Cloud Platforms — AWS / GCP / Azure

1. Vì sao Cloud?

Trước cloud (pre-2006), công ty phải:

• Mua server, để trong datacenter / on-prem.
• Capacity plan trước 6-12 tháng (overprovisioning).
• Tự lo electricity, cooling, network.
• Hire sysadmin 24/7.

2006 AWS ra mắt S3 + EC2 → thay đổi hoàn toàn. Cloud value:

• Pay-as-you-go — không CapEx, OpEx theo use.
• Elastic — scale up/down trong phút.
• Global reach — deploy ở 30+ region trong giờ.
• Managed services — không tự maintain DB, queue, cache.
• Cutting-edge tech — GPU H100, custom silicon (Graviton, TPU).

1.1. Cloud trade-offs

1.2. Market share 2024

2. IaaS / PaaS / SaaS — 3 service model

2.1. IaaS — Infrastructure as a Service

Bạn rent VM, bạn quản lý OS + app. Examples: EC2, GCE, Azure VM.

2.2. PaaS — Platform as a Service

Bạn push code, provider chạy. Không lo OS. Examples: Heroku, AWS Elastic Beanstalk, GCP App Engine, Azure App Service.

2.3. Serverless / FaaS

Provider chạy code khi event (HTTP, queue). Pay per execution. Examples: AWS Lambda, GCP Cloud Functions, Azure Functions, Cloudflare Workers.

2.4. SaaS — Software as a Service

App đầy đủ, end user dùng. Examples: Gmail, Slack, GitHub, Datadog.

2.5. CaaS — Container as a Service

Run container không quản node. Examples: AWS Fargate, GCP Cloud Run, Azure Container Apps.

3. Region, Availability Zone, Edge

3.1. Region

Region = geographic area (us-east-1 = Northern Virginia). Mỗi region:

• Có 2-6 AZ.
• Isolate hoàn toàn — region die không ảnh hưởng region khác.
• Latency khác nhau (us-east-1 ↔ ap-southeast-1 ~250ms).
• Pricing khác (us-east-1 thường rẻ nhất).

3.2. Availability Zone (AZ)

AZ = data center vật lý isolated trong region (power, network, cooling riêng). Multi-AZ deployment:

• Latency giữa AZ < 1ms (within region).
• Dùng cho HA: web app trải 3 AZ → 1 AZ die còn 2.

3.3. Edge / PoP

CloudFront / Cloud CDN / Front Door — edge location toàn cầu, cache content gần user. ~400+ PoP toàn cầu.

3.4. So sánh region naming

4. Compute — VM

4.1. Instance types

Mỗi cloud có family:

• General: t3, t4g (AWS), n2 (GCP), B/D (Azure) — balanced.
• Compute-optimized: c5, c6 (AWS), c2 (GCP), F (Azure) — high CPU.
• Memory-optimized: r5, x2 (AWS), m2 (GCP), E (Azure) — DB.
• Storage-optimized: i3 (AWS), local SSD — DB heavy I/O.
• GPU: p4, g5 (AWS), a2 (GCP) — ML/training.

4.2. Pricing model

• On-demand — full price, pay per hour/sec.
• Reserved (1-3 năm) — discount 40-72% nhưng cam kết.
• Spot/Preemptible — discount 60-90% nhưng có thể bị reclaim 30s notice.
• Savings Plan (AWS) — flexible commitment.

4.3. Spot/Preemptible best practice

Use case: stateless worker, batch job, CI runner. Tránh: stateful DB, single-instance critical.

# Terraform: spot instance
resource "aws_instance" "ci_runner" {
  ami           = "ami-..."
  instance_type = "c5.xlarge"

  instance_market_options {
    market_type = "spot"
    spot_options {
      max_price = "0.05"               # $0.05/hour max
      spot_instance_type = "one-time"
    }
  }
}

# K8s với spot
# AWS Karpenter / Cluster Autoscaler set node pool spot

4.4. Launch template + Auto Scaling Group

resource "aws_launch_template" "web" {
  image_id      = data.aws_ami.amazon_linux.id
  instance_type = "t3.medium"

  user_data = base64encode(templatefile("init.sh", {
    region = var.region
  }))

  network_interfaces {
    security_groups = [aws_security_group.web.id]
  }
}

resource "aws_autoscaling_group" "web" {
  name                = "web-asg"
  vpc_zone_identifier = aws_subnet.public[*].id
  min_size            = 2
  max_size            = 10
  desired_capacity    = 4
  health_check_type   = "ELB"
  target_group_arns   = [aws_lb_target_group.web.arn]

