Cloud Platform Concepts

Each rung hands the provider more of the stack. A rented machine leaves everything above the virtualization layer to you; a managed runtime adds the operating system and runtime; a whole managed capability adds patching, scaling, backups and failover.

On a rented virtual machine you patch the guest operating system and everything above it. On a managed database service the provider patches the host and the engine, while the data, the accounts and the configuration inside it stay yours.

Default encryption at rest protects bytes on the provider's media against drive loss, disposal or raw block access. It restricts nobody who calls the service: an authorized caller, and the provider holding the key, still get plaintext.

A provider can only promise an outcome it fully controls. Each duty a rung takes over becomes a guarantee made across many tenants at once, and any change you could still make by hand is state the fleet operator cannot assume.

A managed tier exposes only what it can operate, persist and support for every tenant at once, so settings that need host access, load foreign code into the engine, or weaken the tier's own promises are withheld, and the work they would have done moves into your application.

A residency obligation filters the candidate list before anything is compared: regions outside the required jurisdiction simply leave. Distance to users, the rate the region charges for the same service, and whether it offers what you need are then traded against each other.

An edge location can terminate the connection and TLS, serve a cached response, issue a redirect, and make a cheap decision from the request itself. The authoritative dataset, durable writes and heavy computation still travel back to the region.

A region is an independent geographic deployment unit; the availability zones inside it are separate facilities with their own power, cooling and network paths, a metro hop apart. The zone boundary isolates a facility failure, the region boundary isolates everything larger.

Distance fixes a round-trip floor: light in fibre travels about 200,000 km per second and real paths are longer than the map, so a far continent costs roughly a tenth of a second per round trip. Bigger machines and more instances cannot shorten it.

Connection setup costs several round trips before any request bytes move. Terminating nearby pays those against the short hop, while the forwarded request crosses the long distance once over a connection the edge already holds warm.

A provider account is one container bundling four things at once: one isolation boundary, one bill, one pooled set of usage ceilings, and one set of administrators. Every resource you create lives inside exactly one account.

A name prefix and an environment label are data every caller in the account can read or ignore; nothing enforces them. Isolation, quota and billing attach to the account, so only a separate account makes the split real.

Three symptoms matter: products contending for ceilings counted once for the whole account, a bill nobody can split by product, and a change or mistake in one product reaching the other two. Each follows from the account being one shared container.

A vended account arrives with its baseline already applied: audit and platform logs delivered to a central collection account, a private address range allocated from the organisation's plan, guardrail policies in force above it, and a named owner recorded.

A permission ceiling above the account subtracts from everything inside it. The effective permission is the intersection of the ceiling and the account's own grants, so an administrator can only grant within what the ceiling still leaves.

The platform issues it on demand. An identity is attached to the machine, and a credential endpoint reachable only from that machine hands the workload a short-lived credential set, which is replaced before it expires.

A principal is the identity a platform authenticates and names when it decides whether a call is allowed: a person's login, a workload such as a batch job or service, or a group that holds grants for the humans inside it.

Creating a new key does not disable the old one. Revoke the exposed credential first so it stops authenticating immediately, then issue replacements, then read back what the leaked credential actually called before it was stopped.

Federated workforce logins keep one copy of each person, in the company directory: cloud access follows group membership, and disabling the directory account cuts every federated sign-in at once. Local platform logins are extra credentials nobody remembers to delete.

Attaching an identity to a workload means running your own code as that identity. If any stronger identity can be attached, the team can launch code that borrows its permissions, so the attach grant is worth the strongest identity it reaches.

An event-driven runtime caps how long one invocation may run, so a twenty-minute job is stopped part-way. Put it on a tier that keeps a process alive: a managed container platform running it on a schedule, or a machine that stays up.

Size from the service's own observed processor, memory, disk and network use over a full demand cycle, taken at a high percentile with headroom added. The specification of the server being replaced records a purchase decision, not the workload, and is ignored.

A refused launch means one of two shortages: the provider has no machine of that shape free in that zone, or your account is not permitted more. A ceiling is a number you can look up; pool depth is never published.

The ratio in a measured profile picks the family — which resource saturates first while the others idle. Memory-heavy work wants a memory-weighted family, compute-bound work a processor-weighted one, heavy local input and output a disk-weighted one, dense parallel numeric work an accelerator.

Buy the always-on base with a term commitment, serve the month-end peak with metered on-demand capacity, and put only interruption-tolerant extra work on reclaimable capacity. Price each layer of the shape separately rather than picking one posture for the fleet.

A grant written on the store side — at store or object level — naming any caller as allowed to read produces public access. Nothing was leaked: the store is doing exactly what its policy says, so no credential was stolen and no defect was exploited.

Durability is about bytes surviving; availability is about bytes being reachable now. A many-nines durability figure estimates how unlikely it is that the store loses an object, and says nothing about an hour of failed requests.

