Cloud Computing Architecture and Infrastructure (IaaS)

What is Infrastructure as a Service (IaaS)

A cloud delivery model where a service provider provisions foundational computing, networking, block storage, and physical facility hardware to customers on an on-demand, pay-as-you-go basis, allowing consumers full control over guest operating systems and application stacks.

What are the 4 primary Cloud Deployment Models defined by NIST

1. Public Cloud: Open for public use over the internet; multi-tenant infrastructure owned by a CSP (AWS, Azure).
2. Private Cloud: Exclusively operated for a single organization; hosted on-premise or by a third party.
3. Hybrid Cloud: Composition of two or more distinct cloud infrastructures (public and private) bound by standardized technology enabling data and application portability.
4. Community Cloud: Shared by several organizations with shared concerns (compliance, security objectives, mission).

Cloud Bursting in a Hybrid Cloud deployment

An application deployment configuration where workloads run in a private cloud or local data center until demand spikes exceed local capacity, at which point the application seamlessly 'bursts' excess traffic into a public cloud to prevent downtime.

What is Server Virtualization in IaaS environments

The partitioning of physical bare-metal servers into multiple isolated virtual machine instances, managed by orchestration software (OpenStack, VMware vCenter) that dynamically assigns CPU cores, RAM, and PCIe devices.

Block Storage, File Storage, and Object Storage

• Block Storage: Raw, unformatted volumes attached to VMs (e.g., AWS EBS). Low latency, supports random read/write, ideal for databases and OS boots.
• File Storage: Hierarchical directory tree sharing files across multiple servers over network protocols (NFS, SMB/CIFS).
• Object Storage: Flat, unstructured key-value storage bucket (e.g., AWS S3). Files stored as immutable objects with rich custom metadata, accessed via REST HTTP APIs.

What is Software-Defined Networking (SDN)

An architectural paradigm that decouples the network control plane (which makes routing decisions) from the underlying data/forwarding plane (which physically forwards data packets), centralizing network control via software controllers.

What is a Virtual Private Cloud (VPC)

A logically isolated, private virtual network provisioned within a public cloud infrastructure, giving the customer complete control over IP address ranges, subnets, route tables, and network gateways.

What is an Availability Zone (AZ) versus a Cloud Region

A Cloud Region is a distinct geographical area (e.g., Mumbai, Frankfurt). An Availability Zone (AZ) is one or more discrete, fault-isolated data centers within a region, equipped with independent power, cooling, and networking, interconnected via ultra-low-latency fiber.

What is Cloud Storage Replication: Synchronous vs Asynchronous

• Synchronous Replication: Writes data simultaneously to multiple disks/locations; write transaction confirms only when all replicas acknowledge. Zero RPO, higher write latency.
• Asynchronous Replication: Writes data to primary storage, immediately acknowledges, and replicates in the background. Lower latency, risks slight data loss during catastrophic crashes.

Elastic Load Balancing (ELB) in cloud architectures

A managed cloud service that automatically distributes incoming application traffic across multiple healthy target instances (VMs, containers) in multiple AZs, monitoring health checks to bypass failed nodes.

Compare Cloud Deployment Models: Public, Private, Hybrid, and Community

Cloud Storage Architecture: Object Storage Mechanics (S3) vs Block Storage (EBS)

Storage Paradigm Architecture

• Block Storage: Operates at the lowest level of storage. Block volumes look like raw SCSI/NVMe disks to the operating system. Enables partial in-place updates of files.
• Object Storage: Stores data as atomic blobs composed of: Unique Key, Payload Data, Extensible Metadata, and Access Control Lists (ACLs). Offers practically infinite horizontal scalability via distributed hashing and erasure coding.

Software-Defined Networking (SDN) and OpenFlow in Cloud Infrastructures

SDN Architectural Decoupling

Traditional routers tightly bundle control decisions and packet switching on the same physical ASIC chassis. SDN separates them into two distinct planes:

1. Application Plane: Network orchestration, security firewalls, and load balancers.
2. Control Plane (The Brain): Centralized software controller (OpenDaylight, ONOS) possessing a global view of network topology. Computes routing tables and installs flow rules.
3. Data Plane (Forwarding): Commodity white-box switches forwarding packets at wire speed based on flow tables received via the OpenFlow protocol.

• Cloud Impact: Enables dynamic creation of tenant VPCs, software-defined firewalls, and micro-segmentation without touching physical patch cables.

