Cloud platforms: AWS, Azure and Google Cloud

In short

AWS (Amazon Web Services), Microsoft Azure and Google Cloud Platform (GCP) are the three largest public cloud providers; each rents compute, storage, networking, databases and managed platform services on a pay-per-use basis through a console, CLI, SDK and API. Learning them means learning a common pattern — regions and availability zones, virtual machines, object storage, managed databases, identity and access management, virtual networks, autoscaling and billing — and then the three vendors' different names for the same thing. Indian university syllabi (AICTE "Cloud Computing" electives, UGC CBCS BCA/B.Sc. IT papers) examine service classification, architecture and comparison; GATE CS touches it only lightly through virtualisation and distributed systems, so marks come mostly from descriptive and lab work. Every large Indian IT services employer (TCS, Infosys, Wipro, HCLTech, Accenture, Cognizant, Capgemini, LTIMindtree, Tech Mahindra) screens freshers on cloud fundamentals and funds AWS/Azure/GCP associate certifications, and product companies and startups (Flipkart, Zomato, Zerodha, PhonePe, Razorpay, Ola) hire directly on it. Indian government and BFSI work adds MeitY empanelment, RBI/IRDAI data-localisation and the DPDP Act, 2023 to the technical picture.

Explained

The three providers and how they are structured

• AWS (2006, Amazon): the oldest and largest, the broadest service catalogue, strongest in generic infrastructure (IaaS) and the default assumption in most Indian job descriptions. Indian regions: Mumbai (ap-south-1) and Hyderabad (ap-south-2).
• Azure (2010, Microsoft): strongest where an enterprise already runs Windows Server, Active Directory, SQL Server, .NET and Microsoft 365; hybrid cloud and licence portability are its selling points. Indian regions include Central India (Pune), South India (Chennai), West India (Mumbai), India South Central (Hyderabad, 2026), plus Jio India West and Jio India Central.
• GCP (2008/2011, Google): strongest in data analytics (BigQuery), Kubernetes (it originated Kubernetes) and ML/AI; smaller catalogue, engineer-friendly. Indian regions: Mumbai (asia-south1) and Delhi NCR (asia-south2).
• Account hierarchy differs and is a favourite exam contrast: AWS = Organization → OU → Account → resources; Azure = Tenant (Entra ID) → Management group → Subscription → Resource group → resources; GCP = Organization → Folder → Project → resources. Billing and quota boundaries sit at Account / Subscription / Project respectively.
• Global footprint vocabulary: Region = a geographic cluster of data centres; Availability Zone (AZ) = one or more independent data centres inside a region with separate power, cooling and network; Edge / PoP location = CDN and DNS caches. Multi-AZ gives high availability; multi-region gives disaster recovery and data residency.
• Market share (industry trackers, 2025-26, approximate and moving): AWS ~30%, Azure ~20-25%, GCP ~11-13% of global cloud infrastructure spend. Quote as approximate — these figures change every quarter.

Service model and the shared responsibility model

• IaaS: raw virtual machines, disks and networks — you manage OS, patching, runtime, data (AWS EC2, Azure Virtual Machines, GCP Compute Engine).
• PaaS: you deploy code or a schema; the provider runs the OS and middleware (AWS Elastic Beanstalk / RDS, Azure App Service / SQL Database, GCP App Engine / Cloud SQL).
• FaaS / serverless: you deploy a function or container and pay per request and per GB-second, scaling to zero (AWS Lambda, Azure Functions, GCP Cloud Run functions / Cloud Run).
• SaaS: finished applications (Microsoft 365, Google Workspace) — consumed, not built.
• Shared responsibility model: the provider is responsible for security of the cloud (physical sites, hypervisor, managed-service internals); the customer is responsible for security in the cloud (IAM policies, OS patching on IaaS, network rules, encryption choices, application code, data classification). The split shifts towards the provider as you go IaaS → PaaS → SaaS. Misconfigured public buckets and over-broad IAM roles are customer faults, not provider faults.
• Deployment models seen in Indian enterprises: public, private (VMware/OpenStack on-premises), hybrid (Azure Arc, AWS Outposts, Google Anthos / GKE Enterprise) and multi-cloud (deliberately using two providers to avoid lock-in and satisfy regulators).

