Cloud & Infrastructure
Running software you cannot reach with your hands — the three clouds, Terraform, containers, CI/CD, and knowing what it costs before the invoice says so.
- Cloud fundamentals — regions, IAM, and the shared responsibility modelThe vocabulary every cloud provider assumes you already have: regions and availability zones as a blast-radius decision, IAM as default-deny, and the shared responsibility line that determines who gets paged for a breach.
- AWS — the services that show up in most stacksEC2, S3, RDS, Lambda and IAM roles as the five services almost every AWS architecture is built from, and the mental model — instance vs managed service vs event-driven function — that generalizes to any provider.
- Azure — resource groups, Entra ID, and Cloud Run's closest cousinWhat's genuinely different about Azure once you already know AWS — resource groups as a real management unit rather than a tagging convention, and Entra ID's tenant-first identity model.
- GCP — projects, IAM inheritance, and Cloud RunWhat's genuinely different about GCP once you already know AWS and Azure — the project hierarchy IAM inherits down through, and Cloud Run's per-request billing as a distinct point between Lambda and a always-on container.
- Terraform — plan, state, and when an edit becomes a replacementReal terraform plan output showing the distinction that matters more than any HCL syntax — update in place versus destroy-and-recreate — plus state as the thing that makes any of this safe to run twice.
- Containers — layers, caching, and what isolation actually meansA container is a process, not a VM — namespaces and cgroups instead of a hypervisor, and image layers as a cache Docker computes from, which is why Dockerfile instruction order is a real performance decision.
- Kubernetes — requests, limits, and why OOMKilled isn't about limits aloneRequests decide where a pod is scheduled; limits decide when it's killed — two different numbers, easy to set identically, and the gap between them is where most production Kubernetes incidents live.
- CI/CD — the pipeline as the only path to productionWhy caching only helps when it's actually restored, what a deployment strategy trades off (blue-green vs rolling vs canary), and the discipline that makes a pipeline trustworthy — nothing reaches production except through it.
- Observability — logs, metrics, traces, and what each can't tell youThree signal types that answer different questions, why none of them substitutes for the others, and SLOs as the mechanism that turns "is it slow" into a number someone can page on.
- Cloud cost — where the bill actually comes fromEgress, idle capacity, and commitment discounts as the three levers that move a cloud bill the most, with real 2026 pricing tiers worked through as arithmetic rather than asserted as a rule of thumb.
- Cloud security — where incidents actually come fromAlmost no real cloud security incident is the provider's infrastructure failing — it's a misconfiguration on the customer's side of the shared responsibility line: a public bucket, an over-broad role, a leaked long-lived credential.