Identity is the main security perimeter in the cloud. Principles Least privilege: grant only the permissions required. Use roles rather than long-lived keys. Enforce multi-factor authentication. Separate duties between environments. Human access Federate with the organisation’s identity provider and use single sign-on. Grant time-limited elevated access for administrative tasks. Workload identity Applications should use managed […]

Infrastructure as code defines cloud resources in version-controlled files. Benefits Repeatable environments, peer review of changes, audit history and faster recovery. Declarative tools Describe the desired state; the tool calculates changes. Provider-native templates and multi-cloud tools are common. State Many tools keep a state file mapping code to real resources. Store it remotely with locking […]

Containers package applications with dependencies; Kubernetes orchestrates them at scale. Containers Build small images from trusted base images, run as non-root users and scan images for vulnerabilities. Kubernetes concepts Pods: one or more containers scheduled together. Deployments: manage replicas and rolling updates. Services: stable network endpoints. Ingress: routes external traffic. ConfigMaps and Secrets: configuration. Namespaces: […]

Pipelines make changes consistent and safe. Application pipelines Build, test, scan, package and deploy to environments in sequence, with automated checks. Infrastructure pipelines Validate and lint code, run security policy checks, produce a plan, require approval for production and apply. Environments Promote the same artefact through development, test and production, changing only configuration. Policy as […]

Observability lets engineers understand system behaviour from outside. Signals Metrics: numeric measurements over time. Logs: event records. Traces: request paths through services. Golden signals Latency, traffic, errors and saturation. Alerting Alert on symptoms that affect users, not every internal fluctuation. Include runbooks with alerts. Service level objectives Define targets and error budgets for key user […]

Cloud systems must tolerate failures of instances, zones and sometimes regions. High availability Run across multiple availability zones with load balancing and health checks. Use managed services with built-in replication. Recovery objectives Recovery time objective is how quickly service must be restored; recovery point objective is how much data loss is acceptable. DR strategies Backup […]

Cloud engineers influence costs every day. Visibility Tag resources by owner, environment and application. Use cost reports and anomaly alerts. Optimisation Right-size instances, use autoscaling, schedule non-production shutdowns, choose appropriate storage tiers and delete unused resources. Commitment discounts Use reserved or committed-use pricing for steady workloads. Architecture choices Serverless and managed services can reduce costs […]