Cloud Fundamentals

Introduction

Cloud computing is now a core part of modern IT infrastructure. Even organisations that still operate traditional data centres usually have some connection to AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, SaaS applications or other cloud services. For someone entering IT or cybersecurity, understanding cloud technology is therefore no longer optional.

However, working in cloud environments is not simply about knowing how to create a virtual machine. Engineers need to understand how cloud environments are organised, how identities receive permissions, how networks are segmented, how applications communicate, how data is stored, how Internet access is controlled, how organisations connect cloud networks to traditional data centres, how administrators monitor cloud environments, how cloud resources are secured, how organisations prevent uncontrolled spending, and how the same concepts differ between AWS, Azure and Google Cloud.

Learning Objectives

By the end of this module, you should be able to explain what cloud computing is, understand IaaS/PaaS/SaaS, explain public/private/hybrid/multi-cloud architectures, understand regions and availability zones, explain the shared responsibility model, recognise the major services in AWS/Azure/GCP, deploy a basic cloud VM, understand cloud storage and IAM (including workload identities), explain Security Groups/NSGs/firewall rules, understand VPCs/VNets and subnets, explain Internet gateways/NAT/VPNs/private connectivity, understand hybrid cloud, recognise legacy technologies being migrated to cloud, identify common cloud security mistakes, understand how large organisations structure their cloud environments, and deploy and secure a basic cloud workload yourself.

1☁️ What Is Cloud Computing?

Cloud computing means consuming computing resources from a provider rather than owning and operating all the underlying physical infrastructure yourself. Instead of purchasing physical servers, storage arrays, network switches, firewalls, racks, power, cooling and data centre space, a company could create a virtual machine in AWS, Azure or Google Cloud within minutes.

The cloud provider operates the physical infrastructure. The customer controls the services they deploy on top of it.

In reality, many large organisations use both — a corporate data centre connected via VPN/private connection to a cloud environment. This is hybrid cloud.

2💰 Why Companies Use Cloud Computing

Faster Deployment

Purchasing a physical server could historically mean requesting budget, ordering hardware, waiting for delivery, installing it, configuring networking and storage, installing an OS, patching it, and installing the application — weeks or months. A cloud VM can often be provisioned in minutes.

Scalability

Cloud platforms allow resources to increase or decrease according to demand. An online retailer might run 10 application servers normally, scale to 50 during a major sale, then back to 10 afterwards — instead of permanently owning enough hardware for peak traffic.

Global Reach

Cloud providers operate data centres around the world, so global organisations can deploy services closer to their customers (London users → European region, Singapore users → Asian region, US users → North American region), improving latency, resilience, disaster recovery and customer experience. This also introduces considerations around data residency, privacy, regulatory requirements, cross-border data transfers, and encryption.

Cost Model

Traditional infrastructure is often associated with capital expenditure (CapEx) — buying infrastructure upfront. Cloud environments typically rely more on operational expenditure (OpEx) — resources consumed and billed over time (VM hours, storage GB, database requests, bandwidth). Cloud can reduce some costs, but is not automatically cheaper — poorly governed cloud environments can become extremely expensive. This has driven the growth of FinOps, which focuses on managing and optimising cloud expenditure.

3📈 IaaS, PaaS and SaaS

One of the most important cloud concepts is understanding what part of the technology stack the provider manages.

The exact responsibility model varies by service.

4🤝 Shared Responsibility Model

One of the biggest misconceptions beginners have:

"If it's in the cloud, the cloud provider secures everything."

This is incorrect. Cloud security is based around shared responsibility. AWS describes this as security of the cloud versus security in the cloud — with EC2, AWS operates the underlying cloud infrastructure, while the customer remains responsible for guest OS patching, credentials, security groups and IAM permissions.

If a company creates a Windows server in AWS but never installs security patches, that is generally the customer's responsibility. If an administrator creates an inbound rule allowing TCP 3389 from 0.0.0.0/0 and exposes Windows RDP to the entire Internet, the cloud provider did not create that insecure configuration — the customer did. The same principle exists across Azure and Google Cloud.

