把云计算知识学成一套可输出的方法

Cloud Computing Basics

Cloud computing provides on-demand network access to a shared pool of configurable computing resources. In IaaS, the customer manages the OS and above. In PaaS, the customer mainly manages application code and data. In SaaS, the provider manages almost the entire stack.

Virtualization / EC2 / Nitro

Virtualization allows multiple VMs to share the same physical host while the hypervisor allocates resources and enforces isolation. AWS Nitro offloads networking, storage, management, monitoring, and security to dedicated hardware, so it no longer needs a privileged Dom0.

• The Nitro Hypervisor handles CPU and memory partitioning and scheduling.
• Nitro Cards offload I/O and management functions.
• The Nitro Security Chip provides a hardware root of trust.

S3 / Versioning / CRR

S3 is object storage. An object consists of a key, metadata, and content. Versioning protects against accidental deletion and overwrite. If an object is deleted without a version ID, S3 creates a delete marker instead of deleting previous versions. Cross-Region Replication requires versioning on both buckets.

• Delete markers are not replicated by default.
• Deleting a specific version is not replicated.
• Eleven nines refers to durability, not availability.

VPC / Subnet / Security Group

A VPC is a regional isolated network, while a subnet is scoped to one Availability Zone. A public subnet is public because its route table has a default route to an Internet Gateway. Private subnets usually use a NAT Gateway for outbound Internet access. Security Groups are instance-level, stateful, and allow-only.

• Place the web tier in public subnets and app/database tiers in private subnets.
• Use NAT Gateway for outbound traffic from private app subnets.
• Using a Security Group as the source is more precise than using a CIDR range.

IAM / Policy / Role

For IAM policy questions, analyze the identity, action, resource, and condition. Authorization starts with default deny. An explicit deny overrides everything. If there is no explicit deny, AWS checks for an explicit allow. Without an allow, the request is implicitly denied.

• Identity-based policies answer “what can this identity access?”
• Resource-based policies answer “who can access this resource?”
• Roles provide temporary credentials through STS.

RDS / Aurora

RDS is a managed relational database service. AWS manages hardware, patching, backups, and host replacement. Multi-AZ is for high availability, while Read Replicas are for read scaling. Aurora separates compute from storage. Data is split into 10 GB segments, with six copies across three AZs.

• Write quorum is 4 out of 6, and read quorum is 3 out of 6.
• Losing one AZ leaves four copies, so writes can continue.
• VDL is the highest CPL that is less than or equal to VCL.

CloudWatch / ASG / ALB

For elasticity questions, describe the sequence: CloudWatch collects metrics; an alarm or target tracking policy triggers the Auto Scaling Group; the ASG launches new EC2 instances from the launch template; the instances are registered with the ALB target group; after health checks pass, the ALB distributes traffic to them.

• ALB is Layer 7 and is suitable for HTTP/HTTPS applications.
• Use Least Outstanding Requests when request processing times vary.
• ALB stops forwarding to unhealthy targets before ASG replaces them.

CloudFormation / DevOps

CloudFormation is AWS-native Infrastructure as Code. A template is like a class, and a stack is like an object. Resources is the only required section. CodePipeline is an orchestration service, organized as Pipeline → Stage → Action → Artifact.

• !Ref returns a physical ID or the default return value.
• !GetAtt returns a resource attribute.
• A change set previews the impact of an update.

Container / Lambda / Kubernetes

Containers are OS-level virtualization. They share the host kernel, use namespaces for isolation, and cgroups for resource limits. Lambda is serverless FaaS and fits event-driven, low-duty-cycle, or unpredictable workloads. Kubernetes is a container orchestration system, and Pod is the smallest scheduling unit.

• VMs provide strong isolation but are heavy; containers are lightweight but weaker; MicroVMs sit in between.
• The execution role controls what a Lambda function can access.
• The resource-based policy controls who can invoke the Lambda function.

SQS / SNS / Fan-out

SQS is a point-to-point queue where consumers pull messages. SNS is a pub/sub topic that pushes messages to multiple subscribers. The fan-out pattern uses SNS to broadcast to multiple SQS queues, so each downstream service receives its own copy and can scale and retry independently.

• After ReceiveMessage, the message becomes invisible.
• After successful processing, the consumer must call DeleteMessage.
• If the timeout expires before deletion, the message becomes visible again and may be processed again; repeated failures can move it to a DLQ.