Cloud, in practice

The services the course uses, side by side on AWS, Google Cloud and Azure, with the self-hosted option. Then what real companies chose, in their own words.

Equivalents

Role	AWS	Google Cloud	Azure	Self-hosted
Delivery
CDNAll bill per request and per GB out; Front Door also routes globally.	Amazon CloudFront	Cloud CDN Media CDN	Azure Front Door	Varnish NGINX
Code at the edgeFront Door offers rules, not your own code; keep edge logic small.	CloudFront Functions Lambda@Edge	Service Extensions	Front Door rules engine
DNS and traffic routingRoute 53 has latency and failover routing built in; Azure splits it out.	Amazon Route 53	Cloud DNS	Azure DNS Azure Traffic Manager	CoreDNS BIND
Global front door (anycast)Google's global load balancer serves many Regions from one anycast IP.	AWS Global Accelerator	Global external Application Load Balancer	Azure Front Door
Layer 7 load balancerPricing units differ (LCUs, rules, capacity units); new connections often dominate.	Application Load Balancer	Application Load Balancer	Azure Application Gateway	Envoy HAProxy
Layer 4 load balancerThe choice for millions of long-lived connections and fixed IPs.	Network Load Balancer	External passthrough Network Load Balancer	Azure Load Balancer	HAProxy Katran
API gatewayPriced per request: keys and quotas are useful, hot paths get expensive.	Amazon API Gateway	API Gateway Apigee	Azure API Management	Kong Gateway Envoy Gateway
Outbound internet (NAT)AWS NAT charges per GB; send S3 and DynamoDB traffic through gateway endpoints.	NAT gateway	Cloud NAT	Azure NAT Gateway
Private connectivity to servicesReach managed services and partners' APIs on private IPs, with no internet path or NAT. AWS interface endpoints bill per hour per zone plus per GB; S3 and DynamoDB gateway endpoints are free.	AWS PrivateLink	Private Service Connect	Azure Private Link
Dedicated link to your data centreA private circuit with steadier latency than a VPN. Data out from US Regions over Direct Connect is $0.02 per GB, against about $0.09 over the internet. Getting a circuit installed takes time, so teams often start with a site-to-site VPN.	AWS Direct Connect	Cloud Interconnect	Azure ExpressRoute
Compute
Virtual machinesSpot capacity is far cheaper but can be reclaimed at short notice.	Amazon EC2	Compute Engine	Azure Virtual Machines	OpenStack
Serverless containersCloud Run and Container Apps scale to zero on requests; Fargate services don't.	Amazon ECS on AWS Fargate	Cloud Run	Azure Container Apps	Knative
KubernetesSame Kubernetes API everywhere; node management and upgrades differ.	Amazon EKS	Google Kubernetes Engine	Azure Kubernetes Service	Kubernetes
Container registryKeep images in the region that pulls them, scan them for vulnerabilities, and set lifecycle rules so old images don't pile up storage.	Amazon ECR	Artifact Registry	Azure Container Registry	Harbor
FunctionsLambda runs one request per environment; Cloud Run functions can share an instance.	AWS Lambda	Cloud Run functions	Azure Functions	OpenFaaS Knative Functions
Service discovery and meshMost teams need discovery and retries long before they need a full mesh.	ECS Service Connect AWS Cloud Map	Cloud Service Mesh	Istio-based service mesh add-on for AKS	Istio Linkerd Consul
Data
Managed Postgres and MySQLThe classic engine on managed VMs; replicas copy data over the network.	Amazon RDS	Cloud SQL	Azure Database for PostgreSQL Azure Database for MySQL	PostgreSQL MySQL
Cloud-native relationalStorage is separate from compute, so replicas share one volume. Hyperscale is SQL Server; HorizonDB (Postgres) is in preview.	Amazon Aurora	AlloyDB for PostgreSQL	Azure HorizonDB (preview)Azure SQL Database Hyperscale	Neon
Distributed SQLAzure's option shards Postgres with Citus; Cosmos DB for PostgreSQL retires in 2029.	Amazon Aurora DSQL	Spanner	Azure Database for PostgreSQL elastic clusters	CockroachDB YugabyteDB Vitess Citus
Key-value and wide-columnDynamoDB bills per request; Bigtable per node; Cosmos DB per request unit.	Amazon DynamoDB Amazon Keyspaces	Bigtable	Azure Cosmos DB	Apache Cassandra ScyllaDB
