Click any module to expand. AWS is the primary cloud (65% market share) with Azure as the enterprise complement. Every module is hands-on: students build on REAL cloud accounts using free tiers. The module is aligned with AWS Solutions Architect Associate (SAA-C03) and Azure Administrator (AZ-104) certification paths.
Cloud models, shared responsibility, global infrastructure, and the economics of cloud
IaaS (Infrastructure as a Service): you manage OS and up — EC2, Azure VMs. PaaS (Platform as a Service): you manage code only — Elastic Beanstalk, Azure App Service, Heroku. SaaS (Software as a Service): you use the product — Gmail, Salesforce, Slack. FaaS (Function as a Service): serverless — Lambda, Azure Functions. The model determines what YOU manage vs what the cloud provider manages.
Cloud provider: physical security, networking, hypervisor, storage. YOU: data encryption, identity management, application security, OS patching (for IaaS), network configuration. The most misunderstood concept: "We're on AWS so we're secure" is WRONG — misconfiguration is the #1 cloud breach cause. "Security OF the cloud" (AWS) vs "Security IN the cloud" (you).
Regions (33+): geographical locations with multiple data centres. Availability Zones (AZs): isolated data centres within a region (2–6 per region). Edge Locations (600+): CDN cache points for CloudFront. Choosing a region: latency (closest to users), compliance (data residency — India's DPDP Act), service availability, cost. Multi-AZ for high availability: if one AZ fails, the other serves traffic.
CapEx (buy servers) → OpEx (pay for what you use). Pricing models: on-demand, reserved instances (1–3 year commit → 40–72% discount), spot instances (up to 90% discount but can be interrupted), savings plans. AWS Free Tier: 12 months free for many services (750 hours EC2 t2.micro/month, 5GB S3). Students build on free tier — no credit card charges if managed correctly. Cost awareness from day one.
EC2, S3, RDS, DynamoDB — the services every AWS user must master
Launch an instance: choose AMI (Amazon Machine Image), instance type (t3.micro free tier), key pair, security group. Instance families: General Purpose (t3, m6i), Compute Optimised (c6i), Memory Optimised (r6i), GPU (p4d, g5). SSH access. User data scripts for bootstrapping. Elastic IPs. Auto Scaling Groups: automatically add/remove instances based on load. "Design a highly available web tier" — the classic AWS architecture question.
Buckets and objects. Storage classes: Standard (frequent access), Intelligent-Tiering (auto-optimise), Glacier (archival — minutes to hours retrieval). Versioning. Lifecycle policies: move to cheaper storage after N days. Static website hosting on S3. Pre-signed URLs for temporary access. S3 event notifications → Lambda (event-driven). "Store unlimited data at pennies per GB" — S3 is the most used AWS service. Hands-on: host a static website on S3 with CloudFront CDN.
RDS: managed MySQL, PostgreSQL, SQL Server, Oracle. Managed = AWS handles patching, backups, failover. Multi-AZ: automatic failover for high availability. Read replicas: offload read traffic to copies. Aurora: AWS-built MySQL/PostgreSQL compatible, 5x faster, auto-scaling storage. Parameter groups. Encryption at rest (KMS) and in transit (TLS). "You NEVER run databases on EC2 in production" — use RDS/Aurora.
Key-value and document database. Single-digit millisecond latency at any scale. Tables, items, attributes. Primary key: partition key or partition key + sort key. Read/write capacity: on-demand (pay per request) vs provisioned. Global Secondary Indexes (GSI). DynamoDB Streams for event-driven processing. DAX for caching. When to use DynamoDB (high scale, simple queries, key-value) vs RDS (complex queries, joins, transactions).
ElastiCache: managed Redis or Memcached for caching. Use cases: session store, API response caching, leaderboards. Amazon OpenSearch: managed Elasticsearch for full-text search and log analytics. Amazon MemoryDB: Redis-compatible durable database. Data service selection: "I need..." structured relational → RDS/Aurora, key-value at scale → DynamoDB, caching → ElastiCache, full-text search → OpenSearch.
