Cloud Computing

Cloud computing is the system of managing and storing data in online servers. Some of this cloud service providers are; Aws, GCP, Azure, Oracle, IBM, etc.

Characteristics of cloud services:

• Scalability: Vertical Scaling(up and down; increasing size of cpu, ram or rom = Speed) and Horizontal Scaling( in and Out; Increasing the number of cpu, ram or rom = Availability).

• Elasticity: The ability of the system to scaling dynamically.

• Agility: The ability to adapt (allocate and deallocate resource).

• Fault Tolerance: Running why reporting the fault.

• Disaster Recovery: preserves data even after disaster(fire, etc)

• High Availability: It provide uninterrupted services.

Types of cloud computing:

• Private cloud: Cloud space used and maintained by just one organization.

• Public Cloud: Cloud space owned by third-party and used by all. eg: Aws, Gcp, Azure, etc.

• Hybrid Cloud: combination of both public and private cloud.

Networking:

• BandWidth: Maximum data that can pass through a network per sec. eg: Kbps, Mbps...

• Latency: It is the time delay between a user making a request and getting a response. The small the better.

Cloud model-Here you manage:

• IaaS: Virtualization, Server, Storage and Networking services.

• PaaS: Operating system, Software and runtime.

• SaaS: Application

Common cloud services are:

• Compute: Job >Cloud Engineer, Solutions Architect

• Networking: Job >Cloud Network Engineer

• Identity & Access Management (IAM): Job >Cloud Security Engineer

• Storage: Job >Cloud Engineer

• Security: Job >Cloud Security Engineer

• Containers (Docker & Kubernetes): Job >DevOps Engineer

• Serverless: Job >Cloud Developer

• Monitoring & Logging: Job >Site Reliability Engineer

• Databases: Job >Database Engineer

• Infrastructure as Code (Terraform/CloudFormation/Bicep): Job >DevOps Engineer

• CI/CD: Job >DevOps Engineer

• AI & Machine Learning Services: Job >AI Cloud Engineer

• Big Data & Analytics: Job >Data Engineer

Role and Salary Range (USD/year)

Cloud Support Engineer = $50k–$90k

Associate Cloud Engineer = $60k–$100k

Cloud Engineer = $80k–$140k

Senior Cloud Engineer = $120k–$180k

Cloud Architect = $140k–$250k+

Solutions Architect = $130k–$240k+

DevOps Engineer = $90k–$170k

Senior DevOps Engineer = $130k–$220k

Platform Engineer = $110k–$190k

Site Reliability Engineer (SRE) = $120k–$220k

Cloud Security Engineer = $120k–$220k

Cloud Security Architect = $160,000–$300,000+

Data Engineer = $100,000–$180,000

MLOps Engineer = $130,000–$250,000+

Kubernetes Engineer = $120,000–$220,000

Nigeria Market (Approximate Annual Salary)

Cloud Support Engineer = ₦3M–₦8M

Junior Cloud Engineer = ₦4M–₦10M

Cloud Engineer = ₦8M–₦20M

Senior Cloud Engineer = ₦15M–₦40M+

DevOps Engineer = ₦10M–₦30M+

Cloud Architect = ₦20M–₦60M+

Cloud Security Engineer = ₦12M–₦40M+

Certifications That Increase Earning Potential

AWS

• AWS Certified Cloud Practitioner

• AWS Certified Solutions Architect – Associate

• AWS Certified DevOps Engineer – Professional

Azure

• Microsoft Certified; Azure Fundamentals (AZ-900)

• Azure Administrator Associate (AZ-104)

GCP

• Associate Cloud Engineer

• Professional Cloud Architect

Highest-Paying Cloud Paths

1. Cloud Security Architect

2. Cloud Architect

3. Solutions Architect

4. Site Reliability Engineer (SRE)

5. MLOps Engineer

6. Principal Cloud Engineer

7. Platform Architect

For Flutter Developers

Because you already have experience with Flutter and software development, a strong path could be:

Flutter Developer

     ↓

AWS Cloud Practitioner

     ↓

AWS Solutions Architect Associate

     ↓

Cloud Engineer

     ↓

DevOps Engineer

     ↓

Cloud Architect

On-Demand: Available 24/7.

CIDR block: Classless inter-domain routing.

Pay-Load: is the original data, while meta-data is the data that contains informations about the payload.

Pay-as-you-go: Paying for what you used only.

SQL: Structural Query data, Excel-like data.

NoSQL: No relational Database.

POP: Point of Presence

Underlay: Is the physical network of a Datacenter.

Overlay: Is the virtual network. It rely on the underlay.

IDP: Identity provider.