Service-by-service mapping (the core of most exam answers)

• Compute: EC2 / Azure VM / Compute Engine. Instance families: general purpose (t, m / B, D / e2, n2), compute optimised (c / F / c2), memory optimised (r, x / E / m2), GPU and accelerated (p, g / NC, ND / a2, g2), storage optimised (i, d / L).
• Purchase models: On-demand (per-second/per-minute, no commitment), Reserved Instances / Savings Plans (AWS) or Reservations (Azure) or Committed Use Discounts (GCP) for 1-3 years at roughly 30-70% off, Spot / Spot VM / Preemptible-Spot at up to ~70-90% off but interruptible, and Dedicated hosts for licence or compliance reasons. GCP additionally applies automatic sustained-use discounts.
• Object storage: S3 / Azure Blob Storage / Cloud Storage — flat, HTTP-accessed, eleven-nines durability design, versioning, lifecycle rules. Tiers: S3 Standard → Standard-IA → One Zone-IA → Glacier Instant/Flexible/Deep Archive; Azure Hot → Cool → Cold → Archive; GCP Standard → Nearline → Coldline → Archive. Colder = cheaper storage, costlier and slower retrieval.
• Block and file storage: EBS / Azure Managed Disks / Persistent Disk & Hyperdisk (block, attached to one VM); EFS / Azure Files / Filestore (shared NFS or SMB).
• Relational databases: RDS & Aurora / Azure SQL Database & Azure Database for MySQL-PostgreSQL / Cloud SQL & AlloyDB. Distributed, horizontally scalable SQL: Aurora DSQL, Azure PostgreSQL elastic clusters, Cloud Spanner.
• NoSQL: DynamoDB / Cosmos DB / Firestore & Bigtable. Cache: ElastiCache / Azure Managed Redis / Memorystore.
• Data warehouse and analytics: Redshift / Synapse Analytics & Microsoft Fabric / BigQuery; Spark as EMR / HDInsight & Databricks / Dataproc; ETL as Glue / Data Factory / Dataflow & Cloud Data Fusion.
• Networking: VPC / Virtual Network (VNet) / VPC network; subnets, route tables, internet gateway, NAT gateway, security groups + NACLs (AWS) vs Network Security Groups (Azure) vs firewall rules (GCP); peering; private connectivity as Direct Connect / ExpressRoute / Cloud Interconnect; VPN gateways. Note the design difference: an AWS subnet is zonal, an Azure VNet and GCP subnet are regional.
• Load balancing and DNS: ALB/NLB/CLB / Azure Load Balancer & Application Gateway & Front Door / Cloud Load Balancing; Route 53 / Azure DNS + Traffic Manager / Cloud DNS. CDN: CloudFront / Azure Front Door CDN / Cloud CDN.
• Containers and orchestration: ECS & EKS & Fargate / ACI & AKS & Container Apps / GKE & Cloud Run. Registries: ECR / ACR / Artifact Registry.
• Identity: AWS IAM (users, groups, roles, JSON policies) / Microsoft Entra ID (formerly Azure AD) plus Azure RBAC role assignments / Cloud IAM (member + role + resource binding). Workload identity: EC2 instance profiles / managed identities / service accounts — always preferred to embedding access keys.
• Messaging and events: SQS & SNS & EventBridge & Kinesis / Service Bus & Event Grid & Event Hubs / Pub/Sub & Eventarc.
• Infrastructure as code: CloudFormation & CDK / ARM & Bicep / Infrastructure Manager & Config Controller (Deployment Manager is retired) — and Terraform, which works across all three and is what most Indian employers actually use.
• Monitoring: CloudWatch & CloudTrail & X-Ray / Azure Monitor & Log Analytics & Application Insights / Cloud Monitoring & Cloud Logging & Cloud Trace.
• Secrets and keys: Secrets Manager & KMS / Key Vault / Secret Manager & Cloud KMS.
• AI/ML platforms: SageMaker & Bedrock / Azure Machine Learning & Azure OpenAI & Microsoft Foundry (ex-AI Foundry) / Vertex AI.

Designing on a cloud platform: a worked architecture pattern

1. Choose region by latency to users, price, service availability and data-residency law — for Indian users, Mumbai or Hyderabad/Delhi/Pune.
2. Create the network: one VPC/VNet; public subnets (load balancer, NAT) and private subnets (app, database) spread across at least two AZs.
3. Put compute behind a load balancer in an autoscaling group / VM Scale Set / Managed Instance Group with health checks; target-tracking policy, e.g. keep average CPU at 60%.
4. Use a managed database with multi-AZ standby and automated backups rather than a self-run database on a VM; keep it in private subnets.
5. Store static assets in object storage behind the CDN; never serve images from the application server.
6. Identity: no long-lived keys on instances — attach a role/managed identity; apply least privilege and MFA on the root/global-admin account, which should otherwise be unused.
7. Observability and cost control: metrics, centralised logs, alarms, resource tags (project, owner, environment) for cost allocation, and a budget alert.
8. Resilience targets: define RPO (acceptable data loss) and RTO (acceptable downtime), then pick a DR pattern: backup-and-restore (cheapest, hours), pilot light, warm standby, or active-active multi-region (costliest, near zero).
9. Automate the whole thing in Terraform so the environment is reproducible, and deploy through CI/CD.