5🌐 Public, Private, Hybrid and Multi-Cloud

6🗺️ Regions and Availability Zones

Cloud infrastructure exists in physical locations around the world. Providers divide infrastructure into geographical regions (UK, Germany, Ireland, US, Canada, India, Singapore, Japan, Australia, etc.), then design separate infrastructure locations within each region for resilience — AWS and Azure call these Availability Zones; Google Cloud uses regions and zones.

Instead of one server in London, an organisation might run application servers across Availability Zones A, B and C within the Europe region — if one data centre location fails, workloads in the others can continue.

7🌐 AWS – Amazon Web Services

AWS is one of the world's largest cloud computing platforms. Students do not need to memorise hundreds of AWS products — learn the core services and understand what problem each one solves.

EC2

Elastic Compute Cloud provides virtual machines known as instances. When creating one, administrators select the OS, instance size, storage, network, subnet, Security Group, IAM role, SSH key, and public/private IP configuration. Typical operating systems: Amazon Linux, RHEL, Ubuntu, SUSE, Windows Server.

AWS provides different instance families optimised for general workloads, CPU-intensive, memory-intensive, storage, GPU, or ML workloads. Choosing the correct size is known as rightsizing.

AWS VPC

A Virtual Private Cloud (VPC) is an isolated logical network — conceptually, a traditional network's cloud equivalent. A VPC has an IP range (e.g. 10.10.0.0/16), with subnets created inside it for public web, application, and database tiers, letting workloads be separated by function and security requirement.

AWS Security Groups

A Security Group acts as a virtual firewall for resources like EC2 instances, controlling inbound/outbound traffic. AWS Security Groups are stateful. Example: allow HTTPS (443) from 0.0.0.0/0, but SSH (22) only from 10.50.0.0/16 — the Internet can reach the web server over HTTPS, but cannot SSH to it.

AWS IAM

IAM controls permissions inside AWS: who are you, what are you allowed to do, which resources can you access. Key concepts: users, groups, roles, policies, permissions, trust relationships. Modern enterprise environments commonly combine AWS Organizations with IAM Identity Center rather than creating many permanent standalone IAM users per account — AWS recommends enabling IAM Identity Center with Organizations for organisation-wide environments.

Allow: s3:GetObject
Resource: company-reports/*
# Identity can read objects inside company-reports

IAM policies can become extremely detailed — this is why IAM engineering is an entire career specialisation.

AWS Enterprise Architecture

Small environments might contain one account; large companies usually use many, e.g. an AWS Organization split into Security (Security Tooling, Log Archive), Production (Banking App, Customer Portal), Development (Dev, Testing), and Infrastructure (Networking, Shared Services). AWS Organizations and services such as Control Tower establish central governance across accounts and organisational units.

8☁️ Microsoft Azure

Azure is extremely common in enterprises already using Microsoft 365, Windows Server, Active Directory, Microsoft Entra ID, SQL Server, PowerShell, .NET, or Microsoft security products.

Resource Hierarchy

An Azure subscription provides a management and billing boundary — large organisations frequently have several (Production, Development, Testing, Networking, Security, Shared Services). Resources are normally organised inside Resource Groups (e.g. CustomerPortal-RG containing VMs, SQL, storage, and a VNet), and operations can often be managed at the Resource Group level.

Azure VMs, VNet and NSGs

Azure Virtual Machines provide Windows or Linux servers — when deploying one, engineers configure region, availability, VM size, OS, disk, network, subnet, NSG, identity, and management configuration. Azure's network service is the Virtual Network (VNet), e.g. 10.20.0.0/16 split into web, application, and database subnets.

Network Security Groups (NSGs) control traffic via rules specifying source, destination, port, protocol, allow/deny, and priority, and can be associated with subnets and VM network interfaces — e.g. priority 100, allow Internet → web subnet on port 443.

Azure Identity: Entra ID vs RBAC

This area regularly confuses beginners. Microsoft Entra ID controls identities — users, groups, applications, service principals, managed identities (previously called Azure Active Directory / Azure AD, so both names appear in enterprise environments). Azure RBAC determines what an identity can do to Azure resources — e.g. a user with "Virtual Machine Contributor" on a Resource Group can manage VMs there, while a user with "Reader" can only view.