  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }

  tag {
    key                 = "Name"
    value               = "web"
    propagate_at_launch = true
  }
}

5. Storage

5.1. Object Storage — S3 / GCS / Blob

5.2. S3 example

# Tạo bucket
aws s3 mb s3://my-app-bucket --region us-east-1

# Upload
aws s3 cp file.txt s3://my-app-bucket/
aws s3 sync ./dist s3://my-app-bucket/ --delete

# Download
aws s3 cp s3://my-app-bucket/file.txt .

# Set encryption + versioning
aws s3api put-bucket-encryption --bucket my-app-bucket \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

aws s3api put-bucket-versioning --bucket my-app-bucket \
  --versioning-configuration Status=Enabled

# Lifecycle (move to Glacier sau 90 ngày)
aws s3api put-bucket-lifecycle-configuration --bucket my-app-bucket \
  --lifecycle-configuration file://lifecycle.json

5.3. Block Storage — EBS / Persistent Disk / Managed Disk

Block storage attach vào VM. Persistence ngoài lifecycle VM.

5.4. File Storage — EFS / Filestore / Files

NFS-compatible, RWX (mount nhiều VM).

• AWS EFS — POSIX, scale tự động.
• GCP Filestore — managed NFS.
• Azure Files — SMB + NFS.
• FSx (AWS) — Lustre, NetApp, Windows File Server.

6. Networking & VPC

6.1. VPC concept

VPC = isolated network trong cloud, có CIDR range (vd 10.0.0.0/16). Chia subnet (public/private), security group, NACL, route table.

6.2. Public vs Private subnet

6.3. Security Group vs NACL

• Security Group (SG) — stateful firewall ở instance level. Allow only (no deny rule).
• Network ACL (NACL) — stateless firewall ở subnet level. Allow + deny.

Practical: dùng SG cho 99% case. NACL chỉ cho subnet-wide block (IP blacklist).

resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    cidr_blocks     = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# DB SG — chỉ cho web SG access
resource "aws_security_group" "db" {
  name   = "db-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.web.id]    # SG-as-source!
  }
}

6.4. Load Balancer

6.5. CDN

• AWS CloudFront — 400+ PoP, integrate S3, ALB.
• GCP Cloud CDN — Anycast IP.
• Azure CDN / Azure Front Door.
• Third-party: Cloudflare, Fastly, Akamai.

6.6. Egress cost — silent killer

Cách giảm: CDN (cache reduce egress), VPC Endpoint (S3 không qua internet), Direct Connect (commit pricing thấp hơn).

7. IAM — Identity & Access Management

7.1. Concepts

• User / ServiceAccount — identity.
• Group — collection of users.
• Role — collection of permissions; users/services assume.
• Policy — JSON rules (allow/deny actions on resources).

7.2. AWS IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadS3",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    },
    {
      "Sid": "DenyDelete",
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "*"
    }
  ]
}

7.3. IAM principles

1. Least privilege — grant minimum permissions needed.
2. No long-lived keys — dùng IAM Role + STS, OIDC từ GitHub.
3. MFA mọi root account.
4. Tách environment — prod ở account riêng, không share role với dev.
5. Audit — CloudTrail (AWS), Cloud Audit Logs (GCP), Activity Log (Azure).
6. Tag-based access control (ABAC) — scale hơn role-based.

7.4. AWS Organizations / GCP Org / Azure Tenant

Multi-account hierarchy:

Service Control Policy (SCP) ở org level — guardrails (vd: prod account không xóa được S3 bucket).

