System Design: Cloud Architecture Concepts

Master Cloud service models (IaaS, PaaS, SaaS), Multi-Region and Multi-AZ topologies, Twelve-Factor Cloud-Native design, Serverless architectures, Infrastructure as Code with Terraform, and FinOps cost optimization.

1. Cloud Service Models & The Shared Responsibility Model

Cloud computing architectures are categorized based on the abstraction layer provided to developers. Under the Shared Responsibility Model, security and operational duties divide between the cloud service provider (AWS, GCP, Azure) and the customer.

Cloud Service Models (IaaS, PaaS, FaaS, SaaS) & Ownership Stack

System Design

Comparing customer vs provider management across hardware, OS, runtime, and application layers

100%

Loading system design canvas…

[
  {
    "id": "sm-iaas",
    "type": "rectangle",
    "x": 30,
    "y": 40,
    "width": 200,
    "height": 260,
    "strokeColor": "#2563eb",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22000,
    "version": 1,
    "versionNonce": 22001,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sm-iaas-text"
      }
    ]
  },
  {
    "id": "sm-iaas-text",
    "type": "text",
    "x": 40,
    "y": 101.25,
    "width": 180,
    "height": 137.5,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22002,
    "version": 1,
    "versionNonce": 22003,
    "isDeleted": false,
    "text": "1. IaaS (Infrastructure)\n(AWS EC2, GCP GCE)\n\nCustomer Manages:\n• Application Code\n• Data & Database\n• Runtime & Middleware\n• Operating System\n\nProvider Manages:\n• Hypervisor & Hardware",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "1. IaaS (Infrastructure)\n(AWS EC2, GCP GCE)\n\nCustomer Manages:\n• Application Code\n• Data & Database\n• Runtime & Middleware\n• Operating System\n\nProvider Manages:\n• Hypervisor & Hardware",
    "containerId": "sm-iaas"
  },
  {
    "id": "sm-paas",
    "type": "rectangle",
    "x": 245,
    "y": 40,
    "width": 200,
    "height": 260,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22004,
    "version": 1,
    "versionNonce": 22005,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sm-paas-text"
      }
    ]
  },
  {
    "id": "sm-paas-text",
    "type": "text",
    "x": 255,
    "y": 101.25,
    "width": 180,
    "height": 137.5,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22006,
    "version": 1,
    "versionNonce": 22007,
    "isDeleted": false,
    "text": "2. PaaS (Platform)\n(Elastic Beanstalk, Heroku)\n\nCustomer Manages:\n• Application Code\n• Data & Configurations\n\nProvider Manages:\n• OS Patching\n• Runtime Updates\n• Autoscaling & Hardware",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "2. PaaS (Platform)\n(Elastic Beanstalk, Heroku)\n\nCustomer Manages:\n• Application Code\n• Data & Configurations\n\nProvider Manages:\n• OS Patching\n• Runtime Updates\n• Autoscaling & Hardware",
    "containerId": "sm-paas"
  },
  {
    "id": "sm-faas",
    "type": "rectangle",
    "x": 460,
    "y": 40,
    "width": 200,
    "height": 260,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22008,
    "version": 1,
    "versionNonce": 22009,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sm-faas-text"
      }
    ]
  },
  {
    "id": "sm-faas-text",
    "type": "text",
    "x": 470,
    "y": 101.25,
    "width": 180,
    "height": 137.5,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22010,
    "version": 1,
    "versionNonce": 22011,
    "isDeleted": false,
    "text": "3. FaaS (Serverless)\n(AWS Lambda, Cloud Run)\n\nCustomer Manages:\n• Stateless Function Code\n• Event Triggers\n\nProvider Manages:\n• Scale from 0 to N\n• Infrastructure & OS\n• Execution Lifecycle",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "3. FaaS (Serverless)\n(AWS Lambda, Cloud Run)\n\nCustomer Manages:\n• Stateless Function Code\n• Event Triggers\n\nProvider Manages:\n• Scale from 0 to N\n• Infrastructure & OS\n• Execution Lifecycle",
    "containerId": "sm-faas"
  },
  {
    "id": "sm-saas",
    "type": "rectangle",
    "x": 675,
    "y": 40,
    "width": 200,
    "height": 260,
    "strokeColor": "#d97706",
    "backgroundColor": "#fffbeb",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22012,
    "version": 1,
    "versionNonce": 22013,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sm-saas-text"
      }
    ]
  },
  {
    "id": "sm-saas-text",
    "type": "text",
    "x": 685,
    "y": 107.5,
    "width": 180,
    "height": 125,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22014,
    "version": 1,
    "versionNonce": 22015,
    "isDeleted": false,
    "text": "4. SaaS (Software)\n(Google Workspace, Slack)\n\nCustomer Manages:\n• User Access & Settings\n\nProvider Manages:\n• 100% of the entire stack\n(App, DB, OS, Hardware,\nSecurity & Upgrades)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "4. SaaS (Software)\n(Google Workspace, Slack)\n\nCustomer Manages:\n• User Access & Settings\n\nProvider Manages:\n• 100% of the entire stack\n(App, DB, OS, Hardware,\nSecurity & Upgrades)",
    "containerId": "sm-saas"
  }
]

