Professor Messer 1.8 | Cloud Models & Designing the Cloud

Infrastructure as a Service (IaaS) also known as Hardware as a Service (HaaS)

Allows you to run applications on the internet using hardware owned by a third party. This model involves outsourcing equipment, while you remain responsible for managing and securing the infrastructure. Although the data is hosted externally, you have significant control over it. Commonly used by web server provider.

Bold = Client Managed

Italtic = Provider Managed

Application

Data

Runtime

Middleware

OS

Virtualization

Servers

Storage

Networking

Software as a Service (SaaS)

Provides on-demand software without the need for local installation. It offers complete application offerings, such as email distribution or payroll services, without requiring development work. Allows for central management of data and applications, with your data hosted externally. Examples include Google Mail and Office 365.

Bold = Client Managed

Italtic = Provider Managed

Application

Data

Runtime

Middleware

OS

Virtualization

Servers

Storage

Networking

Platform as a Service (PaaS)

Provides a middle ground between Software as a Service (SaaS) and Infrastructure as a Service (IaaS). There are no servers, software, maintenance teams, or HVAC systems. Users focus on development, utilizing the provided building blocks to create applications. For instance, a login screen can be implemented using the platform's pre-built components. While users do not have direct control over the data, infrastructure, or personnel, trained security professionals manage these aspects.

Bold = Client Managed

Italtic = Provider Managed

Application

Data

Runtime

Middleware

OS

Virtualization

Servers

Storage

Networking

Cloud deployment models:

Public Cloud: Available to everyone over the internet.

Community Cloud: Shared among several organizations with similar needs or compliance requirements.

Private Cloud: Exclusive to a single organization.

Hybrid Cloud: A combination of public and private clouds.

Desktop as a Service (DaaS)

Provides basic application usage by running applications on a remote server. Could be a Virtual Desktop Infrastructure (VDI). The local devices are a keyboard, mouse, and screen. Requires a minimal operating system, without the need for substantial memory or CPU power. Big network requirement as all processing and data access occur over the network/wire.

Designing the Cloud

Offers on-demand computing power, allowing you to instantly create servers or a suite of servers with a simple click. It features elasticity, enabling the scaling up or down of resources as needed. Provide access from anywhere. Multiple use the same cloud infrastructure.

Infrastructure as code (IaC)

Leverages the software-based nature of cloud environments to define servers, networks, and applications through code. Enables the efficient replication of infrastructure, akin to copying and pasting, to build out new environments quickly. Crucial aspect of cloud computing, ensuring that a perfect version can be recreated reliably.

Orchestration

Automating the management and deployment of services, allowing for the seamless appearance and disappearance of resources either automatically or at the push of a button. This capability enables the instant provisioning of entire application instances, including all servers, networks, switches, firewalls, and policies.

Allows for the dynamic movement of instances around the globe, aligning with strategies like "follow the sun." Importantly, security policies are integrated into the process, ensuring that as applications are provisioned, the correct security measures are automatically applied.

c

You want that cloud to be private, then you’re going to need some way to connect to that cloud that does not provide access from the rest of the internet

VPN
Virtual Private Cloud Gateway
VPC Endpoint

Virtual Private Network (VPN)

Site-to-site virtual private network; multiple networks at different locations are connected, allowing them to communicate securely as if they were on the same local network. Encrypts data transmitted between the sites.

Virtual Private Cloud Gateway

Provides a secure entry point for users on the Internet to access resources within a virtual private cloud. Would be able to use this to gain access to all of your virtual machines and application instances.

VPC Endpoint

Direct connection between cloud provider networks.

Virtual private cloud endpoints:

Endpoints enable secure, private connections between resources within a VPC and other services, such as storage buckets, across different cloud providers. For instance, if you have a virtual machine in a private subnet within a VPC on one cloud provider and need to access a storage bucket on a different provider, a VPC Endpoint facilitates this connection. By setting up a VPC Endpoint, you create a direct, secure link between your virtual machine and the external storage service, ensuring that data transfer occurs within the cloud provider's network without exposing it to the public internet.

VM Sprawl Avoidance

In cloud environments, it's easy to create servers, networks, and firewalls with just a click. It becomes challenging to track their connections and dependencies. This can result in a disorganized infrastructure; you’re not really sure which virtual machines connect to which applications, and you don’t know which ones you can turn off safely without affecting applications that are running in production. To avoid, implement a formal process with detailed documentation. Maintain comprehensive records of each virtual object.

VM Escape Protection

Designed to be self-contained, isolated from the host operating system and other VMs. However, it is a serious security risk where an attacker breaks out of the VM to interact with the host OS or hardware. This exploit grants control over the host and potentially other VMs, posing a significant threat.