Key Code Examples
1. AWS S3 — File Upload & Presigned URLs
import boto3
from botocore.exceptions import ClientError
class S3Manager:
def __init__(self, bucket_name):
self.s3 = boto3.client('s3')
self.bucket = bucket_name
def upload_file(self, file_path, s3_key):
"""Upload file to S3 with server-side encryption."""
try:
self.s3.upload_file(
file_path, self.bucket, s3_key,
ExtraArgs={
'ServerSideEncryption': 'AES256',
'Metadata': {
'uploaded-by': 'eduverse-app',
'content-type': 'application/octet-stream'
}
}
)
print(f"Uploaded {file_path} to s3://{self.bucket}/{s3_key}")
return True
except ClientError as e:
print(f"Upload failed: {e}")
return False
def generate_presigned_url(self, s3_key, expiration=3600):
"""Generate a temporary URL for private objects."""
url = self.s3.generate_presigned_url(
'get_object',
Params={'Bucket': self.bucket, 'Key': s3_key},
ExpiresIn=expiration
)
return url
def list_objects(self, prefix=''):
"""List objects with optional prefix filter."""
response = self.s3.list_objects_v2(
Bucket=self.bucket, Prefix=prefix
)
return [obj['Key'] for obj in response.get('Contents', [])]
def delete_file(self, s3_key):
self.s3.delete_object(Bucket=self.bucket, Key=s3_key)
# Usage
s3 = S3Manager('my-eduverse-bucket')
s3.upload_file('report.pdf', 'reports/2026/report.pdf')
url = s3.generate_presigned_url('reports/2026/report.pdf', 7200)
print(f"Download URL (2h): {url}")
2. AWS EC2 — Instance Management
import boto3
class EC2Manager:
def __init__(self, region='us-east-1'):
self.ec2 = boto3.resource('ec2', region_name=region)
self.client = boto3.client('ec2', region_name=region)
def create_instance(self, image_id='ami-0123456789', instance_type='t3.micro',
key_name='my-key', security_groups=['sg-12345']):
"""Launch a new EC2 instance."""
instances = self.ec2.create_instances(
ImageId=image_id,
MinCount=1,
MaxCount=1,
InstanceType=instance_type,
KeyName=key_name,
SecurityGroupIds=security_groups,
TagSpecifications=[{
'ResourceType': 'instance',
'Tags': [
{'Key': 'Name', 'Value': 'eduverse-web-server'},
{'Key': 'Environment', 'Value': 'production'}
]
}],
UserData='''#!/bin/bash
yum update -y
yum install -y python3
pip3 install flask
'''
)
instance = instances[0]
instance.wait_until_running()
instance.load()
print(f"Instance {instance.id} running at {instance.public_ip_address}")
return instance
def stop_instance(self, instance_id):
self.client.stop_instances(InstanceIds=[instance_id])
print(f"Stopping {instance_id}...")
def get_running_instances(self):
"""List all running instances with their tags."""
response = self.client.describe_instances(
Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]
)
instances = []
for reservation in response['Reservations']:
for inst in reservation['Instances']:
name = next((t['Value'] for t in inst.get('Tags', [])
if t['Key'] == 'Name'), 'unnamed')
instances.append({
'id': inst['InstanceId'],
'name': name,
'type': inst['InstanceType'],
'ip': inst.get('PublicIpAddress', 'N/A'),
'launched': inst['LaunchTime']
})
return instances
# Usage
manager = EC2Manager('us-west-2')
running = manager.get_running_instances()
for inst in running:
print(f" {inst['name']}: {inst['id']} ({inst['ip']})")
3. AWS Lambda — Serverless Function
import json
import boto3
import hashlib
from datetime import datetime
def lambda_handler(event, context):
"""Process uploaded image and store metadata."""