Applications should avoid storing permanent usernames, passwords and API secrets wherever possible. Azure supports managed identities, letting Azure workloads authenticate to supported services using identities managed by Azure rather than credentials embedded in application code (Microsoft distinguishes system-assigned and user-assigned managed identities) — e.g. an Azure VM authenticating to Azure Storage via its managed identity instead of a username and password. This is significantly easier to secure and rotate.

Blob Storage is Azure's most commonly encountered storage model, useful for images, backups, videos, application files, logs and archives — access can be controlled using Microsoft Entra identities and Azure RBAC.

9🌐 Google Cloud Platform – GCP

Google Cloud is widely used for application hosting, Kubernetes, data analytics, machine learning, large-scale data processing, and cloud-native workloads.

Projects are extremely important in GCP — resources normally belong to a project. Google's primary VM platform is Compute Engine, conceptually similar to EC2/Azure VMs, configured with machine type, CPU, memory, OS, disk, VPC, subnet, firewall, service account, and external/internal IP.

GCP also uses the term VPC, but its architecture differs — one important difference is that Google Cloud VPC networks can span regions, while subnets are regional. Don't assume identical terminology means identical architecture.

Google Cloud does not use AWS-style Security Groups — instead, VPC firewall rules control traffic using direction, priority, protocol, ports, source, destination, target, network tags, and service accounts. Google documents these as distributed controls enforced for VM network interfaces, and also supports hierarchical firewall policies for organisation-level governance.

Google Cloud IAM controls access via Principal + Role + Resource, e.g. Alice with "Compute Viewer" on Project A. Roles contain permissions; Google provides predefined, basic, and custom roles — least privilege should always be preferred, and IAM explicitly supports granular resource access and custom roles where predefined roles are too broad.

Google Cloud commonly uses service accounts for applications and workloads — a service account represents a workload rather than a human user. An application VM might hold a service account with "Storage Object Viewer" permission, letting it read objects without a developer embedding their own admin credentials in the application.

10⚖️ Comparing AWS, Azure and GCP

Students should learn mappings between providers.

A cloud engineer should be able to translate requirements between these platforms.

11🖥️ Virtual Machines

Virtual machines remain one of the most important cloud technologies. Even though containers and serverless computing are increasingly common, huge numbers of enterprise workloads still run on VMs — Windows application servers, AD domain controllers, Linux application servers, legacy Java applications, databases, vendor appliances, monitoring servers, security tools, and jump servers.

The customer interacts with the VM but usually has no access to the physical hardware. Important sizing characteristics include vCPU, memory, storage performance, network performance, GPU, and architecture — oversizing wastes money, undersizing causes performance problems.

VMs are usually created from an image (Windows Server, Ubuntu, RHEL, Amazon Linux), and companies also create custom images baking in patches, EDR, monitoring, certificates, and security configuration so every new server starts from an approved baseline.

Cloud migrations frequently begin with lift-and-shift — a Windows/IIS/.NET/SQL application running in VMware might simply be recreated as a cloud VM, allowing rapid migration without necessarily using cloud-native technologies. Later the company might modernise: VM application → containers → managed Kubernetes, or VM application → managed app platform.

12🗃️ Cloud Storage

Traditional enterprise environments commonly contain SAN, NAS, Fibre Channel, iSCSI, Windows file servers, NFS and SMB — these haven't disappeared, and cloud engineers frequently need to migrate or integrate them (e.g. on-premises NAS → cloud file storage).

Common storage security controls: encryption at rest and in transit, IAM permissions, private endpoints, access logging, backup, versioning, retention policies, and replication. One of the most common cloud security failures historically has been accidentally exposing object storage publicly — default to private, grant only required identities access, and avoid anonymous public access unless genuinely required.

13🔑 Identity and Access Management (IAM)

IAM is one of the most important areas of cloud security. Traditional networks were often heavily focused on the perimeter (Internet → Firewall → Trusted Network). Modern cloud security increasingly focuses on identity: Identity → Authentication → Authorization → Resource. If an attacker steals powerful cloud credentials, they may not need to attack the network perimeter at all.