Document databaseMongoDB-compatible services differ from MongoDB in features; test before migrating.	Amazon DocumentDB	Firestore	Azure Cosmos DB for NoSQL Azure Cosmos DB for MongoDB	MongoDB
CacheCaches can lose recent writes on failover; MemoryDB keeps a durable log.	Amazon ElastiCache Amazon MemoryDB	Memorystore	Azure Managed Redis	Valkey Redis
Time seriesNo dedicated Google service; Timestream for LiveAnalytics is closed to new customers.	Amazon Timestream for InfluxDB		Azure Data Explorer	Prometheus InfluxDB ClickHouse
SearchOpenSearch is the engine you tune; Google's and Azure's are managed relevance services.	Amazon OpenSearch Service	Agent Search	Azure AI Search	OpenSearch Elasticsearch
Vector searchIf your data is already in Postgres, pgvector avoids a second system.	OpenSearch Service vector search Amazon S3 Vectors	Vector Search AlloyDB AI	Azure AI Search vectors	pgvector Milvus Qdrant
Messaging
QueueOrdering is per group: SQS FIFO message groups, Service Bus sessions.	Amazon SQS	Pub/Sub (pull subscriptions)	Azure Service Bus queues Azure Queue Storage	RabbitMQ
Pub/sub fan-out and event routingFan-out copies a message per subscriber; replay is limited (EventBridge archives, Pub/Sub seek).	Amazon SNS Amazon EventBridge	Pub/Sub Eventarc	Azure Event Grid Azure Service Bus topics	NATS RabbitMQ
Task queue (rate-limited HTTP dispatch)Only Google has a dedicated service; elsewhere compose a queue and workers.		Cloud Tasks		Celery Sidekiq
Event stream (managed log)Kinesis orders within a shard; Pub/Sub only within an ordering key.	Amazon Kinesis Data Streams	Pub/Sub	Azure Event Hubs	Apache Kafka Redpanda
Managed KafkaEvent Hubs speaks the Kafka protocol on its own engine; MSK runs real Kafka.	Amazon MSK	Managed Service for Apache Kafka	Azure Event Hubs (Kafka endpoint)	Apache Kafka
Email sendingGoogle Cloud has no first-party sending service; reputation is per account.	Amazon SES		Azure Communication Services Email	Postfix
Push notifications and SMSAmazon Pinpoint reaches end of support on 30 October 2026.	Amazon SNS mobile push AWS End User Messaging	Firebase Cloud Messaging	Azure Notification Hubs Azure Communication Services SMS
Storage
Object storageRequests cost as much as storage for small objects; pack them. MinIO's open-source repository was archived in 2026.	Amazon S3	Cloud Storage	Azure Blob Storage	Ceph Garage
Archive storageMinimum storage durations and retrieval fees apply; coldest tiers take hours.	S3 Glacier storage classes	Cloud Storage Archive class	Blob Storage archive tier
Block storageZonal: a disk lives in one zone, so replicate across zones yourself.	Amazon EBS	Persistent Disk and Hyperdisk	Azure Managed Disks	Ceph RBD
File storage (NFS, SMB)Use when software needs a shared file system; object storage is cheaper.	Amazon EFS Amazon FSx	Filestore	Azure Files	CephFS
BackupOne policy for databases, disks and file systems. Copy backups to another account and region, lock the vault so a compromised admin can't delete them, and test restores.	AWS Backup	Backup and DR Service	Azure Backup	restic
Database migration and CDCChange data capture reads the database log; watch replication slots.	AWS Database Migration Service	Database Migration Service Datastream	Azure Database Migration Service	Debezium
Analytics
Stream processingDataflow runs Apache Beam; Azure's is SQL-first, not Flink.	Amazon Managed Service for Apache Flink	Dataflow	Azure Stream Analytics	Apache Flink Kafka Streams
Batch processing (Spark)Google's service was called Dataproc until its recent rename.	Amazon EMR AWS Glue	Managed Service for Apache Spark	Azure Databricks Microsoft Fabric	Apache Spark
Data warehouseBigQuery charges per data scanned or slot; Redshift per cluster or serverless capacity.	Amazon Redshift	BigQuery	Fabric Data Warehouse	ClickHouse
SQL over files in object storageCharged by data scanned: columnar files and partitions cut the bill.	Amazon Athena	BigQuery external tables	Fabric SQL analytics endpoint	Trino DuckDB
Security
