Skip to main content

Module 1: Cloud Platform Fundamentals: Worked Examples

Example 1: Place a Three-Tier Service​

Put public ingress in public subnets and application workloads plus database in private subnets across at least two failure zones. Route only required traffic, expose no database public endpoint, and distinguish security-group/stateful filtering from route reachability. NAT is an outbound dependency and cost driver, not a security boundary by itself.

Example 2: Replace a Wildcard Role​

Wrong policy: application and CI both receive administrator access. Correct reasoning: separate deployer from workload identities; scope actions to named resources and conditions; use short-lived federation for CI; verify denied actions as well as allowed ones. Record the escalation path rather than granting standing privilege.

Example 3: Choose a Service With Exit Costs Visible​

Compare VM, container platform, serverless, and managed database options across operational ownership, scaling shape, latency, compliance, portability, and cost. Managed does not mean responsibility-free: data model, access policy, backup, recovery, quotas, and observability remain yours.

Completion Standard​

  • Draw network, identity, data, and failure boundaries.
  • Prove least privilege with positive and negative tests.
  • Produce a costed service-choice ADR with a teardown plan.