`IaaS vs PaaS vs FaaS`

Selecting the appropriate control vs operational overhead trade-off.

IaaS (EC2, GCE): Full OS control; maximum flexibility with high patch management burden
PaaS (Beanstalk, Heroku): Managed OS and runtime; developers focus on application code
FaaS (AWS Lambda, Cloud Functions): Ephemeral event-driven execution scaling from 0 to N
SaaS (Slack, Salesforce): Fully managed turn-key software solutions

`Shared Responsibility Model`

Dividing security responsibilities.

Security OF the Cloud (Provider): Physical datacenter security, power, hypervisor virtualization, and hardware firmware
Security IN the Cloud (Customer): Network firewall rules (Security Groups), IAM role access, OS patching (IaaS), data encryption, and application vulnerabilities

2. Multi-Region and Multi-AZ (Availability Zone) Architecture

An Availability Zone (AZ) consists of one or more physically isolated datacenters with redundant power and networking. A Region contains 3+ AZs separated by geographical distance. Systems employ Multi-AZ for High Availability (HA) and Multi-Region for global low-latency and Disaster Recovery (DR).

Multi-Region & Multi-AZ Global Cloud High Availability Architecture

System Design

Combining Route53 Geo-DNS routing, sub-millisecond Multi-AZ sync replication, and cross-region DR async sync