try:
# Parse S3 event
for record in event['Records']:
bucket = record['s3']['bucket']['name']
key = record['s3']['object']['key']
# Get file info
s3 = boto3.client('s3')
response = s3.head_object(Bucket=bucket, Key=key)
# Generate metadata
file_hash = hashlib.md5(
response['ETag'].strip('"').encode()
).hexdigest()
metadata = {
'file_key': key,
'bucket': bucket,
'size_bytes': response['ContentLength'],
'content_type': response['ContentType'],
'md5_hash': file_hash,
'uploaded_at': datetime.utcnow().isoformat(),
'processed_by': 'lambda-processor-v1'
}
# Store in DynamoDB
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('file-metadata')
table.put_item(Item=metadata)
# Trigger thumbnail generation
if key.startswith('uploads/images/'):
invoke_thumbnail_lambda(key)
return {
'statusCode': 200,
'body': json.dumps({
'message': 'File processed successfully',
'file_key': key,
'metadata': metadata
})
}
except Exception as e:
return {
'statusCode': 500,
'body': json.dumps({'error': str(e)})
}
4. Terraform — Infrastructure as Code
# main.tf — Deploy a complete web infrastructure
terraform {
required_providers {
aws = { source = "hashicorp/aws", version = "~> 5.0" }
}
}
provider "aws" {
region = var.aws_region
}
# VPC and Networking
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true
enable_dns_support = true
tags = { Name = "eduverse-vpc" }
}
resource "aws_subnet" "public" {
count = 2
vpc_id = aws_vpc.main.id
cidr_block = "10.0.${count.index + 1}.0/24"
availability_zone = data.aws_availability_zones.available.names[count.index]
map_public_ip_on_launch = true
tags = { Name = "public-subnet-${count.index + 1}" }
}
# Security Group
resource "aws_security_group" "web" {
name = "web-sg"
vpc_id = aws_vpc.main.id
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
# Application Load Balancer
resource "aws_lb" "main" {
name = "eduverse-alb"
load_balancer_type = "application"
security_groups = [aws_security_group.web.id]
subnets = aws_subnet.public[*].id
}
# Auto Scaling Group
resource "aws_launch_template" "web" {
image_id = "ami-0123456789"
instance_type = "t3.micro"
key_name = var.key_name
user_data = base64encode(templatefile("user_data.sh", {
db_host = aws_db_instance.main.address
}))
tag_specifications {
resource_type = "instance"
tags = { Name = "eduverse-web" }
}
}
resource "aws_autoscaling_group" "web" {
desired_capacity = 2
max_size = 5
min_size = 1
vpc_zone_identifier = aws_subnet.public[*].id
target_group_arns = [aws_lb_target_group.web.arn]
launch_template {
id = aws_launch_template.web.id
version = "$Latest"
}
tag {
key = "Name"
value = "eduverse-asg"
propagate_at_launch = true
}
}
# RDS Database
resource "aws_db_instance" "main" {
allocated_storage = 20
engine = "postgres"
engine_version = "15"
instance_class = "db.t3.micro"
db_name = "eduverse"
username = var.db_username
password = var.db_password
db_subnet_group_name = aws_db_subnet_group.main.name
vpc_security_group_ids = [aws_security_group.db.id]
skip_final_snapshot = true
}
# Outputs
output "load_balancer_dns" {
value = aws_lb.main.dns_name
}
5. Docker — Multi-Stage Build
# Dockerfile — Production-ready Node.js app
# ---- Build Stage ----
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
# Build the application
RUN npm run build
# ---- Production Stage ----
FROM node:20-alpine AS production
# Security: Run as non-root user
RUN addgroup -g 1001 -S nodejs && \
adduser -S nextjs -u 1001
WORKDIR /app
# Copy only necessary files from builder
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./
USER nextjs
EXPOSE 3000
ENV NODE_ENV=production
ENV PORT=3000
HEALTHCHECK --interval=30s --timeout=10s \
CMD curl -f http://localhost:3000/health || exit 1
CMD ["node", "dist/server.js"]
# ---- docker-compose.yml ----
version: "3.8"
services:
app:
build:
context: .