ASN: Automous system numbers. Related to IP address.

SRE (Site Reliability Engineering): is a discipline that applies software engineering principles to infrastructure and operations to create highly reliable, scalable systems.

IANA (Internet Assigned Numbers Authority): are the once incharge of assigning IP addresses

NACLs: Network...

NFS: Network file share

LTS: Long time support

Ingress (Inbound): This is the incoming traffic

Egress (Outbound): This is outgoing traffic.

REST API: Representational State Transfer Application Programming Interface 

Question: 

Hosting a secure website with AWS.

1. Create Network in AWS: 

• Create VPC,

• Create a subnet for the VPC,

• Explicit Subnet-associates, 

• Create Internet-gateway, select and attach it to the VPC,

• Create a route table; route-rule configuration, 

• Create a Security-group; security-group rule (ingress rules).

• Create S3-bucket.

• Create VPC-flow-log: for foot print of all those that access the VPC. Use the S3 bucket above to store the data here.
  
  

2. Create EC2 Instance with public ip (t2-medium, 2cpu, 4gram). You will need to create/add ssh-key. You can increase storage to 20gib, Attach the VPC, subnet and security-group to EC2. Also, ensure auto assigning of iP addresses. Then click create instance.
   
   

3. Create a dns record with the ip address of the EC2
   Buy a Domain name for the company (A record for IPv4 and AAAA record for IPv6)
   Point the DNS to the public ip address of EC2 instance
   Check the propagation with dnschecker.org.
   
   

4. Download a website template and costumize it.
   Download from themewagon,or themeforest.
   
   

5. Use Mobaxterm to upload file to EC2 instance.
   Allow HTTP and HTTPS
   Go to AWS Console EC2 Security Groups Inbound & Outbound Rules and add
   HTTP, HTTPS, and SSH.
   Set their source to 0.0.0.0/0 each
   Then
   Open MobaXterm
   Click Session and select SSH
   Enter: Remote Host (Your EC2 Public IP) and Specify Username (ubuntu)
   Click Advanced SSH Settings and select/check Use private key, then select your downloaded key (your-key.pem)
   Click OK
   
   

6. Install Nginx (Web services engine)
   Update Ubuntu
   Run:
   sudo apt update
   sudo apt upgrade -y
   Install Nginx
   sudo apt install nginx -y
   to verify that nginx have been insalled (systemctl status nginx)
   Check if it is running (sudo systemctl status nginx), you will see "Active: active (running)"
   If not (sudo systemctl start nginx)
   Enable it (sudo systemctl enable nginx) 
   sudo systemctl stop nginx
   sudo systemctl disable nginx
   sudo systemctl restart nginx
   Test Nginx
   Visit (http://YOUR_PUBLIC_IP) using any browser
   Upload your website
   Suppose your website folder is C:\Users\mine\Desktop\website
   Inside MobaXterm Left panel drag every files&folders inside the ...\website folder into /home/ubuntu/
   Now your website is on the server.
   Move website to Nginx folder
   The default website folder is /var/www/html
   Delete default files (sudo rm -rf /var/www/html/*)
   Copy your website (sudo cp -r ~/website/* /var/www/html/)
   Or
   If your files & folders are directly inside /home/ubuntu: then use (sudo cp -r ~/* /var/www/html/)
   Give permissions
   sudo chown -R www-data:www-data /var/www/html
   Then
   sudo chmod -R 755 /var/www/html
   Restart Nginx
   sudo systemctl restart nginx
   check the ip address or server url on a browser.
   
   

7. Verify the Domain propagation
   www.dnschecker.org
   enter the server domain name and check if ip address has propergated
   
   

8. Configure your domain
   Since you've already pointed your domain to the EC2 public IP, verify the DNS records:
   A, @, and EC2 Public IP
   also
   A, www, and EC2 Public IP
   Wait for DNS propagation if you made recent changes (this can take anywhere from a few minutes to several hours) then check (http://yourdomain.com) on your web browser.
   Enable HTTPS (recommended)
   Install certbot and configure Https with letencrypt, or and other certificate.
   sudo apt install certbot
   sudo apt install certbot python3-certbot-nginx -y
   Follow the prompts: Enter email, Accept Terms, Choose your domain, and Redirect HTTP to HTTPS? YES
   Then visit (https://yourdomain.com)
   You now have a secure site.
   