100%

Loading system design canvas…

[
  {
    "id": "mr-dns",
    "type": "rectangle",
    "x": 315,
    "y": 30,
    "width": 260,
    "height": 45,
    "strokeColor": "#2563eb",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22016,
    "version": 1,
    "versionNonce": 22017,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-dns-text"
      }
    ]
  },
  {
    "id": "mr-dns-text",
    "type": "text",
    "x": 325,
    "y": 38.5,
    "width": 240,
    "height": 28,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22018,
    "version": 1,
    "versionNonce": 22019,
    "isDeleted": false,
    "text": "Global Route53 Geo-DNS / Anycast",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Global Route53 Geo-DNS / Anycast",
    "containerId": "mr-dns"
  },
  {
    "id": "mr-a1",
    "type": "arrow",
    "x": 380,
    "y": 75,
    "width": -150,
    "height": 30,
    "strokeColor": "#2563eb",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        -150,
        30
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 22020,
    "version": 1,
    "versionNonce": 22021,
    "isDeleted": false
  },
  {
    "id": "mr-a2",
    "type": "arrow",
    "x": 510,
    "y": 75,
    "width": 150,
    "height": 30,
    "strokeColor": "#2563eb",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        150,
        30
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 22022,
    "version": 1,
    "versionNonce": 22023,
    "isDeleted": false
  },
  {
    "id": "mr-r1",
    "type": "rectangle",
    "x": 30,
    "y": 105,
    "width": 400,
    "height": 185,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22024,
    "version": 1,
    "versionNonce": 22025,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-r1-text"
      }
    ]
  },
  {
    "id": "mr-r1-text",
    "type": "text",
    "x": 40,
    "y": 183.5,
    "width": 380,
    "height": 28,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22026,
    "version": 1,
    "versionNonce": 22027,
    "isDeleted": false,
    "text": "Primary Region: US-East-1",
    "fontSize": 12,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Primary Region: US-East-1",
    "containerId": "mr-r1"
  },
  {
    "id": "mr-az1",
    "type": "rectangle",
    "x": 45,
    "y": 140,
    "width": 175,
    "height": 135,
    "strokeColor": "#10b981",
    "backgroundColor": "#d1fae5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22028,
    "version": 1,
    "versionNonce": 22029,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-az1-text"
      }
    ]
  },
  {
    "id": "mr-az1-text",
    "type": "text",
    "x": 55,
    "y": 179.375,
    "width": 155,
    "height": 56.25,
    "strokeColor": "#047857",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22030,
    "version": 1,
    "versionNonce": 22031,
    "isDeleted": false,
    "text": "Availability Zone A\n\n• ALB Ingress\n• Web App Pods (AZ-A)\n• Primary DB (Read/Write)",
    "fontSize": 9,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Availability Zone A\n\n• ALB Ingress\n• Web App Pods (AZ-A)\n• Primary DB (Read/Write)",
    "containerId": "mr-az1"
  },
  {
    "id": "mr-az2",
    "type": "rectangle",
    "x": 235,
    "y": 140,
    "width": 180,
    "height": 135,
    "strokeColor": "#10b981",
    "backgroundColor": "#d1fae5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22032,
    "version": 1,
    "versionNonce": 22033,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-az2-text"
      }
    ]
  },
  {
    "id": "mr-az2-text",
    "type": "text",
    "x": 245,
    "y": 179.375,
    "width": 160,
    "height": 56.25,
    "strokeColor": "#047857",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22034,
    "version": 1,
    "versionNonce": 22035,
    "isDeleted": false,
    "text": "Availability Zone B\n\n• Standby Web Pods\n• Sync Standby DB (HA)\n(Sub-1ms Sync Replication)",
    "fontSize": 9,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Availability Zone B\n\n• Standby Web Pods\n• Sync Standby DB (HA)\n(Sub-1ms Sync Replication)",
    "containerId": "mr-az2"
  },
  {
    "id": "mr-crr",
    "type": "arrow",
    "x": 430,
    "y": 195,
    "width": 30,
    "height": 0,
    "strokeColor": "#d97706",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "dashed",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        30,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 22036,
    "version": 1,
    "versionNonce": 22037,
    "isDeleted": false
  },
  {
    "id": "mr-r2",
    "type": "rectangle",
    "x": 460,
    "y": 105,
    "width": 400,
    "height": 185,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22038,
    "version": 1,
    "versionNonce": 22039,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-r2-text"
      }
    ]
  },
  {
    "id": "mr-r2-text",
    "type": "text",
    "x": 470,
    "y": 183.5,
    "width": 380,
    "height": 28,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22040,
    "version": 1,
    "versionNonce": 22041,
    "isDeleted": false,
    "text": "Secondary Region: EU-West-1 (DR / Edge)",
    "fontSize": 12,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Secondary Region: EU-West-1 (DR / Edge)",
    "containerId": "mr-r2"
  },
  {
    "id": "mr-az3",
    "type": "rectangle",
    "x": 475,
    "y": 140,
    "width": 175,
    "height": 135,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#ede9fe",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22042,
    "version": 1,
    "versionNonce": 22043,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-az3-text"
      }
    ]
  },
  {
    "id": "mr-az3-text",
    "type": "text",
    "x": 485,
    "y": 179.375,
    "width": 155,
    "height": 56.25,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22044,
    "version": 1,
    "versionNonce": 22045,
    "isDeleted": false,
    "text": "Availability Zone A\n\n• Local EU ALB\n• Local Web Pods\n• Read Replica DB",
    "fontSize": 9,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Availability Zone A\n\n• Local EU ALB\n• Local Web Pods\n• Read Replica DB",
    "containerId": "mr-az3"
  },
  {
    "id": "mr-az4",
    "type": "rectangle",
    "x": 665,
    "y": 140,
    "width": 180,
    "height": 135,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#ede9fe",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22046,
    "version": 1,
    "versionNonce": 22047,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "mr-az4-text"
      }
    ]
  },
  {
    "id": "mr-az4-text",
    "type": "text",
    "x": 675,
    "y": 179.375,
    "width": 160,
    "height": 56.25,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22048,
    "version": 1,
    "versionNonce": 22049,
    "isDeleted": false,
    "text": "Availability Zone B\n\n• Disaster Recovery Warm\n• Cross-Region Async Sync\n(RPO < 1s, RTO < 2m)",
    "fontSize": 9,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Availability Zone B\n\n• Disaster Recovery Warm\n• Cross-Region Async Sync\n(RPO < 1s, RTO < 2m)",
    "containerId": "mr-az4"
  }
]

`Multi-AZ Architecture (High Availability)`

Defends against local datacenter fires, power cuts, and hardware outages.

