Skip to content

Cloud Fundamentals

Cloud computing is renting someone else's data centers over the internet: compute, storage, and services you can scale on demand and pay for per use. This sheet covers the concepts shared by all providers, with provider-specific details in the AWS, Azure, and Google Cloud sheets.

Table of Contents

Installation / Setup

The CLI tools for each provider (used throughout the cloud sheets):

# AWS
pip install awscli
aws configure                      # access key + secret + default region

# Azure
pip install azure-cli
az login                           # browser-based auth

# Google Cloud
pip install google-cloud-sdk       # or the bundled installer
gcloud auth login
gcloud config set project my-project

All three CLIs support --region/-l, output as JSON (--output json / --format json), and script-friendly exit codes.

Core Concepts

Concept Meaning Why it matters
Region A geographic location of data centers (e.g. us-east-1, eastus, us-central1) Determines latency, cost, compliance; data residency
Availability Zone (AZ) An isolated data center within a region Distribute replicas for high availability
Project / Resource Group / Account The top-level container for your resources Billing, permissions, and cleanup boundaries
IAM Identity & Access Management: users, roles, policies Who can do what — the #1 security surface
Virtual Machine (VM) A rented server (EC2 / VM / Compute Engine) The basic compute unit
Object Storage Flat, massively scalable storage (S3 / Blob / GCS) Store data, models, artifacts, backups
Managed Database Database-as-a-service (RDS / Azure SQL / Cloud SQL) No patching, built-in backups
Serverless Run code without managing servers (Lambda / Functions / Cloud Functions) Pay per invocation; auto-scale to zero
VPC / Virtual Network Your private network slice in the cloud Isolation, subnets, security groups, firewalls
IaaS vs PaaS vs SaaS Raw infrastructure vs managed platform vs software How much you manage vs the vendor

The shared responsibility model

  • Provider secures of the cloud: physical data centers, hosts, networking, managed services.
  • You secure in the cloud: IAM policies, data, app code, network configuration, keys.

A common data/AI trap: the storage bucket is provider-secured, but your misconfigured bucket policy is what leaks data.

Provider Mapping

Concept AWS Azure Google Cloud
CLI aws az gcloud
VM EC2 Virtual Machine Compute Engine
Object storage S3 Blob Storage Cloud Storage (GCS)
Serverless functions Lambda Functions Cloud Functions
Managed Kubernetes EKS AKS GKE
Managed Postgres RDS Flexible Server Cloud SQL
Data warehouse Redshift Synapse BigQuery
Notebooks / ML platform SageMaker Azure ML Vertex AI
IAM IAM (users/roles/policies) Entra ID + RBAC IAM (roles)
Private network VPC Virtual Network VPC
Budget/alerting Cost Explorer Cost Management Budgets

Common Operations

Compute

# AWS — start/stop an instance by tag
aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances  --instance-ids i-1234567890abcdef0

# Azure
az vm create --resource-group rg-ml --name ml-vm --image UbuntuLTS --size Standard_D8s_v3
az vm start --resource-group rg-ml --name ml-vm

# GCP
gcloud compute instances create ml-vm --zone us-central1-a --machine-type n1-standard-8
gcloud compute instances stop ml-vm --zone us-central1-a

Object storage

# AWS S3
aws s3 cp model.pt s3://my-bucket/models/
aws s3 sync ./data s3://my-bucket/data/

# Azure Blob
az storage blob upload --account-name mystore --container-name models --name model.pt --file model.pt

# GCS
gsutil cp model.pt gs://my-bucket/models/
gsutil rsync ./data gs://my-bucket/data/

Cost visibility

# AWS
aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-09-30 --granularity MONTHLY --metrics UnblendedCost

# GCP
gcloud billing projects describe my-project
# Azure: Cost Management is web-only via az CLI equivalents

Practical Examples

Example 1 — Upload and serve a model artifact

# 1. Upload the model
aws s3 cp model.pt s3://my-bucket/models/model-042.pt

# 2. Download on a fresh VM and run inference
aws s3 cp s3://my-bucket/models/model-042.pt ./
python serve.py   # your FastAPI app — see 23-APIs/fastapi.md

Example 2 — Spin up a GPU VM for training

# GCP: create a VM with a T4 GPU
gcloud compute instances create train-vm \
  --zone us-central1-a \
  --machine-type n1-standard-8 \
  --accelerator type=nvidia-tesla-t4,count=1 \
  --maintenance-policy TERMINATE \
  --image-family pytorch-2-4-gpu --image-project deeplearning-platform-release

Example 3 — Serverless data-triggered job

A cloud function/object-storage event fires on upload and runs a processing step. Pattern in any provider:

file upload → event → serverless function → transform → write result to storage

Common Patterns

Storage for ML artifacts

Artifact Storage choice Notes
Datasets Object storage Version via DVC — see dvc.md
Model weights Object storage Large; use a CDN or fast regional bucket
Training logs / metrics Object storage + MLflow See mlflow.md
App config Secret manager + env See environment-variables.md

Credentials, never in code

# Provider-native secret managers
aws secretsmanager put-secret-value --secret-id ml/api-key --secret-string "YOUR_API_KEY"
az keyvault secret set --vault-name myvault --name api-key --value "YOUR_API_KEY"
gcloud secrets create api-key --data-file=key.txt

Read them at runtime via the SDK/CLI, not from the repo or environment dump.

Multi-region for availability

  • Run two copies in different regions (or AZs) behind a load balancer / DNS failover.
  • Keep data in the region that must serve it — copying data across regions costs money and latency.

Best Practices

  • Least privilege IAM — give each service/user only the permissions it needs. Audit with provider tools.
  • Tag/label everything — resources without tags are impossible to attribute to a cost center or team.
  • Prefer managed services — managed databases and serverless are cheaper to operate than DIY VMs.
  • Set budgets and alerts early — cloud cost creep is silent until the bill arrives.
  • Encrypt at rest and in transit — enable default encryption on buckets, use TLS everywhere.
  • Use infrastructure as code — Terraform/Pulumi (see devops.md) instead of click-ops.
  • Never commit keys — rotate regularly, use secret managers, scan repos for leaked keys.

Common Mistakes

Mistake Consequence Correct approach
Publicly readable storage bucket Data leak (the classic AI breach) Private bucket + signed URLs / IAM for access
Root account / admin key in CI Massive blast radius if leaked Scoped service accounts with least privilege
No budget alert Surprise multi-thousand-dollar bill Set budget + alert at 50/80/100%
Spinning up GPU VMs and forgetting them Paying 24/7 for idle machines Auto-stop schedules, spot/preemptible for interruptible work
One region for everything Outage takes down everything Spread across AZs/regions for critical services
Pasting credentials into notebooks Keys leak to logs, commits, teammates Secret manager + env vars, never hard-code

Troubleshooting

Symptom Cause Fix
AccessDenied on a bucket/object IAM policy or bucket policy wrong Check policy, use aws s3 ls with --no-sign-request only for public buckets
CLI auth expired Temporary credentials expired Re-run aws configure / az login / gcloud auth login
Quota exceeded Regional resource limit reached Request quota increase in console; use another region
Huge unexpected bill Idle VMs, egress, or leaked keys Cost explorer → find the service → stop/delete; rotate keys
Slow downloads from object storage Wrong region / no parallel transfer Use same-region buckets; gsutil -m / aws s3 sync parallelism

Official Documentation

Last Updated

2026-09-07 — Initial version.

Found a mistake or something outdated? Open an issue or submit a pull request — see CONTRIBUTING.md.