Authentication asks "who are you?" Authorization asks "what are you allowed to do?" Example: Alice logs in with MFA (authentication succeeds), then attempts to delete a production database; IAM checks her permissions, and if she only has "Database Reader," the deletion is denied (that's authorization).

Least privilege means giving identities only the permissions required to perform their job — not "everyone = administrator," but Help Desk gets password-reset permissions, Developers get the development environment, the Security Team gets security logs, the Database Team gets database management.

Modern cloud environments contain both human identities (administrators, developers, analysts, help desk) and machine identities (applications, VMs, containers, automation scripts, CI/CD pipelines, functions) — increasingly described as workload identities, non-human identities, or service identities. These must also be secured.

Legacy applications frequently contain long-lived credentials (AWS_ACCESS_KEY_ID, passwords, service-account.json) stored in source code, config files, scripts, or even committed to Git and shared between engineers — dangerous. Modern approaches prefer AWS IAM Roles, Azure Managed Identities, and Google Service Accounts/Workload Identity, where short-lived credentials are issued dynamically. Administrative accounts should normally use strong MFA, since attackers frequently target cloud administrators, developers, service accounts, API keys, and session tokens.

14🛡️ Security Groups and Cloud Firewalls

Network controls vary between cloud providers.

# AWS Security Group
WebServer-SG
INBOUND
443 TCP  Source: 0.0.0.0/0
22  TCP  Source: 10.10.10.0/24

# Azure NSG
WebServer-NSG
Priority 100: Allow TCP 443, Internet -> WebServer
Priority 200: Allow TCP 22, AdminSubnet -> WebServer

# GCP firewall rule
allow-web
Direction: Ingress
Source: 0.0.0.0/0
Target: web-server
Protocol: TCP 443

15🌐 Cloud Networking

Cloud networking uses many of the same principles covered in Module 3 — IP addresses, CIDR, routing, NAT, DNS, firewalls, subnets, VPNs. The major difference is that networking is largely software-defined.

10.50.0.0/16
   |
   +-- Web Subnet 10.50.1.0/24 -- Web Server
   +-- App Subnet 10.50.2.0/24 -- App Server
   +-- DB Subnet  10.50.3.0/24 -- Database

A public subnet workload might have a route allowing Internet connectivity (Internet → Cloud Internet Gateway → Public Subnet → Web Server). Database systems should generally sit in a private subnet with no direct inbound Internet access — instead Internet → Web Server → Application Server → Database, with the Internet unable to reach the database directly.

Private systems sometimes still need outbound Internet access (to download updates, for example) without accepting unsolicited inbound connections — that's what NAT provides. Cloud routers still rely on routing-table concepts (10.50.0.0/16 → Local, 0.0.0.0/0 → Internet Gateway, or 10.0.0.0/8 → Corporate VPN).

Cloud environments heavily depend on DNS — managed services like Route 53, Azure DNS, and Google Cloud DNS. Private DNS is also important, e.g. database.internal.company.com resolving only inside the company's private networks.

16🔗 Connecting Cloud to Corporate Networks

Global companies rarely operate cloud environments in complete isolation:

A site-to-site VPN is an encrypted tunnel connecting networks over the Internet (on-prem firewall → encrypted IPsec tunnel → cloud VPN gateway), commonly used for smaller environments, backup connectivity, rapid deployments, and development environments. Large enterprises may instead use dedicated private connectivity — AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect — for private connectivity between corporate infrastructure and the cloud. Microsoft's current ExpressRoute guidance also emphasises identity controls for the management plane and least-privilege administration around circuits, gateways and route configuration.

17🔗 Hub-and-Spoke Networking

Large cloud environments frequently use hub-and-spoke architectures:

with Production VNet and Shared Services also attached to the hub. The central hub might contain firewalls, VPN gateways, DNS, inspection appliances, routing, and proxy services — preventing every application team from designing completely independent connectivity.

18🔁 Hybrid Identity

Cloud migration does not necessarily mean abandoning traditional Active Directory:

Applications might still depend on Kerberos, NTLM, LDAP, and Windows domain membership, while newer applications use OAuth 2.0, OpenID Connect, SAML, and workload identities. Engineers entering enterprise environments need to understand both generations.