Sub-millisecond fiber optic connections between AZs (<1ms latency)
Synchronous database replication (Multi-AZ RDS / Aurora)
Zero downtime automated failover during datacenter faults

`Multi-Region Architecture (Disaster Recovery & Global Scale)`

Defends against entire geographic cloud region outages.

Geo-DNS & Anycast Routing: Routes users to nearest geographic region
Cross-Region Replication (CRR): Asynchronous replication of S3 assets & DynamoDB Global Tables
Compliance & Data Residency: Keeps citizen data stored in required sovereign boundaries (GDPR)

3. Cloud-Native Design Principles & The Twelve-Factor App

Cloud-native systems are purpose-built for elasticity and resilience in dynamic cloud environments. They embrace the Twelve-Factor App methodology, treating infrastructure as disposable Cattle, not Pets.

The Twelve-Factor Cloud-Native Architecture Ecosystem

System Design

Stateless process models, environment configuration isolation, disposability, and backing service attachments

100%

Rendering diagram…

flowchart TD
    subgraph TwelveFactor ["Twelve-Factor Cloud-Native Architecture Principles"]
        direction TB
        Code["1. Codebase: Single Git repo, multiple deploys"]
        Deps["2. Dependencies: Explicitly isolated manifests (package.json / Docker)"]
        Config["3. Config: Strict separation of config in Environment Variables"]
        Backing["4. Backing Services: Attached resources via URLs (DB, S3, Redis)"]
        Build["5. Build, Release, Run: Strict immutable release stages"]
        Stateless["6. Processes: Execute as stateless, share-nothing processes"]
        Port["7. Port Binding: Export services via HTTP port binding"]
        Concur["8. Concurrency: Scale out horizontally via process model"]
        Dispos["9. Disposability: Fast startup & graceful SIGTERM shutdown"]
        DevProd["10. Dev/Prod Parity: Keep development, staging, & prod identical"]
        Logs["11. Logs: Treat logs as unbuffered event streams to stdout"]
        Admin["12. Admin Processes: Run migration scripts as one-off tasks"]
    end

    classDef tfStyle fill:#eff6ff,stroke:#2563eb,stroke-width:2px,color:#1e40af;
    class Code,Deps,Config,Backing,Build,Stateless,Port,Concur,Dispos,DevProd,Logs,Admin tfStyle;

`Core Tenets of Cloud-Native Architecture`

Designing systems that thrive on change and failure.

Cattle vs Pets: Never manually SSH into or configure servers; treat compute as ephemeral and replaceable via automated autoscaling
Stateless Compute: Store zero session state on local server disks; persist state in distributed caches (Redis) and object stores (S3)
Graceful Disposability: Fast startup and graceful handling of SIGTERM signals to finish in-flight requests during rolling updates
Asynchronous Decoupling: Use event buses (EventBridge, SQS, Kafka) to prevent cascading failures across services

4. Serverless Architecture (AWS Lambda & Event-Driven Compute)

Serverless computing abstracts server management entirely. Functions execute on-demand in response to events (HTTP calls, S3 uploads, database stream changes), automatically scaling from 0 to tens of thousands of concurrent instances with pay-per-millisecond billing.

Serverless Event-Driven Invocation & Cold Start vs Warm Execution Lifecycle

System Design

Tracing microVM container provisioning (Firecracker), runtime bootstrapping, and sub-30ms warm executions

100%

Rendering diagram…

sequenceDiagram
    autonumber
    actor User as User / Mobile Client
    participant APIGW as API Gateway
    participant Lambda as AWS Lambda Service
    participant S3 as S3 Bucket / DynamoDB

    Note over User,APIGW: HTTP POST /upload-avatar
    APIGW->>Lambda: Route Request Event
    
    alt Cold Start (No idle container available)
        Note over Lambda: 1. Provision microVM (Firecracker - 150ms)
        Note over Lambda: 2. Download code & bootstrap runtime (100ms)
        Note over Lambda: 3. Run global init code (DB connection - 80ms)
    else Warm Invocation (Reusing active container)
        Note over Lambda: Container already warm! (0ms startup latency)
    end

    Lambda->>Lambda: Execute handler(event, context)
    Lambda->>S3: PutObject (avatar_compressed.webp)
    Lambda-->>APIGW: Return { statusCode: 200, url: 'https://...' }
    APIGW-->>User: 200 OK (Processed in 25ms warm / 355ms cold)

`Cold Starts & Mitigation Techniques`

Understanding the latency penalty of spinning up new serverless instances.