dockerfile: Dockerfile
ports:
- "3000:3000"
environment:
- DATABASE_URL=postgres://user:pass@db:5432/eduverse
- REDIS_URL=redis://cache:6379
depends_on:
db:
condition: service_healthy
cache:
condition: service_started
networks:
- app-network
restart: unless-stopped
deploy:
resources:
limits:
memory: 512M
cpus: '0.5'
db:
image: postgres:15-alpine
environment:
POSTGRES_USER: user
POSTGRES_PASSWORD: pass
POSTGRES_DB: eduverse
volumes:
- pgdata:/var/lib/postgresql/data
ports:
- "5432:5432"
healthcheck:
test: ["CMD-SHELL", "pg_isready -U user -d eduverse"]
interval: 5s
timeout: 5s
retries: 5
networks:
- app-network
cache:
image: redis:7-alpine
ports:
- "6379:6379"
networks:
- app-network
nginx:
image: nginx:alpine
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf
- ./certs:/etc/nginx/certs
depends_on:
- app
networks:
- app-network
volumes:
pgdata:
networks:
app-network:
driver: bridge
6. Kubernetes — Deployment Manifest
# deployment.yaml — Deploy app to Kubernetes
apiVersion: apps/v1
kind: Deployment
metadata:
name: eduverse-api
namespace: production
labels:
app: eduverse-api
version: v1.2.3
spec:
replicas: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: eduverse-api
template:
metadata:
labels:
app: eduverse-api
version: v1.2.3
spec:
containers:
- name: api
image: eduverse/api:v1.2.3
ports:
- containerPort: 3000
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: db-credentials
key: url
- name: REDIS_URL
valueFrom:
configMapKeyRef:
name: app-config
key: redis-url
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
httpGet:
path: /health
port: 3000
initialDelaySeconds: 10
periodSeconds: 15
readinessProbe:
httpGet:
path: /ready
port: 3000
initialDelaySeconds: 5
periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
name: eduverse-api-service
namespace: production
spec:
selector:
app: eduverse-api
ports:
- protocol: TCP
port: 80
targetPort: 3000
type: ClusterIP
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: eduverse-api-hpa
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: eduverse-api
minReplicas: 3
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 70
7. AWS CloudWatch — Monitoring & Alarms
import boto3
import json
class CloudWatchManager:
def __init__(self):
self.client = boto3.client('cloudwatch')
self.logs = boto3.client('logs')
def create_alarm(self, alarm_name, metric_name, namespace,
threshold, comparison='GreaterThanThreshold',
evaluation_periods=2):
"""Create a CloudWatch alarm."""
self.client.put_metric_alarm(
AlarmName=alarm_name,
AlarmDescription=f'Alarm when {metric_name} > {threshold}',
MetricName=metric_name,
Namespace=namespace,
Statistic='Average',
Period=300, # 5 minutes
EvaluationPeriods=evaluation_periods,
Threshold=threshold,
ComparisonOperator=comparison,
TreatMissingData='notBreaching',
AlarmActions=[
'arn:aws:sns:us-east-1:123456789012:alerts'
],
OKActions=[
'arn:aws:sns:us-east-1:123456789012:alerts'
],
Tags=[
{'Key': 'Environment', 'Value': 'production'},
{'Key': 'Application', 'Value': 'eduverse-api'}
]
)
print(f"Alarm '{alarm_name}' created")
def put_custom_metric(self, metric_name, value, namespace='EduVerse',
dimensions=None):
"""Publish a custom metric."""
metric_data = {
'MetricName': metric_name,
'Value': value,
'Unit': 'Count',
'Timestamp': datetime.utcnow()
}
if dimensions:
metric_data['Dimensions'] = [
{'Name': k, 'Value': v} for k, v in dimensions.items()
]
self.client.put_metric_data(
Namespace=namespace,
MetricData=[metric_data]
)
def create_dashboard(self, dashboard_name):
"""Create a CloudWatch dashboard."""
