[Quick Bites] Enterprise Cloud Infra

A weekly series on why companies draw (and connect) their cloud the way they do

You learn AWS the way most of us did. One VPC, one EC2 instance with a public IP, an S3 bucket, and a security group open to the whole world "just to see if it works". No judgment, this is only what you can imagine now with little experience in cloud

It works, it makes sense, and it looks nothing like what a company actually runs. Then you open a real enterprise architecture diagram and it's a plate of spaghetti. Boxes inside boxes, accounts connected to other accounts, arrows going through things you have never heard of.

Learning the cloud is not the same as designing for a company

When you learn AWS, you learn what each service does. S3 stores things, EC2 runs things, a VPC is your network. That is the right place to start, you can't draw anything until you know the pieces.

But a company isn't asking "what does this service do?". It is asking who is allowed to touch this, what happens when it breaks, how fast does it need to be, and who is paying for it.

Same services, different questions. That is the whole difference.

So what changes?

All the stuff that looks like over-engineering is usually a rule written down as a box:

• Many accounts instead of one, so one mistake can't take everything down.
• Private by default. Workloads don't get public IPs, only the front door faces the internet.
• Everything twice, across at least two availability zones, so one failing is boring instead of an outage.
• Locked down access. Least privilege, not an admin user for everyone.
• Logs and monitoring everywhere, because someone will eventually have to answer "what happened?".

None of this is exciting when you are learning. All of it matters when there are real customers and real money.

How we will look at it

I will use the AWS Well-Architected Framework as the checklist. It has six pillars and I am going with four:

• Security: who can reach this?
• Reliability: what happens when it breaks?
• Performance Efficiency: is it fast enough, and is it the right tool?
• Cost Optimization: where is the money going?

Note: The other two pillars are Operational Excellence and Sustainability. They matter too, I am just keeping this to four.

Each week we will take one piece of an enterprise architecture and ask the same things. What is it, why does it exist, how does it connect to everything else, and what do we need to think about for security? Names like PrivateLink and Private DNS sound scary until you know the problem they solve.

We will use the main diagram in this post as a way to build our way from the top down and talk about everything in between

Next week: the CDN

We start with the CDN (content delivery network), and no, it is not just "caching images". It shows up on a lot of enterprise diagrams for more reasons than people expect.