   

9. Other useful Linux commands
   pwd # Current directory
   ls # List files
   ls -la # Detailed listing
   cd foldername # Change directory
   cd .. # Go up one directory
   mkdir test # Create directory
   rm file.txt # Delete file
   rm -rf folder # Delete folder recursively
   cp file1 file2 # Copy file
   cp -r folder1 folder2   # Copy folder
   mv old new # Move or rename
   cat file.txt # View file
   nano file.txt # Edit file
   
   

10. Request for certificate on domain_name.online
    sudo certbot --nginx -d domain_name.online
    sudo systemctl start nginx
    if nginx fails, we restart the entire system.
    if your ip change cos of stop and restart of vm.
    update your dns record with the new ip address.
    
    

11. Test your application.
    
    

12. Penetration Testing
    online pentesting
    https://pentest-tools.com/
    
    

13. Prepare your Documentation.
    
    

14. Post Link.

production-grade highly available AWS architecture following AWS best practices. It is commonly used for hosting web applications that require high availability, scalability, security, monitoring, and centralized administration.

Below is a complete step-by-step deployment guide.

============================

Step 1 — Create the VPC

Name: Production-VPC

CIDR: 10.0.0.0/16

==========================

Step 2 — Create Availability Zones

Use two AZs. Example, us-east-1a, & us-east-1b

============================

Step 3 — Create Subnets

Create 4 subnets.

Public-Subnet-A, Public, 10.0.1.0/24 (CIDR)

Public-Subnet-B, Public, 10.0.2.0/24

Private-App-A, Private, 10.0.10.0/24

Private-App-B, Private, 10.0.20.0/24

===============================

Step 4 — Create Internet Gateway

Create an Internet Gateway.
Name it webserver-igw
Attach it to the VPC.
Reason: Allows public cloud resources access to the Internet.

================================

Step 6 — Create Route Tables

Public Route Table: 

Routes: 0.0.0.0/0. After creation, associate with Public-subnetA and Public-subnetB. This will ensure that the two availability zones are covered, since they are in the same VPC. Edit the route and put 0.0.0.0/0, igw, and then select the internet gateway you created early.

Private Route Table:

Route: 0.0.0.0/0. After creation, associate with private-subnetA and private-subnetB. This will ensure that the two availability zones are covered, since they are in the same VPC.

================================

Step 7 — Create NAT Gateway

Create one NAT gateway. It will take the private route table in step 6 above and link it to a new route table that it will automatically create. This new route table will now link it to your internet gateway created above.

Go to your private route table above, edit the route to add the NAT gateway and 0.0.0.0/0

==================================

Step 8 — Create Security Groups:

Here, i will create 3 security groups

Load Balancer SG: Inbound = HTTPS and HTTP 0.0.0.0/0 and all traffic & Outbound = All

Private SG: Inbound = HTTP and all traffic , 0.0.0.0/0  & Outbound = All

Public SG: Inbound = SSH, custom IP address  and all traffic & Outbound = All

=================================

Step 9 — Create EFS

Create Amazon EFS (Elastic file system). It is the cloud native of NFS. It ensures that every server sees the same files.

• Click on create file system

• Name your EFS and select the VPC it should be Under

• Click on Customize in one of the buttons below.

• Select Regional instead of One zone under file system type.

• Click on Next.

• Now, select the number of networks to be connected to the  EFS under Mount targets.

• Here, private and public subnet ID are selected in different AZ. Ensure that the private subnet ID is in private security group and the public subnet ID is in public security group. Then Click Next.

• Now, you can set your EFS policies but leave it and click Next.

• Then, You can see all that you set up, now click Create.

• Click on name or on file system iD of that particular EFS to open it and do few more setups.

• Under access points, click to create access point. Then select the file system (the EFS you created) and click on Create.

==================================

Step 11 — Launch Jump Server

Launch one EC2 instance. Example: ubuntu;

• Name your instance

• Select image, ensure to select ubuntu server less than 26 like 24.04 LTS because that what works with the current datadog.

• Under network settings, click edit to set your VPC, Public Subnet, and enable auto assign public IP.

• Select from existing security group (public-sg)

• Leave the default root volume if you want.

• Then click on launch instance

• Now, login to the server with Mobaxtem

• Set-up the server

• run nano install.sh and then paste the below code.