19⌛ Legacy Technologies in Cloud Environments

Many beginners imagine cloud companies run only modern technologies. They don't. A global company may simultaneously operate a mainframe, Windows Server 2012-era applications alongside 2016/2019/2022/2025 systems, legacy Java, Oracle databases, SQL Server, VMware, Active Directory, LDAP, SMB, NFS — and also Kubernetes, serverless functions, cloud APIs, managed databases, SaaS, and Infrastructure as Code. IT professionals frequently work between these environments.

Example migration of a legacy payment application (Windows Server + IIS + SQL Server + Active Directory):

Cloud transformation usually happens gradually.

20🎯 Enterprise Cloud Governance

Creating one VM is easy. Managing 50,000 cloud resources is not. Global organisations require governance.

Naming standards: instead of server1, test123, use conventions like uk-lon-prod-web-001. Tags/labels add metadata — Environment=Production, Application=Payments, Owner=PaymentsTeam, CostCentre=CC3420, DataClassification=Confidential — helping with billing, ownership, automation, security, and compliance.

Organisations may implement policies such as "do not allow public storage," "do not create resources outside approved regions," "all disks must be encrypted," "production resources require backups," or "Internet-facing systems require approved security controls" — cloud governance platforms can enforce many of these automatically.

Large organisations frequently create a landing zone — the approved cloud architecture established before application teams begin deploying workloads, covering organisation hierarchy, identity, networking, logging, security, policies, billing, monitoring, DNS, and approved regions. Cloud platforms provide AWS Control Tower, Azure Landing Zones, and Google Cloud enterprise foundations for this.

21🔍 Logging and Monitoring

Cloud activity must be logged. Important sources: AWS CloudTrail/CloudWatch, Azure Activity Log/Monitor/Log Analytics, GCP Cloud Audit Logs/Logging/Monitoring. Security teams may forward these into a SIEM such as Microsoft Sentinel, Splunk, Google Security Operations, Elastic, or QRadar.

Cloud audit logs allow security teams to reconstruct exactly what happened.

22💾 Cloud Backups and Disaster Recovery

Cloud does not eliminate the need for backups. If an administrator accidentally deletes a database, the infrastructure may be highly available but the data has still been deleted. Organisations require backups, snapshots, retention, replication, and recovery procedures.

Critical systems might use multi-region disaster recovery: a primary region (London) replicating to a secondary region, so operations can fail over if the primary experiences major problems.

23💻 Infrastructure as Code

Modern cloud environments increasingly avoid engineers manually creating everything through web portals. Instead infrastructure is described in code — Terraform, AWS CloudFormation, Azure Bicep, ARM Templates, or Google's infrastructure tooling:

network = 10.50.0.0/16
subnet = 10.50.1.0/24
server = Linux
allow_https = true

Automation then builds the environment. Benefits: repeatability, code review, version control, automation, and consistency.

24⚠️ Cloud Security Threats

25🔒 Zero Trust and Cloud

Modern cloud security increasingly follows Zero Trust principles. Instead of assuming "inside the network = trusted," the organisation continuously evaluates identity, device, location, risk, requested resource, and permissions before deciding whether access should be allowed. Identity has therefore become one of the most important cloud security boundaries.

26🧩 Cloud Support Troubleshooting

Suppose: "the application cannot connect to the database." Do not immediately reboot servers.

Test-NetConnection 10.10.2.20 -Port 1433   # PowerShell
nc -vz 10.10.2.20 1433                     # Linux

Then determine whether the failure is DNS, routing, firewall, service, authentication, or application. This exact troubleshooting method applies across traditional and cloud environments.

27💻 Cloud CLI Tools

Cloud engineers should eventually become comfortable working outside graphical portals. Major CLI tools: AWS CLI, Azure CLI (az), Google Cloud CLI (gcloud):

aws ec2 describe-instances
az vm list
gcloud compute instances list

Students do not need to memorise every command. Enterprise automation increasingly uses CLI, APIs, PowerShell, Python, Terraform, and CI/CD rather than manual portal operations.

