Skip to content

Cloud & Infrastructure

Production-grade cloud foundations for SRE/DevOps: secure by default, observable, cost-aware, and automated.

🌟 Core Principles

  • Least privilege by default (IAM policies deny-all → allow minimal).
  • Private-first networking (no public subnets for workloads unless required).
  • Multi-AZ HA, Multi-Region DR (RTO/RPO defined per service tier).
  • Immutable infra (IaC only; no manual console drift).
  • Build once, promote (same artifact across envs).
  • Everything as Code (infra, policies, alerts, runbooks).

🏢 Account / Project Structure (Landing Zone)

AWS: AWS Organizations → Root OU → sandbox/, nonprod/, prod/, shared-services/. Azure: Management Groups → Subscriptions (same split). GCP: Organization → Folders → Projects per env.

Recommended baseline accounts/projects: - shared-services: IAM, SSO, logging, security tooling. - network: core VPC/VNet, TGW/Hub, DNS, egress. - dev / stage / prod: app infrastructure. - audit: immutable logs, security lake.

🔐 Identity & Access Management (IAM)

AWS – Least-privilege policy (example)

```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "", "Resource": "", "Condition": { "BoolIfExists": { "aws:ViaAWSService": "false" } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::my-bucket/*" } ] }