Unit 1: Cloud Computing Fundamentals - Subjective Questions

Cloud computing is a model that provides convenient, on-demand network access to a shared pool of configurable computing resources such as servers, storage, networks, applications, and services. These resources can be rapidly provisioned and released with minimal management effort.

The essential characteristics are:

• On-demand self-service: Users can provision resources automatically without direct interaction with the service provider.
• Broad network access: Services are accessible over a network using standard mechanisms and different client devices.
• Resource pooling: Physical and virtual resources are shared among multiple users through a multi-tenant model.
• Rapid elasticity: Resources can be scaled up or down quickly according to workload requirements.
• Measured service: Resource consumption is monitored and billed based on usage.

These characteristics make cloud computing flexible, scalable, and cost-effective compared with traditional IT infrastructure.

Cloud services are commonly classified into three models:

• Infrastructure as a Service (IaaS): Provides virtual machines, storage, and networking. The provider manages physical infrastructure, while the customer manages the operating system, middleware, and applications. Examples include Amazon EC2 and OpenStack Nova.
• Platform as a Service (PaaS): Provides an application development and deployment platform. The provider manages infrastructure, operating systems, and runtime environments. Developers mainly manage application code and data. Examples include AWS Elastic Beanstalk and Google App Engine.
• Software as a Service (SaaS): Delivers complete applications through a web browser or API. The provider manages the entire technology stack. Examples include Salesforce, Google Workspace, and Microsoft 365.

The level of customer control decreases from IaaS to SaaS, while the provider's management responsibility increases.

• Public cloud: Infrastructure is owned and operated by a third-party provider and shared by many customers. It offers high scalability and low initial cost but provides less direct control. Example: AWS.
• Private cloud: Infrastructure is dedicated to a single organization. It may be hosted on-premises or by a third party. It provides greater control, customization, and security but requires higher investment and management effort.
• Hybrid cloud: Combines public and private clouds with integration between them. Sensitive workloads may remain in the private cloud, while variable workloads use the public cloud.
• Community cloud: Infrastructure is shared by organizations with common security, regulatory, or operational requirements, such as government agencies or healthcare institutions.

The choice depends on cost, scalability, control, compliance, data sensitivity, and workload characteristics.

Cloud resource utilization aims to maximize efficiency while meeting performance requirements. Important guiding principles include:

• Resource pooling: Combine computing capacity into shared pools instead of maintaining isolated hardware for every application.
• Elasticity: Add or remove resources dynamically according to demand.
• Automation: Use policies and orchestration tools to provision, configure, monitor, and release resources.
• Multi-tenancy: Allow multiple customers to share infrastructure while maintaining logical isolation.
• Right-sizing: Select resource capacities appropriate to the workload rather than consistently overprovisioning.
• Load balancing: Distribute requests across instances to avoid hotspots and improve availability.
• Measured usage: Monitor CPU, memory, storage, and network consumption for optimization and billing.
• Energy efficiency: Consolidate workloads and shut down idle resources where possible.

These principles improve utilization, reduce cost, and prevent both underprovisioning and overprovisioning.

Resource utilization is the proportion of available resource capacity that is actively used during a given period.

If is the used capacity and is the total allocated capacity, utilization is:

For example, if a virtual machine uses 6 virtual CPUs out of 8 allocated virtual CPUs:

If useful output is and consumed resources are , efficiency can be represented as:

For a pay-per-use resource, if is the quantity of resource consumed and is its unit price, total cost is:

Utilization should not always be forced to , because spare capacity may be required to absorb demand spikes and satisfy availability or latency targets.

Service-Oriented Architecture (SOA) is an architectural approach in which business functionality is organized as reusable, interoperable, and loosely coupled services accessed through well-defined interfaces.

Major SOA principles include:

• Loose coupling: Consumers depend on service contracts rather than internal implementations.
• Standardized contracts: Services expose consistent interfaces, message formats, and policies.
• Reusability: A service can support multiple applications and business processes.
• Autonomy: Each service controls its logic and resources within its boundary.
• Abstraction: Internal implementation details are hidden from consumers.
• Discoverability: Service descriptions can be published and located.
• Composability: Multiple services can be combined into larger business workflows.

Core components are the service provider, service consumer, service contract, optional service registry, and communication infrastructure such as an enterprise service bus or API gateway.