28🔗 APIs and Cloud Infrastructure

Nearly everything in modern cloud platforms can be controlled through APIs. When you click "Create Virtual Machine" in a portal, the portal itself ultimately interacts with cloud APIs — meaning infrastructure can also be created by Terraform, PowerShell, Python, a CI/CD pipeline, or an automation platform. This relationship becomes particularly important later when learning APIs, PowerShell and DevOps.

🏢 Enterprise Example

Imagine a multinational bank:

Identity: Active Directory → Microsoft Entra ID → Cloud Federation → AWS/Azure/GCP. Security: MFA, Conditional Access, Cloud IAM, PAM, SIEM, EDR, firewalls, WAF, DLP, logging. Networking: MPLS/SD-WAN, VPN, ExpressRoute, Direct Connect, Cloud Interconnect.

This combination of old and new technology is much closer to what engineers encounter in large enterprises than an entirely cloud-native demonstration environment.

Lab🚀 Required Lab — Deploy a Cloud Web Server

ssh user@PUBLIC_IP

sudo apt update
sudo apt upgrade
sudo apt install nginx
systemctl status nginx

sudo systemctl stop nginx

journalctl -u nginx

Lab🏗️ Optional Extension — Three-Tier Application

Lab🔗 Optional Extension — Hybrid Lab

Lab🔍 Security Exercise — Find the Problems

VM Public IP: YES
Firewall: 22/0.0.0.0/0, 3389/0.0.0.0/0, 443/0.0.0.0/0, 445/0.0.0.0/0
IAM: Administrator
Storage: Public
MFA: Disabled

Lab🔍 Troubleshooting Exercise

🧠 Interview Questions

Students should be able to answer the following. Click each one you're confident you can explain out loud.

1. 1What is cloud computing?
2. 2What is the difference between IaaS, PaaS and SaaS?
3. 3What is the shared responsibility model?
4. 4What is a cloud region? What is an availability zone?
5. 5What is a VPC? What is a subnet?
6. 6What's the difference between a public and private subnet?
7. 7What is AWS EC2? Azure Virtual Machines? Google Compute Engine?
8. 8What is object storage? How does it differ from block and file storage?
9. 9What is IAM? What is least privilege?
10. 10What's the difference between authentication and authorization?
11. 11What is a workload identity?
12. 12What is an AWS IAM role? An Azure Managed Identity? A GCP service account?
13. 13What is an AWS Security Group? An Azure NSG?
14. 14How does GCP control VM network traffic?
15. 15What is NAT?
16. 16What is a site-to-site VPN?
17. 17What is hybrid cloud? What is multi-cloud?
18. 18What is Infrastructure as Code?
19. 19Why should production databases normally not be directly exposed to the Internet?
20. 20What's the difference between RPO and RTO?
21. 21What is a landing zone?
22. 22What is FinOps?
23. 23What is lift-and-shift?
24. 24What is hub-and-spoke networking?
25. 25What does Zero Trust mean in a cloud context?
26. 26What's the difference between AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect?
27. 27Why do enterprises tag/label cloud resources?
28. 28What would you check first if an app can't reach its database?

🚫 Common Beginner Mistakes

What Students Should Remember

Do not try to memorise hundreds of cloud services. Understand the architecture.

And around all of them: security, logging, monitoring, governance, backup, automation. If you understand these layers, moving between AWS, Azure and GCP becomes much easier — the product names change, the underlying engineering principles largely remain the same.

Module Summary

Cloud infrastructure now forms a major part of global enterprise IT. AWS, Azure and Google Cloud each provide broadly equivalent capabilities for compute, networking, storage, identity, databases, security, monitoring and automation — but the terminology, resource hierarchy and defaults differ enough that you need to consciously translate between them.

Students should also recognise that enterprise environments rarely consist entirely of cloud-native technology. A real global company may simultaneously operate AWS, Azure, GCP, Microsoft 365, Active Directory, VMware, Windows, Linux, Oracle, SQL Server, mainframes, SaaS, Kubernetes, APIs, and legacy applications. Cloud engineers, support engineers and cybersecurity professionals therefore need to understand how modern cloud services integrate with traditional infrastructure.

The most important skills are not memorising cloud product names. They are understanding networking, identity, permissions, compute, storage, security, logging, troubleshooting, and automation. Those skills transfer between almost every technology you'll encounter throughout your career.