dashboard_body = {
"widgets": [
{
"type": "metric",
"width": 12,
"height": 6,
"properties": {
"metrics": [
["AWS/EC2", "CPUUtilization",
"InstanceId", "i-1234567890"]
],
"period": 300,
"stat": "Average",
"region": "us-east-1",
"title": "CPU Utilization"
}
},
{
"type": "log",
"width": 24,
"height": 6,
"properties": {
"query": "SOURCE '/eduverse/api' | \
fields @timestamp, @message | \
filter @message like /ERROR/ | \
stats count() as error_count by \
bin(5m)",
"region": "us-east-1",
"title": "Error Count (5min)"
}
}
]
}
self.client.put_dashboard(
DashboardName=dashboard_name,
DashboardBody=json.dumps(dashboard_body)
)
# Usage
cw = CloudWatchManager()
cw.create_alarm('high-cpu', 'CPUUtilization', 'AWS/EC2', 80)
cw.put_custom_metric('ActiveUsers', 1542, dimensions={'Env': 'prod'})
cw.create_dashboard('EduVerse-Production')
8. Azure — Blob Storage & Functions
// Azure Blob Storage with Node.js
const { BlobServiceClient, StorageSharedKeyCredential } = require('@azure/storage-blob');
class AzureBlobManager {
constructor(accountName, accountKey) {
const credential = new StorageSharedKeyCredential(accountName, accountKey);
this.client = new BlobServiceClient(
`https://${accountName}.blob.core.windows.net`,
credential
);
}
async uploadBlob(containerName, blobName, content) {
const container = this.client.getContainerClient(containerName);
const blockBlob = container.getBlockBlobClient(blobName);
await blockBlob.upload(content, content.length, {
blobHTTPHeaders: { blobContentType: 'application/octet-stream' },
metadata: { uploadedBy: 'eduverse-app', timestamp: Date.now().toString() }
});
return blockBlob.url;
}
async downloadBlob(containerName, blobName) {
const container = this.client.getContainerClient(containerName);
const blockBlob = container.getBlockBlobClient(blobName);
const downloadResponse = await blockBlob.download();
return streamToBuffer(downloadResponse.readableStreamBody);
}
}
// Azure Function (HTTP Trigger)
module.exports = async function (context, req) {
context.log('Processing request...');
const { name, email, message } = req.body;
// Validate
if (!name || !email || !message) {
context.res = {
status: 400,
body: { error: 'Missing required fields' }
};
return;
}
// Store in Cosmos DB
const contact = {
id: context.invocationId,
name, email, message,
submittedAt: new Date().toISOString(),
status: 'new'
};
context.bindings.outputDocument = contact;
// Send notification via Service Bus
context.bindings.outputQueueItem = {
type: 'new_contact',
data: contact
};
context.res = {
status: 201,
body: { message: 'Contact submitted successfully', id: contact.id }
};
};
9. Google Cloud — Cloud Run Deployment
# cloudbuild.yaml — CI/CD Pipeline for Cloud Run
steps:
# Build the container image
- name: 'gcr.io/cloud-builders/docker'
args:
- 'build'
- '-t'
- 'gcr.io/$PROJECT_ID/eduverse-api:$SHORT_SHA'
- '-t'
- 'gcr.io/$PROJECT_ID/eduverse-api:latest'
- '.'
# Push to Container Registry
- name: 'gcr.io/cloud-builders/docker'
args: ['push', 'gcr.io/$PROJECT_ID/eduverse-api:$SHORT_SHA']
# Run tests
- name: 'gcr.io/cloud-builders/docker'
args:
- 'run'
- 'gcr.io/$PROJECT_ID/eduverse-api:$SHORT_SHA'
- 'npm'
- 'test'
# Deploy to Cloud Run
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
entrypoint: gcloud
args:
- 'run'
- 'deploy'
- 'eduverse-api'
- '--image'
- 'gcr.io/$PROJECT_ID/eduverse-api:$SHORT_SHA'
- '--region'
- 'us-central1'
- '--platform'
- 'managed'
- '--allow-unauthenticated'
- '--memory'
- '512Mi'
- '--concurrency'
- '80'
- '--max-instances'
- '10'
- '--min-instances'
- '1'
# Apply database migrations
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
entrypoint: 'bash'
args:
- '-c'
- |
gcloud sql connect eduverse-db --user=postgres --quiet \
< migrations/latest.sql
images:
- 'gcr.io/$PROJECT_ID/eduverse-api:$SHORT_SHA'
options:
logging: CLOUD_LOGGING_ONLY
10. Cloud Cost Optimization Script
import boto3
from datetime import datetime, timedelta
class CostOptimizer:
def __init__(self):
self.ce = boto3.client('ce') # Cost Explorer
self.ec2 = boto3.client('ec2')
self.rds = boto3.client('rds')
def get_cost_last_30_days(self):
"""Get daily cost for last 30 days."""