Cold Start Cause: Downloading code, provisioning microVM, and initializing language runtime
Provisioned Concurrency: Keeps a pre-warmed pool of Lambda containers ready for instant sub-millisecond execution
Global Connection Caching: Instantiate database clients outside the handler function to reuse connections across warm calls

`Serverless Architectural Constraints`

Designing around serverless execution boundaries.

Execution Timeout: Max 15 minutes per function invocation (AWS Lambda)
Stateless Memory: Temporary /tmp storage is ephemeral and cleared between instances
Concurrency Limits: Account-level concurrency limits (e.g. 1000 concurrent executions) require SQS buffering

Production Serverless Image Optimizer Handler (AWS Lambda + S3 in Node.js)

An AWS Lambda handler that resizes images on-the-fly and stores the output back in S3.

5. Infrastructure as Code (Terraform & GitOps Automation)

Infrastructure as Code (IaC) replaces manual cloud console clicking with version-controlled, declarative configuration files. Terraform (HCL) is the industry standard, allowing teams to plan, review, and automate infrastructure changes via GitOps pipelines.

Terraform GitOps Plan & Apply CI/CD Pipeline Architecture

System Design

Automated Pull Request plan generation, DynamoDB state locking, and S3 remote state management

100%

Rendering diagram…

flowchart LR
    Dev[Software Engineer] -- 1. Author HCL Code & Open Pull Request --> Git[GitHub Repository]
    
    subgraph CI [CI Pipeline / GitHub Actions]
        Git --> TInit[terraform init]
        TInit --> TPlan[terraform plan<br/>Calculates exact state diff]
        TPlan --> PRComment[Post Plan Summary Diff to PR Comment]
    end

    PRComment -- 2. Code Review & Approval --> Merge[Merge to Main Branch]

    subgraph CD [Automated CD Pipeline]
        Merge --> TLock[Acquire DynamoDB State Lock]
        TLock --> TApply[terraform apply -auto-approve]
        TApply --> CloudInfra[Cloud API calls provision VPC, RDS, K8s cluster]
        TApply --> S3State[(S3 Remote State Storage: terraform.tfstate)]
        S3State --> Release[Release State Lock]
    end

    classDef gitStyle fill:#eff6ff,stroke:#2563eb,stroke-width:2px,color:#1e40af;
    classDef ciStyle fill:#fef3c7,stroke:#d97706,stroke-width:2px,color:#92400e;
    classDef cdStyle fill:#ecfdf5,stroke:#059669,stroke-width:2px,color:#065f46;

    class Dev,Git,Merge gitStyle;
    class TInit,TPlan,PRComment ciStyle;
    class TLock,TApply,CloudInfra,S3State,Release cdStyle;

`Terraform Core Principles & Remote State`

Managing reproducible cloud environments.

Declarative Syntax: Declare the desired end state (HCL); Terraform calculates the exact steps to achieve it
State Management (terraform.tfstate): Maps your code definitions to real-world cloud resource IDs; stored securely in remote S3 buckets with encryption
State Locking: Uses DynamoDB locks to prevent two engineers or CI pipelines from applying concurrent updates simultaneously

Production Terraform HCL Manifest: Multi-AZ VPC & S3 Cost Lifecycle Tiering

A Terraform configuration that provisions a multi-AZ VPC and applies S3 lifecycle rules for cost-efficient storage tiering.

6. Cloud Cost Optimization Strategies (FinOps & Resource Right-Sizing)

Unmonitored cloud spending quickly spirals out of control. FinOps establishes financial accountability by combining compute purchasing commitments, automated resource right-sizing, storage lifecycle tiering, and data egress minimization.