Building secure, scalable network architectures on AWS
VPC: your isolated network on AWS. CIDR blocks (10.0.0.0/16). Subnets: public (internet-accessible via Internet Gateway) vs private (no direct internet — use NAT Gateway). Route tables: control traffic flow. Internet Gateway for public access. NAT Gateway: let private instances access internet (for updates) without being directly exposed. VPC Peering for connecting VPCs. "Design a VPC with public and private subnets" — the #1 AWS architecture interview question.
Security Groups: stateful firewall at instance level — allow inbound port 80 (HTTP), 443 (HTTPS), 22 (SSH from your IP only). Default: deny all inbound, allow all outbound. NACLs (Network ACLs): stateless firewall at subnet level — rules evaluated in order. Security Group vs NACL: SG is per-instance (stateful), NACL is per-subnet (stateless). Layered security: NACL → Security Group → Application. The defence-in-depth network approach.
Users, groups, roles, policies. Policy structure: Effect (Allow/Deny) + Action (s3:GetObject) + Resource (arn:aws:s3:::my-bucket/*). Principle of least privilege: grant minimum permissions needed. IAM Roles for EC2 (instance profiles — never put access keys on instances). Cross-account access with roles. MFA for root and admin users. "Review this IAM policy and identify the security risk" — the cloud security interview exercise.
Application Load Balancer (ALB): HTTP/HTTPS, path-based routing (/api → backend, / → frontend), host-based routing. Network Load Balancer (NLB): TCP/UDP, ultra-low latency, millions of requests per second. Target groups: EC2 instances, Lambda, IPs. Health checks: unhealthy targets removed automatically. Route 53: managed DNS — domain registration, routing policies (simple, weighted, latency-based, failover). CloudFront: CDN for global caching.
Run code without servers — the paradigm that eliminates infrastructure management
Lambda: upload code → runs on demand → pay only for execution time (millisecond billing). Runtimes: Python, Node.js, Java, Go, .NET. Triggers: API Gateway (HTTP), S3 (file upload), DynamoDB Streams, SQS, EventBridge. Memory: 128MB–10GB (more memory = more CPU). Cold starts: first invocation is slower. Concurrency: automatic scaling. Lambda Layers for shared libraries. "Process 10,000 images without provisioning a single server" — the serverless promise.
API Gateway: create REST/HTTP APIs that invoke Lambda. Resource-based routes: /users, /products/{id}. Request validation, throttling, API keys. Stages: dev, staging, prod. CORS configuration. WebSocket APIs for real-time. Building a complete serverless REST API: API Gateway → Lambda → DynamoDB — zero servers to manage. The architecture pattern powering most serverless applications.
SQS (Simple Queue Service): message queue for decoupling services (producer → queue → consumer). SNS (Simple Notification Service): pub/sub for fan-out (one event → multiple consumers). EventBridge: event bus for routing events between services. Step Functions: orchestrate multi-step workflows (order processing: validate → charge → ship → notify). Event-driven = loosely coupled, scalable, resilient. The architecture pattern behind modern cloud-native applications.
Patterns: API backend (API Gateway + Lambda + DynamoDB), file processing (S3 upload → Lambda → transform → save), scheduled tasks (EventBridge rule → Lambda), stream processing (Kinesis/DynamoDB Streams → Lambda). Limitations: 15-minute max execution, cold starts (mitigated with Provisioned Concurrency), vendor lock-in, debugging complexity. When serverless fits (event-driven, variable load, quick MVPs) vs when containers are better (long-running, predictable load, complex orchestration).
Package, deploy, and scale applications with containers
Containers: lightweight, isolated environments with application + dependencies. Docker vs VMs: containers share the host OS kernel (faster, smaller). Dockerfile: FROM → RUN → COPY → EXPOSE → CMD. Multi-stage builds: builder stage (compile) → runtime stage (slim image). docker build, docker run, docker push. Docker Compose: multi-container applications (app + database + cache). .dockerignore. The packaging standard for every cloud deployment.