7.5. IAM trong Terraform — OIDC GHA

# GitHub OIDC provider
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["1b511abead59c6ce207077c0bf0e0043b1382612"]
}

# Role assume được bởi GitHub Actions
resource "aws_iam_role" "gha_deploy" {
  name = "gha-deploy"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.github.arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
        }
        StringLike = {
          "token.actions.githubusercontent.com:sub" = "repo:myorg/myrepo:ref:refs/heads/main"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "gha_deploy" {
  role       = aws_iam_role.gha_deploy.name
  policy_arn = aws_iam_policy.deploy.arn
}

8. Managed Kubernetes — EKS / GKE / AKS

8.1. EKS quick start

# eksctl (CLI dễ nhất)
eksctl create cluster \
  --name dev-cluster \
  --region us-east-1 \
  --version 1.28 \
  --nodegroup-name workers \
  --node-type t3.medium \
  --nodes 3 \
  --nodes-min 1 \
  --nodes-max 10 \
  --managed

# Connect
aws eks update-kubeconfig --name dev-cluster --region us-east-1
kubectl get nodes

8.2. Production-grade với Terraform

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "prod-cluster"
  cluster_version = "1.28"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access = true

  cluster_addons = {
    coredns                = { addon_version = "v1.10.1-eksbuild.7" }
    kube-proxy             = {}
    vpc-cni                = {}
    aws-ebs-csi-driver     = {}
  }

  eks_managed_node_groups = {
    general = {
      desired_size = 3
      min_size     = 2
      max_size     = 10
      instance_types = ["t3.medium"]
    }

    spot = {
      desired_size = 2
      min_size     = 0
      max_size     = 20
      instance_types = ["c5.large", "c5a.large", "m5.large"]
      capacity_type  = "SPOT"
    }
  }
}

8.3. GKE Autopilot (zero-config)

gcloud container clusters create-auto autopilot-cluster \
  --region=us-central1

Autopilot: Google quản node, billing per Pod resource (request CPU/RAM). Phù hợp team không muốn lo node management.

9. Serverless / Functions

9.1. AWS Lambda

// index.js
exports.handler = async (event) => {
  console.log('Event:', JSON.stringify(event));

  return {
    statusCode: 200,
    body: JSON.stringify({ message: 'Hello!' }),
  };
};

# Deploy với SAM
sam init --runtime nodejs20.x
sam build
sam deploy --guided

# Hoặc Terraform

9.2. Lambda pricing

• Free tier: 1M request + 400,000 GB-second/month.
• Sau đó: $0.20/1M request + $0.0000166667/GB-s.
• 1M request 128MB chạy 200ms = ~$0.20 + $0.42 = ~$0.62.

So sánh với EC2 t3.micro $7.5/month: Lambda rẻ hơn cho traffic < ~3M request/month, đắt hơn cho continuous load.

9.3. Cold start

Lambda có thể "ngủ" nếu không có request. Request đầu tiên: cold start (init runtime, load code) — 100ms - vài giây.

Mitigations:

• Provisioned Concurrency — pre-warm N instance ($).
• Languages khởi động nhanh: Go, Rust, Python > Java, .NET.
• Lambda SnapStart (Java) — pre-init snapshot.
• Smaller deployment package.

9.4. Use cases serverless

• API GW + Lambda — REST API simple.
• S3 trigger — process upload.
• Cron — EventBridge schedule.
• Stream processing — Kinesis/SQS triggers.
• Webhook handler.

9.5. Cloud Run (GCP) — middle ground

gcloud run deploy myapp \
  --image gcr.io/myproject/myapp:1.0 \
  --platform managed \
  --region us-central1 \
  --allow-unauthenticated

Cloud Run = container serverless. Pay per request, scale-to-zero, max 60min request. Tốt hơn Lambda cho:

• Long-running request (Lambda max 15min).
• Container portability (any language).
• Less vendor lock-in.

Equivalent: AWS App Runner, Azure Container Apps.

10. Managed Databases

10.1. RDS example (Terraform)

resource "aws_db_subnet_group" "default" {
  name       = "main"
  subnet_ids = module.vpc.database_subnets
}

resource "aws_db_instance" "main" {
  identifier              = "myapp-prod"
  engine                  = "postgres"
  engine_version          = "15.4"
  instance_class          = "db.r5.large"
  allocated_storage       = 100
  storage_type            = "gp3"
  storage_encrypted       = true

  db_name                 = "myapp"
  username                = "app"
  password                = var.db_password   # Vault / Secrets Manager

  multi_az                = true              # HA
  backup_retention_period = 30
  backup_window           = "02:00-04:00"
  maintenance_window      = "sun:04:00-sun:05:00"

  performance_insights_enabled = true

  deletion_protection = true

  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.default.name

  skip_final_snapshot = false
  final_snapshot_identifier = "myapp-prod-final"
}

10.2. Backup & Recovery

• Snapshot — point-in-time backup, restore tạo DB mới.
• PITR (Point-In-Time Recovery) — restore tới timestamp cụ thể (within retention).
• Cross-region snapshot — DR.
• Read replica — async replication, read scaling.