end = datetime.now().date()
start = end - timedelta(days=30)
response = self.ce.get_cost_and_usage(
TimePeriod={
'Start': start.isoformat(),
'End': end.isoformat()
},
Granularity='DAILY',
Metrics=['UnblendedCost']
)
total = sum(
float(day['Total']['UnblendedCost']['Amount'])
for day in response['ResultsByTime']
)
return total
def find_idle_instances(self, days=7):
"""Find EC2 instances with < 5% CPU utilization."""
cloudwatch = boto3.client('cloudwatch')
instances = self.ec2.describe_instances(
Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]
)
idle = []
for reservation in instances['Reservations']:
for inst in reservation['Instances']:
instance_id = inst['InstanceId']
# Get average CPU over 7 days
metrics = cloudwatch.get_metric_statistics(
Namespace='AWS/EC2',
MetricName='CPUUtilization',
Dimensions=[{'Name': 'InstanceId', 'Value': instance_id}],
StartTime=datetime.utcnow() - timedelta(days=days),
EndTime=datetime.utcnow(),
Period=days * 86400,
Statistics=['Average']
)
if metrics['Datapoints']:
avg_cpu = metrics['Datapoints'][0]['Average']
if avg_cpu < 5:
idle.append({
'id': instance_id,
'type': inst['InstanceType'],
'avg_cpu': avg_cpu,
'monthly_cost': self._estimate_cost(inst['InstanceType'])
})
return idle
def _estimate_cost(self, instance_type):
"""Rough monthly cost estimate."""
pricing = {
't3.micro': 7.59, 't3.small': 15.18, 't3.medium': 30.37,
't3.large': 60.74, 'm5.large': 70.08, 'm5.xlarge': 140.16,
}
return pricing.get(instance_type, 'Unknown')
def generate_savings_report(self):
"""Generate a cost optimization report."""
idle_instances = self.find_idle_instances()
total_cost = self.get_cost_last_30_days()
potential_savings = sum(i['monthly_cost'] for i in idle_instances)
report = {
'total_monthly_cost': f"${total_cost:.2f}",
'idle_instances_count': len(idle_instances),
'potential_monthly_savings': f"${potential_savings:.2f}",
'idle_instances': idle_instances,
'recommendations': []
}
if idle_instances:
report['recommendations'].append(
f"Stop or terminate {len(idle_instances)} idle instances "
f"to save ${potential_savings:.2f}/month"
)
return report
Core Concepts
Cloud Service Models (IaaS, PaaS, SaaS, FaaS)
- IaaS (Infrastructure as a Service): Virtual servers, storage, networking (AWS EC2, Azure VMs, GCP Compute Engine). You manage OS and above.
- PaaS (Platform as a Service): Development platform with OS, middleware, runtime managed (Heroku, Google App Engine, AWS Elastic Beanstalk).
- SaaS (Software as a Service): Complete software managed by vendor (Gmail, Salesforce, Office 365).
- FaaS (Function as a Service): Serverless functions (AWS Lambda, Azure Functions, GCP Cloud Functions). Pay per execution.
Cloud Deployment Models
- Public Cloud: Shared infrastructure owned by third party (AWS, Azure, GCP). Pay-as-you-go, highly scalable.
