Cloud Platforms (AWS / Azure / GCP)

Analogy: Cloud is like electricity from the grid.
You don't build your own power plant to run your house.
You plug in, use what you need, and pay for what you consume.
Before cloud: buy servers, rack them, cool them, hire ops teams.
After cloud:  API call → server running in 60 seconds. Pay per hour.

IaaS (Infrastructure as a Service):
  You manage: OS, runtime, app, data
  Provider manages: hardware, networking, virtualization
  Example: EC2, Azure VMs, GCE

PaaS (Platform as a Service):
  You manage: app, data
  Provider manages: OS, runtime, infrastructure
  Example: Heroku, Google App Engine, AWS Elastic Beanstalk

SaaS (Software as a Service):
  You manage: your usage
  Provider manages: everything
  Example: Gmail, Salesforce, Slack

# Launch an EC2 instance (AWS CLI)
aws ec2 run-instances \
  --image-id ami-0c02fb55956c7d316 \  # Amazon Linux 2 AMI
  --instance-type t3.micro \            # CPU/RAM configuration
  --key-name my-keypair \
  --security-group-ids sg-0123456789 \
  --subnet-id subnet-0123456789 \
  --count 1

# Connect via SSH
ssh -i "my-keypair.pem" ec2-user@<public-ip>

ASG Configuration:
  Min: 2 instances (always running)
  Max: 20 instances (never exceed)
  Desired: 5 (current target)
  Scale-out trigger: CPU > 70% for 5 minutes → add 2 instances
  Scale-in trigger: CPU < 30% for 10 minutes → remove 1 instance

# Create bucket
aws s3 mb s3://my-app-assets-prod

# Upload file
aws s3 cp ./image.jpg s3://my-app-assets-prod/uploads/image.jpg

# Sync directory
aws s3 sync ./build/ s3://my-website-bucket/ --delete

# Make public (for static website hosting)
aws s3 website s3://my-website-bucket --index-document index.html

# Pre-signed URL (temporary access without credentials)
aws s3 presign s3://my-bucket/private-file.pdf --expires-in 3600

# Create PostgreSQL RDS instance
aws rds create-db-instance \
  --db-instance-identifier mydb \
  --db-instance-class db.t3.medium \
  --engine postgres \
  --engine-version 15.3 \
  --master-username admin \
  --master-user-password "SecurePass123!" \
  --allocated-storage 100 \  # GB
  --storage-type gp3 \
  --multi-az \               # automatic failover to standby in another AZ
  --backup-retention-period 7 # 7 days of automated backups

Primary DB (read + write) → Read Replica 1 (read-only)
                          → Read Replica 2 (read-only)
Your app directs: all WRITES to primary, read-heavy queries to replicas

# lambda_function.py — triggered by API Gateway
import json
import boto3

def lambda_handler(event, context):
    # event contains the HTTP request data
    body = json.loads(event.get("body", "{}"))
    name = body.get("name", "World")

    # Can use AWS SDK to call other services
    dynamodb = boto3.resource("dynamodb")
    table = dynamodb.Table("greetings")
    table.put_item(Item={"id": context.aws_request_id, "name": name})

    return {
        "statusCode": 200,
        "headers": {"Content-Type": "application/json"},
        "body": json.dumps({"message": f"Hello, {name}!"})
    }

Without CDN: User in India → US East server (200ms round trip)
With CDN:    User in India → Mumbai edge (10ms round trip) → cache hit

CloudFront Edge Locations: 450+ worldwide

# Create CloudFront distribution for an S3 static site
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-root-object index.html

VPC (e.g., 10.0.0.0/16):
  ├── Public Subnet (10.0.1.0/24) — Internet Gateway attached
  │     └── EC2 instances with public IPs (web servers, load balancers)
  └── Private Subnet (10.0.2.0/24) — No direct internet access
        ├── EC2 instances (app servers) — access internet via NAT Gateway
        └── RDS instances (databases) — never exposed to internet

# Allow HTTPS from anywhere, SSH only from your IP
aws ec2 create-security-group --group-name web-sg --description "Web server"
aws ec2 authorize-security-group-ingress --group-id sg-xxx \
  --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-xxx \
  --protocol tcp --port 22 --cidr YOUR-IP/32

// IAM Policy: allow reading from S3 bucket, nothing else
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ]
  }]
}