ECR (Elastic Container Registry): AWS-managed Docker registry. Push images: docker push to ECR. ECS (Elastic Container Service): AWS-managed container orchestration. Task definitions: container image, CPU/memory, ports, environment variables. Fargate: serverless containers — no EC2 instances to manage. ECS + Fargate = run containers without managing infrastructure. When to use ECS (simpler, AWS-native) vs EKS (Kubernetes, portable).
Kubernetes (K8s): open-source container orchestration. Concepts: Pods (smallest unit), Deployments (manage replicas), Services (networking), Ingress (external access), ConfigMaps/Secrets (configuration). kubectl: command-line tool. YAML manifests: declarative infrastructure. Self-healing: restart failed containers. Rolling updates: zero-downtime deployments. Horizontal Pod Autoscaler. K8s is the industry standard for container orchestration — used at Google, Spotify, Airbnb.
EKS (Elastic Kubernetes Service): AWS-managed Kubernetes control plane. Node groups: EC2 instances running your pods. Fargate profiles: serverless pods (no nodes to manage). Helm: Kubernetes package manager — install complex applications (Prometheus, Grafana, Nginx Ingress) with one command. Helm charts for your own applications. EKS + Helm = production Kubernetes without managing the control plane.
Define, version, and automate cloud infrastructure — never click in the console again
Manual console clicking: unrepeatable, undocumented, error-prone, un-auditable. IaC: define infrastructure in code files → version control → review → apply. Benefits: reproducibility (same infra in dev/staging/prod), disaster recovery (rebuild from code), collaboration (PRs for infra changes), compliance (audit trail). IaC is the foundation of DevOps — without it, cloud management doesn't scale.
HCL (HashiCorp Configuration Language): resource "aws_instance" "web" { ... }. Providers: AWS, Azure, GCP, Kubernetes — one tool for all clouds. Core workflow: terraform init → plan (preview changes) → apply (create resources) → destroy. State file: tracks what Terraform manages. Remote state: S3 backend for team collaboration. Modules: reusable infrastructure components. Variables and outputs. Data sources for reading existing resources.
Building a complete environment: VPC + subnets + security groups + ALB + EC2 Auto Scaling + RDS — all in Terraform. Module structure: modules/vpc, modules/compute, modules/database. terraform.tfvars for environment-specific values. Workspaces for dev/staging/prod. State locking with DynamoDB. terraform import for existing resources. Hands-on: provision entire 3-tier architecture with one "terraform apply."
CloudFormation: AWS-native IaC with YAML/JSON templates. Stacks, change sets, rollback. Nested stacks for modularity. AWS CDK (Cloud Development Kit): write infrastructure in TypeScript/Python → generates CloudFormation. CDK constructs: higher-level abstractions. When to use Terraform (multi-cloud, existing team knowledge) vs CloudFormation (AWS-only, deeper AWS integration) vs CDK (developers who prefer code over YAML).
Automate build, test, and deployment — the pipeline that turns code into production
Continuous Integration: every code push → build → test automatically. Continuous Delivery: every passing build CAN be deployed (manual approval). Continuous Deployment: every passing build IS deployed automatically. CI/CD benefits: faster releases, fewer bugs (caught by automated tests), smaller deployments (less risk). "How does your team deploy code?" — the DevOps interview question every engineer should answer well.
Workflows: .github/workflows/ci.yml triggered on push/PR. Jobs: build, test, deploy running in parallel or sequence. Steps: actions/checkout, setup-node, npm test, docker build, deploy. Secrets: store API keys, cloud credentials securely. Matrix builds: test on multiple OS/versions. Reusable workflows. Self-hosted runners for private infrastructure. GitHub Actions is the most popular CI/CD platform — free for public repos.