Pricing, SLAs and cost control

• Charge dimensions: compute per second/minute of instance uptime by size; storage per GB-month; data transfer out (egress) per GB — ingress is normally free; requests/operations (per million on S3, Lambda, BigQuery); per-query bytes scanned (BigQuery); per provisioned IOPS/throughput; licences; support plans.
• Egress is the classic trap and the main source of lock-in; inter-AZ and cross-region traffic is also billed. All three now waive egress charges when a customer fully exits the platform (an EU Data Act-driven change) — confirm current terms, as these policies are still evolving.
• Free tiers: AWS gives new accounts sign-up credits plus always-free items (the 12-month free tier applies to accounts opened before July 2025); Azure 12 months of popular services plus credits; GCP always-free tier plus a sign-up credit. Credit amounts change — treat any figure as indicative.
• SLA basics: a single VM typically carries ~99.5-99.9%; two or more instances across AZs/zones reach 99.95-99.99%; object storage availability SLAs are ~99.9-99.99%. The remedy is a service credit, not compensation for business loss — an exam point students miss.
• FinOps levers: right-size instances, use commitments for steady baseline and spot for batch, schedule dev/test shutdown outside office hours, lifecycle-tier cold data, delete unattached disks and idle IPs, use autoscaling, and enforce tagging.
• Lock-in gradient: VMs and Kubernetes are portable; managed proprietary services (DynamoDB, Cosmos DB, BigQuery) give the most value but the most lock-in.

Indian regulation, standards and certification

• MeitY empanelment: Indian government departments must use cloud providers empanelled by MeitY under the GI Cloud ("MeghRaj") initiative, audited by STQC; AWS, Azure, GCP and Indian providers such as CtrlS, ESDS, Sify, Yotta, Tata Communications and NIC's National Cloud hold empanelments. Government workloads are often required to stay in India.
• Data protection: the Digital Personal Data Protection (DPDP) Act, 2023 governs personal data; it permits transfer abroad except to countries the Central Government restricts, and makes the organisation (data fiduciary) accountable even when a cloud provider is the processor — a written processor contract is mandatory. Rules under the Act have been issued/notified in phases, so check the current status.
• Sector rules: RBI requires payment-system data to be stored only in India (2018 directive) and imposes outsourcing/IT-governance norms on banks and NBFCs with audit and exit-plan clauses; IRDAI and SEBI have parallel cloud frameworks (SEBI's framework for market infrastructure institutions and intermediaries); CERT-In 2022 directions require 180-day log retention within India and incident reporting within 6 hours.
• Standards referenced in tenders: ISO/IEC 27001 (ISMS), 27017/27018 (cloud and cloud-PII controls), SOC 1/2/3, PCI DSS, and ISO/IEC 17788/17789 for cloud vocabulary and reference architecture.
• Certifications students are hired on: AWS Cloud Practitioner → Solutions Architect Associate → Developer/CloudOps (ex-SysOps) → Professional/Specialty; Azure AZ-900 → AZ-104 (Administrator) / AZ-305 (Architect) (AZ-204 retired July 2026); Google Cloud Digital Leader → Associate Cloud Engineer → Professional Cloud Architect. Exam fees are in the US$99-300 band (roughly ₹8,000-₹26,000); Indian employers frequently reimburse. Fees and exam codes change — verify before booking.

Key points

• Region - a geographic group of data centres; chosen for latency, price, service availability and data residency.
• Availability Zone - an isolated data centre within a region; deploying across two or more AZs is the standard high-availability pattern.
• Account / Subscription / Project - the billing and isolation boundary in AWS / Azure / GCP respectively.
• IaaS, PaaS, FaaS, SaaS - decreasing customer responsibility and increasing provider abstraction.
• Shared responsibility - provider secures the cloud, customer secures what is in it; most breaches are customer misconfiguration.
• Compute trio - EC2, Azure Virtual Machines, Compute Engine; sized by instance family and type.
• Object storage trio - S3, Blob Storage, Cloud Storage; tiered Hot → Cool/IA → Archive by access frequency.
• Network trio - VPC, VNet, VPC network; AWS subnets are zonal while Azure and GCP subnets are regional.
• Identity - IAM / Entra ID + RBAC / Cloud IAM; use roles, managed identities or service accounts, never hardcoded keys.
• Least privilege and MFA - grant the minimum permissions and protect root/global-admin accounts; policies are deny-by-default.
• Autoscaling - Auto Scaling Group / VM Scale Set / Managed Instance Group adjusts capacity to demand; horizontal scaling is the cloud way.
• Serverless - Lambda / Functions / Cloud Run: per-request billing, scale to zero, cold starts, execution time limits.
• Purchase models - on-demand, reserved/committed (30-70% cheaper), spot (up to ~90% cheaper, interruptible).
• Egress charges - outbound data transfer is billed per GB and drives both cost surprises and lock-in.
• SLA credits - breaching an SLA earns a service credit, not damages; stated availability depends on a compliant multi-AZ design.
• RPO and RTO - the data-loss and downtime budgets that decide the DR architecture and its cost.
• Terraform - the vendor-neutral IaC tool most used in Indian projects; CloudFormation, Bicep and Infrastructure Manager are the native ones.
• Indian compliance - MeitY/STQC empanelment (MeghRaj), DPDP Act 2023, RBI payment-data localisation, CERT-In 6-hour reporting and 180-day Indian log retention.