- Private Cloud: Dedicated infrastructure for one organization. Greater control, higher cost.
- Hybrid Cloud: Mix of public and private. Sensitive data on private, burst capacity on public.
- Multi-Cloud: Using multiple cloud providers to avoid vendor lock-in and increase redundancy.
Scalability & Elasticity
Vertical Scaling (Scale Up): Adding more CPU/RAM to existing server. Simple but has limits.
Horizontal Scaling (Scale Out): Adding more servers to distribute load. More complex but nearly unlimited.
Auto Scaling: Automatically adjusting resources based on demand (CPU, network traffic, custom metrics).
- Scale Out: Add instances when load increases
- Scale In: Remove instances when load decreases (cost savings)
- Target Tracking: Maintain CPU at 70%
- Scheduled Scaling: Pre-scale for known traffic patterns
High Availability & Fault Tolerance
Definition: Designing systems to remain operational despite component failures.
- Availability: Percentage of time system is operational (99.9% = "three nines" = 8.76 hours downtime/year)
- Multi-AZ: Deploy across multiple Availability Zones within a region
- Multi-Region: Deploy across multiple geographic regions
- Load Balancing: Distribute traffic across healthy instances
- Health Checks: Automatically detect and replace failed instances
- RTO/RPO: Recovery Time Objective / Recovery Point Objective
Cloud Security & Shared Responsibility
Shared Responsibility Model:
- Provider manages: Physical security, network infrastructure, hypervisor, hardware
- Customer manages: Data, OS, network configuration, access management, encryption
Key Security Practices:
- IAM (Identity & Access Management): Least privilege access, MFA, role-based access
- Encryption: At rest (KMS) and in transit (TLS/SSL)
- Network Security: VPC, security groups, private subnets
- Monitoring: CloudTrail, GuardDuty, Security Hub
Container Orchestration (Kubernetes)
Definition: Automating deployment, scaling, and management of containerized applications.
- Pod: Smallest deployable unit; one or more containers
- Deployment: Declarative updates for pods and ReplicaSets
- Service: Stable network endpoint to access pods
- ConfigMap/Secret: Configuration and sensitive data management
- Namespace: Virtual cluster for resource isolation
- HPA: Horizontal Pod Autoscaler — scale based on CPU/memory
Serverless Computing
Definition: Cloud model where provider manages infrastructure; you only write and deploy code.
- Benefits: No server management, auto-scaling, pay-per-use, faster time-to-market
- Limitations: Cold starts, execution time limits, vendor lock-in, debugging difficulty
- Use Cases: API backends, event processing, scheduled tasks, file processing
- Tools: AWS Lambda, Azure Functions, GCP Cloud Functions, Knative
Cloud Cost Management
- Pay-as-you-go: Only pay for resources consumed
- Reserved Instances: 1-3 year commitment for 30-60% discount
- Spot Instances: Spare capacity at 70-90% discount (can be interrupted)
- Savings Plans: Commit to consistent usage for discount
- Cost Explorer: Visualize and analyze spending patterns
- Budgets & Alerts: Set spending limits and notifications
Worked Examples
Example 1: Calculate Cloud Monthly Cost
Problem: A web app uses: 3× t3.medium EC2, 1× RDS db.t3.micro, 100 GB S3, 5 TB data transfer out. Calculate monthly cost.
Solution:
- EC2: 3 × $30.37 = $91.11
- RDS: 1 × $12.41 = $12.41
- S3: 100 GB × $0.023 = $2.30
- Data Transfer: 5,000 GB × $0.09 = $450.00
- Total: $555.82/month
- With Reserved Instances (1-year, no upfront): EC2 = 3 × $18.92 = $56.76
- Optimized Total: $521.47/month (6% savings)
Example 2: Design a Highly Available Architecture
Problem: Design an architecture for an e-commerce site requiring 99.99% availability.