Web application firewallBilled per request it sees: attach it to every public entry, or only behind the CDN if the origin accepts nothing else. Scope-down statements cut Bot Control and Fraud Control fees.	AWS WAF	Google Cloud Armor	Azure Web Application Firewall	Coraza
DDoS protectionBasic network-layer protection is free. Paid tiers (Shield Advanced is $3,000 a month on a 1-year term) add credits for what you scaled up during an attack and access to a response team. A CDN in front absorbs most floods.	AWS Shield	Google Cloud Armor	Azure DDoS Protection
Cloud access controlAWS policies attach to principals and resources; Google and Azure bind roles at scopes.	AWS IAM	IAM	Azure role-based access control Microsoft Entra ID	Open Policy Agent
Workload identity (no stored keys)Short-lived credentials from the platform beat long-lived keys in config.	IAM roles for tasks and EKS Pod Identity	Attached service accounts Workload Identity Federation	Managed identities	SPIFFE and SPIRE
Encryption keys (KMS)KMS calls have per-Region request quotas; cache data keys (envelope encryption).	AWS KMS	Cloud KMS	Azure Key Vault	OpenBao HashiCorp Vault
SecretsRotation is the hard part; Vault's per-client users and RDS IAM, Cloud SQL IAM or Entra login tokens avoid long-lived DB passwords.	AWS Secrets Manager Parameter Store	Secret Manager	Azure Key Vault secrets	OpenBao HashiCorp Vault
Customer sign-inMoving users off a sign-in service later is hard; password hashes rarely export.	Amazon Cognito	Identity Platform	Microsoft Entra External ID	Keycloak Ory
TLS certificatesACM certificates are free on load balancers and CloudFront; exportable ones cost extra and last 198 days. Public certificates are capped at 200 days since March 2026 and fall to 47 days by 2029, so automate renewal.	AWS Certificate Manager	Certificate Manager	Key Vault certificates	Let's Encrypt cert-manager
Operations
MetricsCloudWatch prices each custom metric, managed Prometheus each sample: watch label cardinality.	Amazon CloudWatch Amazon Managed Service for Prometheus	Cloud Monitoring Managed Service for Prometheus	Azure Monitor Azure Monitor managed service for Prometheus	Prometheus VictoriaMetrics
LogsIngestion is the big cost; sample successful requests, keep every error.	Amazon CloudWatch Logs	Cloud Logging	Azure Monitor Logs	Grafana Loki OpenSearch
TracingInstrument once with OpenTelemetry and keep the choice of backend open.	AWS X-Ray	Cloud Trace	Application Insights	OpenTelemetry Jaeger Grafana Tempo
Audit loggingWho changed what. Control-plane changes are logged by default (CloudTrail keeps 90 days free); data events such as S3 object reads are off until you enable them, at $0.10 per 100,000 on AWS. Send them to a separate, locked account.	AWS CloudTrail	Cloud Audit Logs	Azure Monitor activity log
Workflow orchestrationStep Functions bills per state transition; Durable Functions and Temporal workflows are code.	AWS Step Functions	Workflows	Azure Logic Apps Durable Functions	Temporal
SchedulerSchedulers fire at least once: make the job idempotent.	Amazon EventBridge Scheduler	Cloud Scheduler	Azure Functions timer trigger	Kubernetes CronJob
Data pipeline orchestrationAWS and Google run Airflow; Azure Data Factory is its own pipeline engine.	Amazon MWAA	Cloud Composer	Azure Data Factory	Apache Airflow Dagster
Infrastructure as codeGoogle's Infrastructure Manager runs Terraform; Terraform works on all three.	AWS CloudFormation AWS CDK	Infrastructure Manager	Bicep	Terraform OpenTofu Pulumi
AI
Foundation model APIsGoogle renamed Vertex AI in April 2026; check which Regions process your data.	Amazon Bedrock	Gemini Enterprise Agent Platform	Microsoft Foundry	vLLM Ollama
Hosting your own modelManaged endpoints add a premium over the same GPUs on Kubernetes.	Amazon SageMaker AI endpoints	Agent Platform Endpoints	Azure Machine Learning online endpoints	vLLM KServe
GPU and accelerator capacityCapacity is scarce: reserve ahead. Google also offers its own TPUs.	EC2 accelerated instances Capacity Blocks for ML	GPUs on Compute Engine Cloud TPU	GPU virtual machines	NVIDIA GPU Operator