CodePipeline: orchestrate source → build → test → deploy stages. CodeBuild: managed build service (docker build, npm test). CodeDeploy: deploy to EC2, ECS, Lambda with rollback. Blue/green deployment: run two environments, switch traffic. Canary deployment: route 10% traffic to new version, monitor, then 100%. AWS-native CI/CD for teams fully invested in AWS ecosystem.
GitOps: Git as the single source of truth for both code AND infrastructure. ArgoCD: Kubernetes GitOps — changes in Git automatically sync to cluster. Deployment strategies: rolling (gradual replacement), blue/green (instant switch), canary (gradual traffic shift), A/B testing. Rollback strategies: automatic rollback on health check failure. Feature flags: decouple deployment from release. The modern deployment workflow that reduces risk.
If you can't measure it, you can't manage it — monitoring production cloud systems
CloudWatch Metrics: CPU utilisation, memory, disk, network, custom metrics. CloudWatch Alarms: alert when CPU > 80% → trigger Auto Scaling or SNS notification. CloudWatch Logs: centralise application logs, search, filter, metric filters. CloudWatch Dashboards: visualise key metrics. CloudTrail: audit trail of ALL API calls — who did what, when (security and compliance). "Your app is slow — how do you diagnose it?" — CloudWatch is step one.
Prometheus: open-source metrics collection and alerting (the Kubernetes monitoring standard). Pull-based: scrapes /metrics endpoints. PromQL: powerful query language for metrics. Grafana: beautiful dashboards for visualising Prometheus metrics. Pre-built dashboards for Kubernetes, Node.js, PostgreSQL. Alertmanager: route alerts to Slack, PagerDuty, email. Prometheus + Grafana = the open-source monitoring stack used alongside or instead of CloudWatch.
Centralised logging: aggregate logs from all services into one searchable platform. ELK Stack: Elasticsearch (search engine) + Logstash (log pipeline) + Kibana (visualisation). AWS OpenSearch Service: managed ELK. Structured logging: JSON logs with timestamp, service, level, trace_id. Log-based alerting: error rate > threshold → alert. Distributed tracing: trace a request across microservices (AWS X-Ray, Jaeger). "Logs + metrics + traces" = the three pillars of observability.
Azure core services, cost optimisation, and designing across multiple clouds
Azure VMs = EC2. Azure Blob Storage = S3. Azure SQL Database = RDS. Azure Virtual Network = VPC. Azure AD / Entra ID = IAM (but identity-centric, not resource-centric). Azure App Service = Elastic Beanstalk (PaaS, easier). Azure Functions = Lambda. Azure Kubernetes Service (AKS) = EKS. Learning Azure through AWS mappings: same concepts, different names. Azure is the enterprise cloud — dominant in Microsoft-stack companies and government.
Cost visibility: AWS Cost Explorer, Azure Cost Management — understand WHERE money goes. Right-sizing: downgrade over-provisioned instances (t3.xlarge → t3.medium saves 50%). Reserved/Savings Plans: 40–72% savings for predictable workloads. Spot/preemptible instances for fault-tolerant workloads. S3 Intelligent-Tiering: automatic storage cost optimisation. Tag everything: cost allocation by team/project/environment. "How would you reduce this cloud bill by 40%?" — the FinOps interview question.
Multi-cloud: use AWS + Azure + GCP together (avoid vendor lock-in, use best-of-breed). Hybrid cloud: on-premises + cloud (AWS Outposts, Azure Arc). When multi-cloud makes sense (compliance, best services from each) vs when it doesn't (complexity, team overhead). Terraform for multi-cloud IaC. Kubernetes as the portable compute layer. "Should we go multi-cloud?" — the architecture decision every enterprise faces.
SageMaker, Bedrock, Azure AI — and designing production-grade cloud architectures
SageMaker: managed ML platform — data labelling, training, tuning, deployment. SageMaker Studio: Jupyter-like IDE for ML. SageMaker Endpoints: deploy models as APIs with auto-scaling. Amazon Bedrock: access foundation models (Claude, LLaMA, Titan) via API — build GenAI apps without managing infrastructure. Amazon Rekognition (image/video), Comprehend (NLP), Textract (OCR). The managed AI stack for companies that don't want to manage GPUs.