Cloud Cost Optimization Strategy Matrix (Compute, Storage & Networking)

System Design

Leveraging Spot/Savings Plans, S3 Intelligent-Tiering, and CDN edge egress reduction

100%

Loading system design canvas…

[
  {
    "id": "cost-comp",
    "type": "rectangle",
    "x": 30,
    "y": 40,
    "width": 260,
    "height": 260,
    "strokeColor": "#2563eb",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22050,
    "version": 1,
    "versionNonce": 22051,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "cost-comp-text"
      }
    ]
  },
  {
    "id": "cost-comp-text",
    "type": "text",
    "x": 40,
    "y": 138.75,
    "width": 240,
    "height": 62.5,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22052,
    "version": 1,
    "versionNonce": 22053,
    "isDeleted": false,
    "text": "1. Compute Pricing Models\n\n• On-Demand: Zero commitment (Highest $/hr)\n• Savings Plans / Reserved: 1-3 year commitment (Save up to 72%)\n• Spot Instances: Unused cloud capacity (Save up to 90% for batch/CI jobs)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "1. Compute Pricing Models\n\n• On-Demand: Zero commitment (Highest $/hr)\n• Savings Plans / Reserved: 1-3 year commitment (Save up to 72%)\n• Spot Instances: Unused cloud capacity (Save up to 90% for batch/CI jobs)",
    "containerId": "cost-comp"
  },
  {
    "id": "cost-stor",
    "type": "rectangle",
    "x": 315,
    "y": 40,
    "width": 260,
    "height": 260,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22054,
    "version": 1,
    "versionNonce": 22055,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "cost-stor-text"
      }
    ]
  },
  {
    "id": "cost-stor-text",
    "type": "text",
    "x": 325,
    "y": 132.5,
    "width": 240,
    "height": 75,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22056,
    "version": 1,
    "versionNonce": 22057,
    "isDeleted": false,
    "text": "2. S3 Lifecycle Tiering\n\n• S3 Standard: Active data\n• S3 Intelligent-Tiering: Auto-migrates based on access\n• S3 Glacier Instant: Infrequent\n• S3 Glacier Deep Archive: Long-term audit backup ($0.00099/GB/mo)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "2. S3 Lifecycle Tiering\n\n• S3 Standard: Active data\n• S3 Intelligent-Tiering: Auto-migrates based on access\n• S3 Glacier Instant: Infrequent\n• S3 Glacier Deep Archive: Long-term audit backup ($0.00099/GB/mo)",
    "containerId": "cost-stor"
  },
  {
    "id": "cost-net",
    "type": "rectangle",
    "x": 600,
    "y": 40,
    "width": 260,
    "height": 260,
    "strokeColor": "#d97706",
    "backgroundColor": "#fffbeb",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 22058,
    "version": 1,
    "versionNonce": 22059,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "cost-net-text"
      }
    ]
  },
  {
    "id": "cost-net-text",
    "type": "text",
    "x": 610,
    "y": 138.75,
    "width": 240,
    "height": 62.5,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 22060,
    "version": 1,
    "versionNonce": 22061,
    "isDeleted": false,
    "text": "3. Egress & Architecture\n\n• CloudFront CDN: Low-cost edge caching to avoid origin egress\n• VPC Endpoints: Keep AWS traffic within private network\n• Auto-Shutdown: Automatically stop staging VMs at 7 PM weekdays",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "3. Egress & Architecture\n\n• CloudFront CDN: Low-cost edge caching to avoid origin egress\n• VPC Endpoints: Keep AWS traffic within private network\n• Auto-Shutdown: Automatically stop staging VMs at 7 PM weekdays",
    "containerId": "cost-net"
  }
]

`1. Compute Optimization`

Slashing VM and container costs.

Spot Instances: Up to 90% discount for stateless batch jobs & worker nodes
Savings Plans: 1-3 year commitment for steady-state workloads (up to 72% discount)
Auto-Shutdown: Scripted scheduled shutdown of non-production environments

`2. Storage Lifecycle`

Auto-migrating cold data.

S3 Intelligent-Tiering: Automatically moves unaccessed objects to cheaper tiers with zero operational overhead
Glacier Deep Archive: Long-term compliance archiving at $0.00099/GB/month
EBS Snapshot Cleanup: Deleting orphaned volume snapshots

`3. Network Egress`

Minimizing cross-boundary data transfer.

CloudFront CDN: Absorbs static asset requests at edge POPs, drastically lowering origin bandwidth costs
VPC Endpoints (PrivateLink): Keeps internal S3/DynamoDB traffic off public internet to avoid NAT Gateway data fees

Knowledge Check

1. What does the customer manage under the Platform as a Service (PaaS) model?

2. What is the primary difference between an Availability Zone (AZ) and a Region?

3. What is a "Cold Start" in Serverless Function execution?

4. What is the purpose of the "terraform.tfstate" file in Infrastructure as Code?

5. How do Spot Instances help reduce cloud infrastructure compute costs?