Service names and links checked 2026-10-20. Clouds rename and retire services; follow the links for the current details.

Building blocks

One page per role: how the options differ, the limits that bite, how they charge, and who runs them in production.

CDN and edgeCloudFront, Cloud CDN and Front Door: what they cache, what they charge for, and code at the edge.Load balancingLayer 4 and layer 7 balancers, global front doors, and the pricing units that surprise people.ContainersServerless containers or Kubernetes: Fargate, Cloud Run, Container Apps, EKS, GKE and AKS.FunctionsLambda, Cloud Run functions and Azure Functions: cold starts, concurrency and the cost crossover.Relational databasesManaged Postgres and MySQL, cloud-native engines like Aurora and AlloyDB, and distributed SQL.Key-value and document storesDynamoDB, Bigtable, Firestore and Cosmos DB: data models, partition limits and consistency.CachesManaged Valkey and Redis on each cloud: node-based or serverless, durability and failover.Queues and pub/subSQS and SNS, Pub/Sub and Cloud Tasks, Service Bus: delivery guarantees, ordering and limits.Event streamsKinesis, MSK, Pub/Sub, Managed Kafka and Event Hubs: when you need a log, and which one.Object storageS3, Cloud Storage and Blob Storage: storage classes, request costs, consistency and limits.Search and vector searchOpenSearch, Azure AI Search, Google's Agent Search and Vector Search, and pgvector: text, geo and vector queries.Data processing and analyticsStream and batch engines and warehouses: Flink, Spark, Dataflow, BigQuery, Redshift, Athena, Fabric.Workflows and schedulingStep Functions, Workflows, Logic Apps and Durable Functions, and when Temporal fits better.Identity, keys and secretsIAM, KMS and secret stores on each cloud, and how workloads get credentials without passwords.ObservabilityMetrics, logs and traces: CloudWatch, Cloud Monitoring, Azure Monitor, and the OpenTelemetry route.AI platformsBedrock, Google's Agent Platform and Microsoft Foundry, or your own GPUs: models, quotas, data residency and cost.

Field notes

Real decisions, each told from the company's own write-up, talk or paper, with links to the source.

Dropbox leaves S3 for its own storageWhy an exabyte-scale customer built Magic Pocket, and what it took to move the data.Discord moves trillions of messages to ScyllaDBHot partitions, garbage collection pauses, and a migration done with a data service in front.Figma shards PostgresVertical partitioning first, then horizontal sharding behind a query proxy.Slack moves to VitessFrom workspace-sharded MySQL to Vitess, and the migration that took years.GitHub partitions MySQLSplitting one big cluster by domain, with tooling to find the queries that cross boundaries.Shopify scales a monolith with podsIsolated pods of shops, each with its own databases, behind one Rails codebase.Segment goes back to a monolithWhat a hundred-plus microservices cost a small team, and the consolidation that followed.Prime Video rebuilds a serverless pipeline as one serviceStep Functions and Lambda at video-frame scale, and why the team moved it into one process.Uber switches from Postgres to MySQLWrite amplification, replication and upgrades: the 2016 write-up and the debate it started.Stripe migrates data without downtimeDual writes, backfills and verification: the four-step pattern for changing live data models.Netflix moves to AWSSeven years from data centre to cloud, and the resilience practices that came out of it.37signals leaves the cloudThe cost case for owned hardware, what it actually saved, and what it gave up.Amazon Aurora: the log is the databaseThe SIGMOD 2017 paper: shipping redo logs to storage instead of pages, and quorum writes across zones.Amazon DynamoDB after ten yearsThe USENIX ATC 2022 paper: how DynamoDB differs from Dynamo, and predictable performance at scale.LinkedIn builds KafkaWhy LinkedIn wrote a log-based messaging system, and the design choices in the original paper.