SOA and microservices both decompose applications into services, but they differ in scope and implementation.

• Service size: SOA services are often coarse-grained business services, while microservices are smaller and focused on specific capabilities.
• Communication: Traditional SOA may use SOAP and an enterprise service bus. Microservices commonly use lightweight REST, gRPC, or asynchronous messaging.
• Data management: SOA solutions may share enterprise databases, whereas microservices generally favor decentralized data ownership.
• Deployment: SOA services may be deployed as part of larger platforms. Microservices are independently deployable.
• Governance: SOA often uses centralized governance, while microservices favor decentralized team ownership and automation.
• Fault isolation: Microservices emphasize independent scaling and failure containment.

Cloud computing supports both through on-demand infrastructure, managed databases, messaging, containers, auto-scaling, monitoring, API management, and automated deployment pipelines.

Important cloud computing applications include:

• Data storage and backup: Scalable object storage, file storage, archival, and disaster recovery.
• Web and mobile applications: Elastic hosting of websites, APIs, and mobile back ends.
• Software development and testing: Rapid creation of temporary development, testing, and continuous integration environments.
• Big data analytics: Processing large datasets using distributed storage and computing services.
• Artificial intelligence: Access to machine learning platforms, GPUs, and pre-trained AI services.
• Healthcare: Secure storage of medical records, telemedicine, and medical-image analysis.
• Education: Virtual classrooms, learning management systems, and shared research platforms.
• Internet of Things: Device registration, message ingestion, stream processing, and remote monitoring.
• Business applications: Customer relationship management, enterprise resource planning, and collaboration.
• Media services: Video transcoding, streaming, and global content delivery.

Cloud adoption in each domain must consider security, privacy, cost, latency, availability, and regulatory requirements.

Designing a public cloud environment involves the following steps:

1. Assess requirements: Identify workloads, users, traffic patterns, availability targets, compliance needs, and budget.
2. Select regions and availability zones: Choose locations that satisfy latency, resilience, and data residency requirements.
3. Design networking: Create virtual networks, subnets, routing tables, gateways, load balancers, and firewall rules.
4. Choose compute services: Select virtual machines, containers, serverless functions, or managed platforms.
5. Design storage and databases: Match block, file, object, relational, or NoSQL services to workload needs.
6. Implement identity and security: Apply least-privilege access, encryption, key management, logging, and secrets management.
7. Plan scalability and resilience: Use auto-scaling, health checks, redundancy, backups, and disaster recovery.
8. Automate deployment: Use infrastructure as code and continuous delivery pipelines.
9. Enable monitoring and governance: Configure metrics, alerts, audit logs, budgets, tagging, and policy enforcement.

The final design should balance performance, security, reliability, operational simplicity, and cost.

A private cloud provides cloud-like services on infrastructure dedicated to one organization. Its design and implementation involve:

• Requirement analysis: Determine capacity, workloads, security, compliance, and service-level objectives.
• Hardware planning: Select servers, storage systems, network switches, and redundant power infrastructure.
• Virtualization layer: Install a hypervisor such as KVM, VMware ESXi, or Hyper-V.
• Cloud management platform: Deploy software such as OpenStack to provide self-service provisioning and centralized control.
• Network architecture: Design management, tenant, storage, and external networks with proper segmentation.
• Storage architecture: Provide block, object, and file storage with replication and backup.
• Identity and security: Integrate directory services, role-based access control, encryption, and audit logging.
• Automation and orchestration: Use templates and configuration-management tools for repeatable deployment.
• Operations: Establish monitoring, patching, metering, capacity management, and disaster recovery procedures.

A private cloud offers greater control and customization, but the organization remains responsible for procurement, maintenance, upgrades, staffing, and capacity planning.

• Ownership: Public cloud infrastructure belongs to a provider, while private cloud infrastructure is dedicated to one organization.
• Capital expenditure: Public cloud usually has low initial expenditure and usage-based billing. Private cloud requires hardware and data-center investment.
• Scalability: Public cloud offers rapid access to large resource pools. Private cloud is limited by installed capacity.
• Control: Private cloud provides greater control over hardware, networking, and platform configuration.
• Operations: Public cloud providers maintain physical infrastructure. Private cloud operators must manage hardware, cloud software, upgrades, and failures.
• Security: Both can be secure, but responsibilities differ. Private clouds provide direct control, while public clouds provide mature managed security services.
• Compliance: Private clouds may simplify strict data-location or isolation requirements, although certified public cloud services can also satisfy many regulations.
• Availability: Public clouds provide multiple regions and availability zones. Private clouds need deliberate redundancy across local facilities.
• Cost model: Public cloud uses operational expenditure, while private cloud combines capital and operational costs.