Scratch belongs on a block volume: it attaches to one machine and behaves like a local disk, so seeks and in-place writes are cheap. Finished videos belong in an object store, fetched by key over HTTP by any number of readers.

A colder tier discounts rent by charging separately for reads and by making them slow. Data read every week pays a retrieval charge every week and waits for a restore each time, so the bill usually goes up, not down.

Versioning kept each pre-overwrite copy as a previous version under the same key, so recovery is promoting that version back to current, key by key. Nothing is restored from a backup, and every retained version keeps being stored and charged.

The stateful rule set needs only the request direction written; it matches the reply to the flow it already accepted. The stateless subnet filter judges each packet alone, so the reply needs its own rule allowing the client's ephemeral port range.

The address is allocated from the platform's pool and held by the entry point resource, not by any machine. It outlives instance replacement, is usually charged while you hold it, and goes back to the pool only when you release it.

Routing, not the name. A subnet is public when the route table it uses sends traffic for destinations outside the network to a target that reaches the internet. Private means no such route exists. The label itself configures nothing.

An endpoint inside your own range keeps the call on the provider's internal network: the workload connects to an address in one of your subnets, so the request does not take the public path and the subnet needs no route to the internet.

Two things: a default route on that subnet naming an address-translating gateway, and the gateway itself on the routed side. Outbound flows leave translated; unsolicited inbound packets match no translation entry, so nothing outside can open a connection.

A recovery point objective caps how much recent work the business accepts losing, measured backwards from the failure. A recovery time objective caps how long the service may stay unavailable, measured forwards from the same moment.

An availability commitment is a contract term, not a promise the service stays up. If the provider's own measurement falls short, the remedy is a service credit against your bill for that service, which you normally have to claim.

Instances in the two healthy zones keep serving, but only if the traffic entry point health-checks the dead ones out, the writable data copy is not stranded in the lost zone, and the survivors already had spare capacity.

The control plane - the platform's management API that creates, changes and deletes resources - is degraded, while the data plane that carries request traffic keeps serving. Launching, scaling, replacing and failing over stop; already-running capacity does not.

A replica copies committed writes, so it reproduces the mistaken delete as faithfully as any other write. Only a point-in-time restore rewinds the data to a moment before the mistake, at the cost of a much longer recovery time.

A label copies a key-value pair onto the charges a resource generates, so the provider's detailed cost report can be grouped by team, environment or service. It changes reporting only: the rate, the metered quantity and the total are unaffected.

A budget threshold is a notification rule, not a spending cap. Crossing it emits a message about money already spent. It does not pause running resources, block new ones, or cancel anything, and the figure it fired on lags the usage.

Transfer is metered by direction. Bytes arriving from outside are normally unmetered; bytes leaving toward the internet are priced per gigabyte after a small monthly allowance. So delivery to viewers is the charge, not the upload of masters.

Providers meter usage along several independent dimensions: running time, requests served, gigabyte-months stored, gigabytes moved, and provisioned capacity units. One service can charge on all of them at once, so a large bill line exists with no hourly rate anywhere.

Storage and reservations outlive the machine. A block volume that was not marked to be deleted with it, the snapshots and images built from it, and a reserved public address all keep billing. Find them by listing resources attached to nothing, not by reading the machine's record.

The call was accepted, not completed. A management API create is asynchronous: it validates and records the request, hands back an identifier immediately, and only then works the resource through build states before anything can serve traffic.

Both are clients of the same management API. The console is a hosted application that turns a form into the same request the command line tool sends; neither has a private path into the platform.

A maintenance window is a recurring slot you nominate in which the provider may patch and restart your managed instance. The application normally sees dropped connections and a short interruption, or a failover to the standby replica, not a seamless change.

A soft quota is a provider ceiling an increase request can raise, so hitting it costs lead time. A hard limit is fixed by the platform's design, and the only way past it is an architecture change.

The management API meters requests per account, separately from the traffic your workload serves. Deployment tools, dashboards and scripts all spend that management budget; user requests do not consume it unless the service itself calls the management API.

Running the component yourself keeps the software identical wherever the machines are rented, so a move becomes a reinstall and a restore rather than a rewrite. You pay for that with the patching, backups and on-call the managed tier was doing.

Lock-in is the cost of leaving, not an inability to leave. Code is one bill of four: data that is priced to move, operating knowledge the team has only here, and an unexpired term commitment are the other three.

A rewrite estimate covers one of four exit lines. The others are the outbound data charge plus the weeks the copy takes, both platforms billed through the overlap window, and the months still running on a term commitment.

Compatibility with an open interface normally covers the data path your application speaks, and stops at the edges: provisioning, sizing, authentication, backup and restore, telemetry, quotas and error behaviour all stay the provider's own design.

Multi-cloud covers three different architectures: the same workload live on two platforms at once, different workloads split across platforms with one home each, and a single live platform plus a documented exit plan. Each has a different bill and a different failure behaviour.