storage (per GB-month) egress = 500 GB × $0.09 # data OUT ← the surprise ingress = 500 GB × $0.00 # data IN is free # ───────────────────────────── total ≈ $29 + $2.3 + $45 # egress > the server itself
your cloud internet users in · free out · $$$ egress is the line people forget

Bytes flow in free and out at a price — here the egress dwarfs the actual server.

Four ways to buy compute

On-demand

Full price, full flexibility

Pay by the second, no commitment, drop it anytime. The default — great for unpredictable or short-lived workloads.

Pro — zero commitment. Con — the most expensive per hour.

Reserved · Savings Plan

Commit, save big

Promise 1–3 years of usage for a steep discount (often 40–70%). Best for your steady, always-on baseline.

Pro — large, predictable savings. Con— you're locked in.

Spot · Preemptible

Cheap, but interruptible

Buy spare capacity at up to ~90% off — but the provider can reclaim it with minutes of warning. For fault-tolerant, restartable work.

Pro — cheapest by far. Con — can vanish anytime.

Free tier

Learn without a bill

A small always-free allowance plus time-limited credits. Great for learning — but set a budget alertso a mistake can't snowball.

Pro — start at $0. Con — easy to drift past the limits.

Keep the bill honest

  • Turn off what you're not using — idle VMs and unattached disks bill 24/7. Most waste is just forgotten resources.
  • Cover the baseline with commitments, the spikes on-demand, and push batch work to spot.
  • Watch egress and cross-region traffic — keep chatty services in the same zone and cache static content at the edge.
  • Set budgets and alerts on day one. The worst bills are the ones nobody was watching.
07 · AWS vs GCP vs Azure & choosing + recap 5 min

Three big providers,
mostly the same shapes.

AWS, Google Cloud, and Microsoft Azure offer the same primitives under different names. The building blocks you just learned transfer directly — only the labels change. Pick one and go deep; chasing multi-cloud early usually buys complexity, not freedom.

The same map, three legends compute, storage, databases, and serverless exist on all three clouds with equivalent capabilities. Learn the concepts once and you can read any provider's docs. The tabs below line up the service names so the equivalence is obvious.

Service-name map

AWS

EC2 for VMs · ECS / EKS for containers.

Google Cloud

Compute Engine for VMs · GKE for containers.

Azure

Virtual Machines · AKS for containers.

AWS

S3 (object) · EBS (block) · EFS (file).

Google Cloud

Cloud Storage · Persistent Disk · Filestore.

Azure

Blob Storage · Managed Disks · Azure Files.

AWS

RDS / Aurora (SQL) · DynamoDB (NoSQL).

Google Cloud

Cloud SQL / Spanner · Firestore (NoSQL).

Azure

Azure SQL · Cosmos DB (NoSQL).

AWS

Lambda (functions) · Fargate (serverless containers).

Google Cloud

Cloud Functions · Cloud Run (containers).

Azure

Azure Functions · Container Apps.

Honest pros, cons & how to choose

AWS

Pro — the broadest, most mature catalog; the biggest community and hiring pool.

Con — sheer breadth is overwhelming; the console and pricing can feel sprawling.

Choose when you want the widest service selection and the deepest ecosystem and docs.

Google Cloud

Pro — strong data, analytics, ML, and Kubernetes (its birthplace); clean DX.

Con — smaller service catalog; some products change or retire faster.

Choose when data/ML or containers are central, or you already lean on Google tooling.

Azure

Pro — deep Microsoft integration (AD, Office, Windows); strong enterprise sales.

Con — the portal and naming can be inconsistent; best value tied to the MS stack.

Choosewhen you're a Microsoft / Windows / enterprise shop with existing licensing.

About multi-cloud — spreading across two providers to avoid lock-in sounds prudent, but early on it usually means double the tooling, the lowest common denominator of features, and a team that's expert in neither. Pick one cloud, learn it well, and keep your core logic provider-agnostic. Revisit multi-cloud only when a concrete need — regulation, acquisition, real resilience requirements — forces it.

Five things to walk out with

1The cloud is rented capacity. IaaS / PaaS / SaaS just decide how much of the stack the provider manages for you.
2Know the building blocks. Compute (VM → container → serverless), storage (object / block / file), and the VPC are the vocabulary of every cloud.
3Security is shared — and your half matters most. Least privilege in IAM and a closed-by-default network prevent almost every breach.
4Watch the bill, especially egress. Turn off idle resources, commit to your baseline, and set budget alerts on day one.
5Pick one provider and go deep. The concepts transfer; skip multi-cloud until a real need forces it.
  • No strong reason either way? → AWS — the widest catalog and the biggest pool of docs, tutorials, and hireable expertise.
  • Data, analytics, or ML is the heart of it? → Google Cloud.
  • Already a Microsoft / enterprise shop? → Azure, to reuse identity and licensing.
  • Just learning? → Any one of them. Use the free tier, set a budget alert, and build something small end-to-end.
Knowledge check

Did it stick?

Five quick questions on service models, compute, storage, security, and pricing — instant feedback, no sign-in.

Rate this deck
be the first

Navigate with ← → or scroll · back to library