11. Cost Management & FinOps

11.1. Cost monitoring

• AWS Cost Explorer — view spend, forecast.
• GCP Cost / Budget alerts.
• Azure Cost Management.
• Third-party: Vantage, Infracost (Terraform), CloudHealth, Datadog.

11.2. Common cost traps

11.3. Reserved Instances / Savings Plans

Cam kết 1-3 năm cho discount 40-72%. Phù hợp baseline traffic. On-demand cho burst.

AWS Compute Savings Plans linh hoạt nhất — apply EC2/Lambda/Fargate.

11.4. FinOps practices

1. Tag mọi resource (Owner, Project, Env, CostCenter).
2. Showback / Chargeback — chia phí theo team/project.
3. Budget alert — Slack notification khi vượt 80%.
4. Right-sizing — review monthly utilization.
5. Auto shutdown dev/staging cuối ngày.
6. Spot for stateless.
7. Reserved cho predictable.

12. Multi-cloud strategy

12.1. Lý do multi-cloud

• Avoid vendor lock-in.
• Best-of-breed per workload (BigQuery cho analytics, AWS cho legacy).
• Compliance (data sovereignty per region).
• Negotiation leverage.
• Disaster recovery cross-cloud.

12.2. Khó khăn multi-cloud

• Skill: team phải biết 2-3 cloud → expensive.
• Network: cross-cloud networking phức tạp + đắt egress.
• Security: IAM khác nhau, audit khó.
• Cost optimization khó (cant negotiate volume).
• Tooling: K8s + Terraform + Crossplane help nhưng vẫn cần per-cloud expertise.

12.3. Realistic patterns

• Primary + DR: AWS chính, GCP backup. Active-passive.
• Best-of-breed: AWS infra + GCP BigQuery + Cloudflare CDN.
• Compliance split: EU data ở Azure EU, US data ở AWS.
• Hybrid: on-prem chính + cloud burst.

Avoid: "true multi-cloud active-active" — overhead phần lớn không xứng. Đa số công ty thắng khi single-cloud + multi-region.

13. Bài tập

1. Cloud account: setup AWS Free Tier, GCP $300 credit, hoặc Azure $200 credit. Setup MFA cho root account.
2. EC2 first server: launch t3.micro, SSH vào, install nginx, expose qua public IP.
3. VPC custom: tạo VPC 10.99.0.0/16 với 2 public + 2 private + 2 DB subnet ở 2 AZ. NAT Gateway. Verify private subnet có internet egress.
4. Multi-tier app: web (public subnet, ALB) + app (private subnet) + RDS (DB subnet). Security Group chain: ALB → web → DB.
5. S3 + lifecycle: tạo bucket. Upload file. Setup versioning. Lifecycle: transition to IA sau 30 ngày, Glacier sau 90, expire sau 365.
6. IAM least privilege: tạo user "developer" chỉ có quyền read EC2, write S3 1 bucket cụ thể. Test bằng aws sts assume-role.
7. OIDC GitHub: setup IAM OIDC provider + role cho GitHub Actions deploy S3. Workflow assume role không cần long-lived key.
8. EKS cluster: dùng eksctl tạo cluster 3-node. Deploy app. Sau test, eksctl delete cluster để khỏi tốn.
9. Lambda + API GW: viết Lambda Hello World, expose qua API Gateway. Test với curl.
10. Cloud Run: container hóa app, deploy lên GCP Cloud Run. Verify scale-to-zero (sleep 5 phút, hit lại — cold start).
11. RDS Postgres: deploy db.t3.micro multi-AZ. Connect từ EC2 trong VPC. Backup snapshot. Restore.
12. Cost analysis: review AWS Cost Explorer / Billing 30 ngày. Identify top 5 spend. Đề xuất 3 optimizations.
13. Cross-cloud: setup VPN giữa AWS VPC và GCP VPC (hoặc Cloud Interconnect). Ping VM cross-cloud.
14. Disaster recovery drill: backup RDS cross-region. Simulate region failure: terminate primary, restore từ snapshot ở region 2. Đo RTO/RPO.

14. Quiz