Detail Virtual Private Cloud (VPC) Components: Subnets, Route Tables, NAT Gateways, and Security Groups

Enterprise VPC Blueprint

• CIDR Block: Defines IP address allocation space (e.g., 10.0.0.0/16 offering 65,536 private IPs).
• Public vs. Private Subnets:
• Public Subnet: Associated with a Route Table directing 0.0.0.0/0 traffic to an Internet Gateway (IGW).
• Private Subnet: Isolated from inbound internet traffic; routes outbound requests through a managed NAT Gateway in the public subnet.
• Security Groups (Stateful) vs Network ACLs (Stateless):
• Security Group: Acts as a virtual firewall at the VM instance level. Stateful: If inbound request is allowed, return outbound traffic is automatically permitted.
• NACL: Operates at the subnet boundary. Stateless: Inbound and outbound rules must be explicitly configured separately using rule numbers.

Data Protection Strategies in IaaS: Snapshots, RAID Arrays, and Disaster Recovery (DR)

Enterprise IaaS Resiliency Architecture

1. Point-in-Time Snapshots: Incremental block-level backups stored durability in object storage. Only modified blocks are copied after the initial snapshot baseline.
2. Software RAID in Cloud: Striping (RAID 0) across multiple EBS volumes to multiply IOPS throughput; Mirroring (RAID 1) or RAID 10 for extreme fault tolerance.
3. Disaster Recovery Architectures:

• Backup & Restore: Lowest cost, highest RTO/RPO.
• Pilot Light: Core data is replicated continuously to a remote region; compute instances remain off until disaster occurs.
• Warm Standby: Scaled-down version of full environment always running in remote region.
• Multi-Region Active-Active: Full traffic served concurrently from multiple geographical regions.

Design and Architect an Enterprise-Grade Multi-Tier Web Application on IaaS with High Availability, Multi-AZ Redundancy, and Auto-Scaling

Enterprise Multi-Tier IaaS Architecture Blueprint

1. Ingestion Tier

• Multi-AZ Application Load Balancer (ALB) terminates incoming SSL/TLS certificates and distributes traffic across EC2 instances in private subnets based on path routing (/api vs /static).

2. Compute Tier (Auto-Scaling Group)

• Compute instances reside strictly in private subnets, completely inaccessible from public IP ranges.
• Auto-Scaling Policy: Target tracking metric maintaining aggregate CPU utilization at 65%. Automatically adds VMs across AZ-1 and AZ-2 when traffic surges.

3. Database Tier (Multi-AZ Relational Storage)

• Primary relational database instance in AZ-1 writes synchronously to a Hot Standby instance in AZ-2.
• Automated Failover: If AZ-1 suffers a catastrophic power outage, database DNS flips to Standby in AZ-2 within 60 seconds with zero data loss (RPO = 0).

OpenStack: The Open-Source IaaS Architecture, Dissecting Its Core Microservices and Inter-Service Communication

OpenStack Open-Source IaaS Architecture

Core Modular Microservices:

1. Nova: Orchestrates the lifecycle of compute instances (VM provisioning, scheduling, CPU/RAM allocation via libvirt/KVM).
2. Neutron: Manages software-defined networking, IP allocation (DHCP), routing, and Open vSwitch / VXLAN overlay networks.
3. Glance: Image registry storing, discovering, and delivering VM disk templates (.qcow2, .raw, .vmdk).
4. Cinder: Provisions persistent block storage volumes attached to compute VMs via iSCSI or Ceph.
5. Swift: Scalable distributed object storage storing unstructured blobs across clusters.
6. Keystone: The central authentication and service catalog authority, issuing scoping tokens (Fernet tokens) to validate every API call.

Inter-Service Orchestration:

• All microservices communicate asynchronously using RabbitMQ message queues (AMQP) for long-running tasks and persist transactional state in a shared MariaDB relational cluster.

Analyze Disaster Recovery Metrics: Recovery Point Objective (RPO) vs Recovery Time Objective (RTO) with Mathematical Loss Formulations

Disaster Recovery Engineering

1. Fundamental Metrics Defined

• Recovery Point Objective (RPO): The maximum acceptable age of files or data that must be recovered from backup storage for normal operations to resume if a disaster occurs. Determines allowable data loss measured in time units.
• Recovery Time Objective (RTO): The maximum acceptable duration of clock time that can elapse before a system must be restored to full operation after a crash. Determines allowable downtime.

2. Mathematical Cost Optimization Curve

Let C_{loss}(RPO, RTO) represent business loss cost due to downtime and lost transactions, and C_{prep}(RPO, RTO) represent the technical infrastructure cost to achieve low RPO/RTO: $Total Cost = C_{loss}(RPO, RTO) + C_{prep}(RPO, RTO)$

• As RPO and RTO approach zero (instantaneous active-active replication), infrastructure cost exponentially accelerates.
• Business systems categorize applications: Tier 1 (Financial ledger: RPO = 0, RTO < 1 min); Tier 3 (Archival reporting: RPO = 24 hrs, RTO = 72 hrs).

Examiners heavily evaluate: Public vs Private vs Hybrid cloud comparison (5 marks), Block vs Object vs File storage (5/10 marks), and Multi-tier HA architecture with Load Balancer and Auto-scaling (10/15 marks).