Solution:
- Multi-Region: Primary (us-east-1) + DR (us-west-2)
- Load Balancer: Application Load Balancer in each region
- Compute: Auto Scaling Group (2-10 instances) across 2 AZs
- Database: RDS Multi-AZ with read replicas in each region
- Cache: ElastiCache (Redis) cluster mode
- CDN: CloudFront for static assets
- DNS: Route 53 with health checks and failover routing
- Monitoring: CloudWatch alarms + PagerDuty integration
Example 3: Kubernetes Rolling Deployment
Problem: Deploy a new version of an app with zero downtime to Kubernetes.
Solution:
# 1. Build and push new image
docker build -t eduverse/api:v2.0.0 .
docker push gcr.io/project/eduverse/api:v2.0.0
# 2. Update deployment
kubectl set image deployment/eduverse-api api=gcr.io/project/eduverse/api:v2.0.0
# 3. Monitor rollout
kubectl rollout status deployment/eduverse-api
# 4. If issues, rollback
kubectl rollout undo deployment/eduverse-api
# Rolling update strategy ensures:
# - maxSurge: 1 (can have 1 extra pod)
# - maxUnavailable: 0 (never fewer than desired replicas)
# Result: Zero-downtime deployment
Example 4: Terraform State Management
Problem: Set up remote Terraform state with locking for team collaboration.
# backend.tf
terraform {
backend "s3" {
bucket = "eduverse-terraform-state"
key = "production/terraform.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform-locks"
}
}
# Create S3 bucket and DynamoDB table first
resource "aws_s3_bucket" "terraform_state" {
bucket = "eduverse-terraform-state"
}
resource "aws_s3_bucket_versioning" "terraform_state" {
bucket = aws_s3_bucket.terraform_state.id
versioning_configuration { status = "Enabled" }
}
resource "aws_dynamodb_table" "terraform_locks" {
name = "terraform-locks"
billing_mode = "PAY_PER_REQUEST"
hash_key = "LockID"
attribute {
name = "LockID"
type = "S"
}
}
# Commands:
# terraform init # Initialize with backend
# terraform plan # See what changes will be made
# terraform apply # Apply changes
Example 5: Auto-Scaling Policy Configuration
Problem: Configure auto-scaling to handle traffic spikes for a web app.
Solution:
- Target Tracking: Maintain average CPU at 60%
- Step Scaling:
- CPU > 70% for 5 min → Add 2 instances
- CPU > 85% for 5 min → Add 4 instances
- CPU < 30% for 15 min → Remove 1 instance
- Scheduled: Scale to 10 instances at 9 AM weekdays, back to 2 at 6 PM
- Predictive: Use ML to predict traffic patterns (AWS only)
Practice Problems
Problem 1: Docker Network Configuration
Create a Docker Compose setup with app, database, and cache services on separate networks.
version: "3.8"
services:
app:
image: eduverse-app:latest
networks:
- frontend
- backend
depends_on:
- db
- redis
db:
image: postgres:15
networks:
- backend
environment:
POSTGRES_PASSWORD: secret
volumes:
- pgdata:/var/lib/postgresql/data
redis:
image: redis:7-alpine
networks:
- backend
networks:
frontend: # Exposed to outside
backend: # Internal only
volumes:
pgdata:
Problem 2: Kubernetes ConfigMap and Secret
Create ConfigMap and Secret resources for app configuration.
# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
DATABASE_HOST: "postgres-service"
DATABASE_PORT: "5432"
LOG_LEVEL: "info"
CACHE_TTL: "300"
---
# secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: db-credentials
type: Opaque
stringData:
username: "app_user"
password: "super_secret_password"
url: "postgres://app_user:pass@postgres:5432/app"
---
# deployment.yaml using both
spec:
containers:
- name: app
env:
- name: DB_HOST
valueFrom:
configMapKeyRef:
name: app-config
key: DATABASE_HOST
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-credentials
key: password
Problem 3: Lambda Cold Start Mitigation
List three strategies to reduce Lambda cold start latency.