#!/bin/bash

set -e

#Set server name, update and upgrade

sudo hostnamectl set-hostname Jumper-server

sudo apt update -y

sudo apt upgrade -y

#Create a directory called webserver

mkdir -p /home/ubuntu/webserver

#install EFS dependencies

sudo apt -y install nfs-common stunnel4 git binutils

#Add EFS access point

sudo tee -a /etc/fstab > /dev/null <<EOF

fs-0846ba61994aec079.efs.us-east-1.amazonaws.com:/ /home/ubuntu/webserver nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport,_netdev 0 0

EOF

#mount efs

sudo mount -a

#connect to datadog agent

DD_API_KEY=883a62ddb18fb69ed826d18416184f6f \

DD_SITE="datadoghq.com" \

DD_APM_INSTRUMENTATION_ENABLED=host \

DD_DATA_STREAMS_ENABLED=true \

DD_PROFILING_ENABLED=auto \

DD_ENV=dev \

DD_APM_INSTRUMENTATION_LIBRARIES=java:1,python:4,js:5,php:1,dotnet:3,ruby:2 \

DD_LOGS_CONFIG_PROCESS_COLLECT _ALL=true \

bash -c "$(curl -L https://install.datadoghq.com/scripts/install_script_agent7.sh)"

• Save ctrl+X, select y to save and hit Enter.

• Install and Run the bash script (sh install.sh) or (chmod +x install.sh)(the +x is to make it executable) and  (./install.sh), then hit enter.

• 
  

=====================================

Step 12 — Install Datadog Agent

• Sign up for datadog account

• Under what would you like to monitor? select infrastructure & backend application.

• Then click on install datadog agent, and select linux.

• Under configure agent, select dev.

• Now copy and run the install command, but before running the command in your mobaxtem (server). first of all update and upgrade ( sudo apt update -y; sudo apt upgrade -y)  the jumper server you created. You can also rename the server (sudo hostnamectl set ...).

• Now, paste the command to configure your datadog agent, click Enter. When it has run successfully, go to datadog and click on finish, it will bring you to your datadog dashboard.

• In the left panel of your datadog dashboard, at the bottom, hover on integrations, then select install agents, select Linux.

• Now, in customize your agent:
  - Enable Application performance monitoring
  - Enable Real user monitoring
  - Under Application observerbility, Enable everything
  - Under Cloudand App Security, Enable  everything
  - Under Code security, Enable everything
  - Enable DDOT collector
  - Enable agent to take action
  - select key to use
  - Copy the script and paste it

• Bash script

#!/bin/bash

set -e

sudo hostnamectl set-hostname WebServer-`hostname -I`

sudo apt update -y

sudo apt upgrade -y

sudo apt install -y nginx

sudo systemctl enable nginx

sudo systemctl start nginx

sudo rm -rf /var/www/html/*

sudo apt -y install nfs-common stunnel4 git binutils

sudo tee -a /etc/fstab > /dev/null <<EOF

fs-0846ba61994aec079.efs.us-east-1.amazonaws.com:/ /var/www/html nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport,_netdev 0 0

EOF

sudo mount -a

#making nginx the owner of /var/www/html

sudo chown -R www-data:www-data /var/www/html

#For Datadog configuration

DD_API_KEY=883a62ddb18fb69ed826d18416184f6f \

DD_APP_KEY=ddapp_NzIQPD6KFKkMJ1HLKVWZXsZNQeHk4bVkuE \

DD_SITE="datadoghq.com" \

DD_APM_INSTRUMENTATION_ENABLED=host \

DD_APM_INSTRUMENTATION_LIBRARIES=java:1,python:4,js:5,php:1,dotnet:3,ruby:2 \

DD_APPSEC_ENABLED=true \

DD_IAST_ENABLED=true \

DD_APPSEC_SCA_ENABLED=true \

DD_RUNTIME_SECURITY_CONFIG_ENABLED=true \

DD_COMPLIANCE_CONFIG_ENABLED=true \

DD_SBOM_CONTAINER_IMAGE_ENABLED=true \

DD_SBOM_HOST_ENABLED=true \

DD_DATA_STREAMS_ENABLED=true \

DD_PROFILING_ENABLED=auto \

DD_OTELCOLLECTOR_ENABLED=true \

DD_RUM_ENABLED=true \

DD_RUM_APPLICATION_ID=4725a267-199e-46eb-94fa-6c35d2a060a8 \

DD_RUM_CLIENT_TOKEN=pubbf9ce9596b275eccaa90fbbecb5c5023 \

DD_RUM_REMOTE_CONFIGURATION_ID=c2fef097-a79b-4354-b507-76bffc3536e9 \

DD_RUM_SITE=datadoghq.com \

DD_PRIVATE_ACTION_RUNNER_ENABLED=true \

DD_PRIVATE_ACTION_RUNNER_ACTIONS_ALLOWLIST=com.datadoghq.script.runPredefinedScript \

bash -c "$(curl -L https://install.datadoghq.com/scripts/install_script_agent7.sh)"

• VPC must have both DNS Hostnames and DNS Resolution are enabled in AWS Console 

• Back to your Mobaxtem, create a directory called webserver (mkdir -p /home/ubuntu/webserver) in home/ubuntu.

