cloud-platforms

Cloud Platforms

Core Principles

1. Zero Trust: Never trust, always verify
2. Least Privilege: Minimum necessary permissions
3. Defense in Depth: Multiple layers of security
4. Infrastructure as Code: All infrastructure defined in code
5. Observability: Comprehensive logging, metrics, and tracing

Platform Selection

Use Case	Recommended
Enterprise, broad services	AWS
Microsoft ecosystem	Azure
Data/ML workloads	GCP
Edge/CDN, simple serverless	Cloudflare

AWS Quick Reference

IAM Best Practices

# EKS Pod Identity (Recommended over IRSA)
resource "aws_eks_pod_identity_association" "app" {
  cluster_name    = aws_eks_cluster.main.name
  namespace       = "default"
  service_account = "app"
  role_arn        = aws_iam_role.app_pod_identity.arn
}

VPC Pattern

# Private subnets only - Zero Trust
resource "aws_subnet" "private" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.16.${count.index + 1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Type = "Private"
  }
}

Essential Services

• EKS: Managed Kubernetes
• Lambda: Serverless compute
• RDS/Aurora: Managed databases
• S3: Object storage
• CloudFront: CDN
• Secrets Manager: Secret storage

Azure Quick Reference

Managed Identity

resource "azurerm_user_assigned_identity" "app" {
  name                = "app-identity"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
}

Essential Services

• AKS: Managed Kubernetes
• Azure Functions: Serverless
• Azure SQL: Managed databases
• Blob Storage: Object storage
• Azure CDN: Content delivery
• Key Vault: Secret management

GCP Quick Reference

Workload Identity

resource "google_service_account" "app" {
  account_id   = "app-sa"
  display_name = "Application Service Account"
}

resource "google_project_iam_member" "app" {
  project = var.project_id
  role    = "roles/storage.objectViewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}