Answer:
- Provisioned Concurrency: Keep functions pre-warmed (costs more but eliminates cold starts)
- Reduce Package Size: Minimize dependencies, use tree-shaking, avoid large libraries
- Use ARM/Graviton: AWS Lambda on ARM offers better price-performance ratio
- Memory Allocation: More memory = more CPU = faster initialization
Problem 4: Terraform for VPC
Write Terraform code to create a VPC with public and private subnets across 2 AZs.
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true
enable_dns_support = true
tags = { Name = "main-vpc" }
}
resource "aws_subnet" "public" {
count = 2
vpc_id = aws_vpc.main.id
cidr_block = "10.0.${count.index + 10}.0/24"
availability_zone = data.aws_availability_zones.azs.names[count.index]
map_public_ip_on_launch = true
tags = { Name = "public-${count.index + 1}" }
}
resource "aws_subnet" "private" {
count = 2
vpc_id = aws_vpc.main.id
cidr_block = "10.0.${count.index + 20}.0/24"
availability_zone = data.aws_availability_zones.azs.names[count.index]
tags = { Name = "private-${count.index + 1}" }
}
resource "aws_internet_gateway" "main" {
vpc_id = aws_vpc.main.id
}
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.main.id
}
}
Problem 5: Design a Multi-Tier Architecture
Design a 3-tier web application architecture on AWS with specific services.
Answer:
- Presentation Tier: CloudFront (CDN) + S3 (static assets)
- Application Tier: ALB + ECS/EKS (containers) or EC2 Auto Scaling Group
- Data Tier: RDS (primary) + ElastiCache (Redis cache)
- Security: WAF + Security Groups + IAM + ACM (SSL)
- Monitoring: CloudWatch + X-Ray
Problem 6: Kubernetes Liveness vs Readiness Probe
Explain the difference and provide configuration examples.
Answer:
- Liveness Probe: Is the container running? If fails → restart container
- Readiness Probe: Is the container ready to serve traffic? If fails → remove from Service endpoints
livenessProbe:
httpGet:
path: /health
port: 3000
initialDelaySeconds: 10
periodSeconds: 15
readinessProbe:
httpGet:
path: /ready
port: 3000
initialDelaySeconds: 5
periodSeconds: 10
Problem 7: Cloud Migration Strategy
Compare the "6 R's" of cloud migration and provide an example for each.
Answer:
- Rehost (Lift & Shift): Move VMs to EC2 as-is
- Replatform (Lift & Reshape): Move app to Elastic Beanstalk
- Refactor (Re-architect): Move from monolith to Lambda microservices
- Repurchase: Switch from on-prem CRM to Salesforce
- Retain: Keep some workloads on-premises
- Retire: Decommission unused servers during migration
Problem 8: Implement CI/CD Pipeline
Design a CI/CD pipeline for a containerized application from code commit to production.
Answer:
- Code: Developer pushes to GitHub
- Build: GitHub Actions / Jenkins triggers build
- Test: Run unit tests + integration tests
- Security Scan: Snyk / Trivy vulnerability scan
- Package: Build Docker image → push to ECR
- Deploy Staging: Update EKS deployment
- Smoke Tests: Automated tests against staging
- Deploy Production: Rolling update with health checks
Problem 9: Serverless Data Processing
Design a serverless pipeline to process uploaded CSV files and store results in DynamoDB.
Answer:
- S3: User uploads CSV to S3 bucket
- S3 Event: Triggers Lambda function
- Lambda: Parse CSV, validate data, transform
- DynamoDB: Store processed records
- SNS: Send notification on completion/failure
- CloudWatch: Monitor and log pipeline execution
Problem 10: Disaster Recovery Plan
Design a DR plan for a web application with RPO of 1 hour and RTO of 4 hours.
Answer:
- Backup Strategy: Hourly incremental backups to S3 Cross-Region
- Database: RDS snapshots every hour + cross-region read replica
- Infrastructure: Terraform state in both regions; infrastructure as code
- DNS Failover: Route 53 health checks with automatic failover
- Runbook: Documented DR procedures with step-by-step recovery
- Testing: Quarterly DR drills to validate recovery process