• Install all the dependencies needed for EFS to work (sudo apt -y install nfs-common stunnel4 git binutils).

• Now, check for EFS in /etc/fstab (cat /etc/fstab ),

• Now mount the EFS (sudo tee -a /etc/fstab > /dev/null <<EOF

fs-0846ba61994aec079.efs.us-east-1.amazonaws.com:/ /var/www/html nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport,_netdev 0 0

EOF).

• Complete the mounting (sudo mount -a).

• Confirm the mount with (df -h).

====================================

Step 13 — Create Launch Template

• Name it webserver-tp

• Add description

• Under Quick start, select ubuntu AMI (ubuntu 24.04 LTS ...)

• Under instance Type, select t3.micro (ask CTO preferrably)

• Under Advance details, scroll down to user data and paste your bash script in step 12 above.

======================================

Step 14 — Create Auto Scaling Group, Load balancer, and Target group

• Name your auto scalar (webserver-as).

• Select the default template you created earlier and then click Next.

• Under network, select your VPC, and your two private subnets, then click Next.

• Under load balancing, select attach to a new new load balancer, select Application Load Balancer, set load balancer name (webserver-ld rather the auto created name), select internet-facing, under Availability zone and subnets, ensure that the load balancer subnets are both public, Under listeners and routing (port 80 and click default routing, then create a target group named webserver-tg), click Next

• Under scaling group set to the lowest number of server, mine is 2.

• Under scaling, set your min and max desired capacity. Mine is 2 and 10.

• Under automatic scaling, select target tracking scaling policy, set target value to allow it to know when to add extra server (EC2), Instance warmup is how many seconds to wait before creating a new instance. Click Next, Next, Next, and Create auto scaling group .

====================================

Step 15 — Upload Your Webcontent for test:

• Upload the web content to home/ubuntu/webserver

• You can change webserver permission by running sudo chmod 777 webserver/

• Now, try and upload the web content webserver

Step 20 — Create Slack Channel

Example

#production-alerts

Inside Datadog

Integrations

↓

Slack

Authorize your Slack workspace.

Step 21 — Create Monitors

Examples

CPU

>80%

Memory

>90%

Disk

>85%

Instance Down

No heartbeat

Load Balancer

5XX Errors

EFS

Burst Credits Low

NAT Gateway

High Errors

Auto Scaling

Launch Failure

Configure every monitor

↓

Notify

@slack-production-alerts

Step 22 — Test the Architecture

Verify the following scenarios:

• Access the application via the ALB over HTTPS (port 443).

• Confirm the ALB distributes traffic across instances in both Availability Zones.

• Increase CPU load on the EC2 instances and verify the Auto Scaling Group scales out above the minimum of 3 instances.

• Remove the load and verify it scales back down (but not below 3 instances).

• Confirm all instances can read from and write to the shared EFS file system.

• SSH from your workstation to the jump server, then SSH from the jump server to private EC2 instances.

• Verify private instances have outbound internet access through the NAT Gateways (e.g., package updates).

• Ensure Datadog is receiving metrics and logs from the EC2 instances, ALB, and EFS.

• Trigger a Datadog monitor (for example, by stressing CPU) and confirm a notification is delivered to the Slack channel.

• Simulate an instance failure and verify the Auto Scaling Group replaces the unhealthy instance automatically.

Final Architecture Summary

Component

Purpose

VPC

Isolated network for all resources

Internet Gateway

Internet connectivity for public subnets

Public Subnets

Host the Application Load Balancer, NAT Gateways, and jump server

NAT Gateways

Provide secure outbound internet access for private instances

Private Subnets

Host the application servers

Application Load Balancer (HTTPS/443)

Distributes incoming traffic across healthy instances

Auto Scaling Group (Min 3, Max 30)

Automatically adjusts application capacity

Amazon EFS

Shared, highly available file storage across instances

Jump (Bastion) Server

Secure administrative access to private servers

IAM Role

Grants EC2 instances permission to access AWS services securely

Cloud Engineer User

Administrative account used to manage infrastructure via the jump server

Datadog

Infrastructure monitoring, metrics, dashboards, and alerting

Slack

Receives operational alerts and incident notifications

Security Groups

Stateful firewall rules controlling traffic between components

Route Tables

Direct traffic between subnets, NAT Gateways, and the Internet Gateway

This architecture follows AWS Well-Architected practices by providing high availability (multi-AZ deployment), scalability (Auto Scaling from 3 to 30 instances), security (private application tier with a bastion host), resilience (EFS and health checks), and observability (Datadog integrated with Slack alerts).