Azure OpenAI Service: GPT-4, DALL-E, Whisper — enterprise-grade with Azure's compliance and security. Azure AI Studio: build, evaluate, deploy AI apps. Azure Cognitive Services: pre-built AI APIs (vision, speech, language). Google Vertex AI: managed ML with AutoML. Google Cloud AI Platform: TensorFlow/PyTorch training. Choosing AI cloud: AWS (broadest ML ecosystem), Azure (OpenAI integration, enterprise), GCP (TensorFlow, TPUs).
AWS Well-Architected Framework's 6 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability. Design patterns: multi-tier (web → app → database), microservices (independent services + API Gateway), event-driven (queues + serverless), data lake (S3 + Glue + Athena). "Design a scalable, fault-tolerant e-commerce platform on AWS" — the architecture capstone exercise.
AWS SAA-C03 (Solutions Architect Associate): the most valued cloud certification. Study plan: this module covers 80%+ of SAA-C03 topics. Azure AZ-900 (Fundamentals) / AZ-104 (Administrator): enterprise cloud certifications. Practice exams: Tutorials Dojo, Stephane Maarek. Portfolio: GitHub with Terraform code, architecture diagrams (draw.io), deployed applications on AWS. "AWS Certified Solutions Architect" on your resume opens doors at every company.
VPC with public/private subnets, ALB, Auto Scaling EC2 group, RDS PostgreSQL, S3 for static assets, CloudFront CDN, Route 53 DNS — all provisioned with Terraform.
API Gateway + Lambda + DynamoDB — building a complete CRUD API with JWT auth, CI/CD with GitHub Actions, monitoring with CloudWatch, and IaC with SAM/CDK.
Dockerise a microservices app, deploy to EKS with Helm charts, Ingress controller, HPA, Prometheus + Grafana monitoring, ArgoCD GitOps.
Build a GenAI application using Amazon Bedrock (Claude/LLaMA), RAG with OpenSearch, Lambda for orchestration, deployed as a serverless chatbot.
Students work on real AWS accounts (free tier). Every concept is immediately practised: launch EC2, create VPC, write Terraform, deploy to EKS. Not slides — live cloud consoles and terminals.
Weekly architecture challenges: "Design a scalable video streaming platform" "How would you build a ride-sharing backend?" Draw diagrams, justify choices, present to the class.
Every project includes a cost estimate. Students learn to check billing dashboards, set budget alarms, right-size instances. FinOps habits from day one — not an afterthought.
Module aligns with AWS SAA-C03. Weekly practice questions. Mock exams. Students graduate ready to sit the certification — and pass.
Cloud Engineer, DevOps Engineer, SRE, Platform Engineer — these roles at TCS, Infosys, Wipro (cloud practices), Amazon, Flipkart, and startups offer ₹8–25L+ packages. Cloud migration projects are worth billions — every service company needs cloud-certified engineers. The demand-supply gap is massive.
AWS Solutions Architect Associate is the most valued cloud certification globally. It's listed as "preferred" or "required" in 60%+ of cloud job postings. This module covers 80%+ of SAA-C03 content. A certified student with hands-on project experience is immediately hireable. Certification + portfolio > either alone.
Every AI application runs on cloud infrastructure. SageMaker for ML training, Bedrock for GenAI, GPU instances for deep learning. Cloud engineers who understand AI services bridge the gap between ML teams and infrastructure teams — the most valuable cross-functional profile in 2025–26 tech.
Java, Python, Node.js, .NET — every full-stack application deploys to AWS/Azure. Cloud knowledge makes ANY developer more valuable. Backend developers who can provision RDS and configure VPCs, frontend developers who can deploy to CloudFront + S3 — cloud skills amplify every other technical skill.
E-305, Industrial Area, Sahibzada Ajit Singh Nagar, Punjab 160055, IN