The appropriate choice depends on workload demand, compliance, existing infrastructure, skills, control requirements, and total cost of ownership.

OpenStack is an open-source cloud computing platform used primarily to build and manage private or public Infrastructure as a Service environments.

Major OpenStack services include:

• Nova: Manages compute instances and coordinates with hypervisors.
• Neutron: Provides virtual networks, subnets, routers, security groups, and floating IP addresses.
• Cinder: Provides persistent block storage volumes.
• Swift: Provides distributed object storage.
• Glance: Stores and manages virtual machine images.
• Keystone: Provides authentication, authorization, service discovery, projects, users, and roles.
• Horizon: Offers a web-based administrative and self-service dashboard.
• Heat: Provides template-based orchestration of infrastructure resources.
• Telemetry services: Collect measurements, events, and resource usage information.

OpenStack uses modular services connected through APIs and message queues, allowing organizations to customize the cloud according to their requirements.

A simplified OpenStack instance-launch workflow is:

1. The user submits a launch request through Horizon, a command-line client, or an API.
2. Keystone authenticates the user and verifies project permissions.
3. The request reaches the Nova API service.
4. Nova validates the requested image, flavor, key pair, and security configuration.
5. The Nova scheduler selects a suitable compute host based on capacity and scheduling policies.
6. Glance supplies the selected virtual machine image or its location.
7. Neutron creates or attaches network ports, assigns addresses, and applies security groups.
8. If persistent block storage is requested, Cinder creates or attaches the required volume.
9. The Nova compute service instructs the hypervisor, such as KVM, to create and start the instance.
10. Status information is stored and returned to the user. A floating IP may be associated for external access.

This workflow demonstrates coordination among loosely coupled OpenStack services through APIs, databases, and messaging.

• Virtualization: A hypervisor divides a physical compute host into multiple virtual machine instances. OpenStack Nova manages these instances but normally relies on hypervisors such as KVM for execution.
• Multi-tenancy: OpenStack allows multiple projects or tenants to share the same physical infrastructure. Keystone organizes users, roles, projects, and access permissions.
• Compute isolation: Hypervisor boundaries separate virtual machines from one another.
• Network isolation: Neutron provides isolated tenant networks using VLANs, overlay networks, routing, security groups, and network namespaces.
• Storage isolation: Cinder volumes and Swift objects are associated with authorized projects and protected by access policies.
• Administrative isolation: Role-based access control limits operations according to user responsibilities.
• Usage tracking: Quotas prevent a tenant from consuming excessive shared capacity.

Together, these mechanisms improve resource utilization while maintaining security and predictable access in a shared cloud.

Major AWS services include:

• Amazon EC2: Provides resizable virtual machine instances.
• Amazon S3: Provides durable and scalable object storage.
• Amazon EBS: Provides persistent block storage for EC2 instances.
• Amazon VPC: Creates logically isolated networks with subnets, routing, and security controls.
• Elastic Load Balancing: Distributes traffic across multiple targets.
• Amazon RDS: Provides managed relational databases.
• Amazon DynamoDB: Provides a managed NoSQL key-value database.
• AWS Lambda: Runs event-driven functions without direct server management.
• Amazon ECS and Amazon EKS: Manage containerized applications.
• AWS IAM: Controls users, roles, policies, and access permissions.
• Amazon CloudWatch: Provides metrics, logs, alarms, and monitoring.
• AWS CloudFormation: Creates and manages infrastructure using templates.

These services can be combined to create secure, scalable, highly available, and automated cloud applications.

A highly available AWS web application can be designed as follows:

1. Create an Amazon VPC across at least two Availability Zones.
2. Place an internet-facing Application Load Balancer in public subnets.
3. Deploy application instances or containers in private subnets across multiple Availability Zones.
4. Configure an Auto Scaling group to add or remove instances according to demand and replace unhealthy instances.
5. Use Amazon RDS Multi-AZ for a managed relational database with standby failover, or use DynamoDB where appropriate.
6. Store static files and user objects in Amazon S3.
7. Use Amazon CloudFront to cache and distribute static content globally.
8. Provide outbound access from private subnets through redundant NAT gateways when required.
9. Apply security groups, network controls, IAM roles, encryption, and AWS Web Application Firewall.
10. Use CloudWatch, CloudTrail, and centralized logs for monitoring and auditing.
11. Configure backups, versioning, and a tested disaster recovery strategy.

The multi-zone architecture removes single points of failure, while load balancing and auto-scaling improve availability and elasticity.

• Platform type: OpenStack is open-source cloud management software. AWS is a provider-operated public cloud platform.
• Deployment: Organizations install OpenStack on their own or hosted infrastructure. AWS services are consumed from AWS regions.
• Ownership: OpenStack users may own and control the hardware. AWS owns and operates the underlying infrastructure.
• Customization: OpenStack provides extensive infrastructure and source-level customization. AWS offers service configuration but not control over its internal platform.
• Operations: OpenStack requires the organization to manage installation, capacity, upgrades, and hardware failures. AWS manages physical facilities and cloud service operations.
• Scalability: OpenStack capacity depends on installed hardware. AWS provides access to a very large global resource pool.
• Cost: OpenStack has no mandatory platform license fee but involves hardware and operational costs. AWS generally charges according to consumption and service pricing.
• Service portfolio: AWS provides a broad set of managed services. OpenStack focuses mainly on infrastructure services, although it can integrate with additional platforms.

OpenStack is suitable where control, customization, or on-premises deployment is important, while AWS is suitable when rapid provisioning and managed services are priorities.

The shared responsibility model divides security and operational duties between the cloud provider and the customer.

AWS is responsible for security of the cloud, including:

• Physical data centers and environmental controls
• Hardware, storage devices, and network infrastructure
• The virtualization layer
• Maintenance of underlying infrastructure
• Availability and security of managed service platforms

The customer is responsible for security in the cloud, including:

• Identity and access management
• Data classification and protection
• Application security
• Network and firewall configuration
• Guest operating system patching for IaaS instances
• Encryption choices and key permissions
• Logging, monitoring, and regulatory configuration

The exact division depends on the service model. Customers manage more components when using EC2 and fewer infrastructure components when using managed services such as RDS or SaaS applications. However, customers always remain responsible for their data and access decisions.

Assume every day contains hours.

Static provisioning:

To support peak demand, the system keeps 30 virtual machines active throughout the day:

Therefore, static provisioning consumes 720 instance-hours per day.

Elastic provisioning:

Ten virtual machines run throughout the day, and 20 additional virtual machines run only during the 4-hour peak period:

Therefore, elastic provisioning consumes 320 instance-hours per day.

The daily saving is:

The percentage reduction is:

Thus, elastic provisioning reduces consumption by approximately 55.56%, assuming instant scaling and identical per-instance pricing.

A hybrid cloud strategy is suitable because it combines private control with public-cloud elasticity.

A possible implementation plan is:

1. Assess and classify workloads: Identify sensitive data, regulatory constraints, dependencies, performance needs, and migration risks.
2. Retain sensitive components privately: Host regulated databases and critical systems in a private cloud or on-premises environment.
3. Move scalable application tiers: Deploy web servers, APIs, batch jobs, or analytics workloads in the public cloud.
4. Establish secure connectivity: Use encrypted VPN connections or dedicated private links between environments.
5. Integrate identity: Apply federated authentication, single sign-on, least privilege, and consistent role-based access.
6. Protect data: Use encryption in transit and at rest, tokenization, key management, and data-loss prevention controls.
7. Design service interfaces: Expose on-premises functionality through secure, versioned APIs rather than direct database access.
8. Implement cloud bursting: Scale suitable stateless workloads into the public cloud during demand peaks.
9. Automate deployment: Use infrastructure as code, configuration management, and continuous delivery.
10. Monitor and govern both environments: Centralize logs, metrics, security alerts, cost reports, and compliance evidence.
11. Migrate incrementally: Begin with low-risk workloads, test performance and recovery, and refine the architecture before migrating critical services.

This approach preserves control over sensitive data while gaining scalability and managed capabilities from the public cloud.