Formulas and examples

Example 1 — Compute cost and the effect of a commitment. An application runs 4 VMs of ₹6.00 per hour, 24×7, for a month (730 hours).

• On-demand = 4 × 730 × 6.00 = ₹17,520 per month.
• A 1-year commitment at 40% off gives ₹3.60/hr → 4 × 730 × 3.60 = ₹10,512 per month, a saving of ₹7,008 per month = ₹84,096 per year.
• If only 2 VMs are needed round the clock and 2 only for 10 hours a day on 22 working days: 2 × 730 × 6.00 = ₹8,760, plus 2 × (10 × 22) × 6.00 = ₹2,640 → ₹11,400, i.e. ₹6,120 less than running all four 24×7 without any commitment. Best practice: commit the steady 2 and keep the burst 2 on-demand or spot.

Example 2 — Object storage bill. 500 GB stored in a hot tier at ₹2.00 per GB-month, 200 GB egress at ₹7.00 per GB, 2 million GET requests at ₹30 per million.

• Storage = 500 × 2.00 = ₹1,000; Egress = 200 × 7.00 = ₹1,400; Requests = 2 × 30 = ₹60.
• Total = ₹2,460 per month — note that egress alone is 57% of the bill. Put a CDN in front: if the CDN serves 90% of requests from cache, origin egress falls to 20 GB = ₹140, and even with CDN delivery at ₹5.00 per GB for 200 GB (₹1,000) the total becomes 1,000 + 140 + 6 + 1,000 = ₹2,146, with much better latency.
• Moving 400 GB of the same data to an archive tier at ₹0.20 per GB-month: storage becomes (100 × 2.00) + (400 × 0.20) = 200 + 80 = ₹280, a 72% cut on the storage line — valid only if that data is rarely read, since retrieval is charged separately.

Example 3 — Serverless vs a VM (break-even). A function uses 512 MB (0.5 GB) and runs 200 ms per call; rates: $0.20 per million requests and $0.0000166667 per GB-second. Monthly volume 5 million calls.

• GB-seconds = 0.5 × 0.2 × 5,000,000 = 500,000 GB-s → 500,000 × 0.0000166667 = $8.33.
• Request charge = 5 × 0.20 = $1.00. Total ≈ $9.33 per month (about ₹830 at ₹89/$).
• An always-on small VM at $0.02/hr costs 730 × 0.02 = $14.60. So serverless wins here; the break-even is near 7.8 million calls per month at this memory and duration. At 50 million calls the function costs about $93 and the VM (if it can take the load) is far cheaper — the standard answer: serverless for spiky or low-volume workloads, provisioned compute for steady high volume.

Example 4 — Availability arithmetic. Each VM has availability 0.99 (99%).

• One VM: downtime = (1 − 0.99) × 8,760 = 87.6 hours per year.
• Two VMs in different AZs behind a load balancer: availability = 1 − (0.01)² = 0.9999 → 0.876 hours ≈ 52.6 minutes per year.
• Three VMs: 1 − (0.01)³ = 0.999999 → about 31.5 seconds per year.
• But the chain matters: if the load balancer itself is 0.9995 and the database 0.9995, system availability = 0.9999 × 0.9995 × 0.9995 ≈ 0.9989 → about 9.6 hours per year. The weakest serial component caps the design.

Example 5 — Sizing and autoscaling. Peak load 12,000 requests per second; one instance serves 800 rps safely.

• Instances = ceil(12,000 ÷ 800) = 15, plus 1 for N+1 = 16, spread as 8 + 8 across two AZs so a zone failure still leaves 8 × 800 = 6,400 rps. To survive a zone loss at full peak, use 3 AZs with 8 each (24 instances, each zone's loss leaving 16 × 800 = 12,800 rps).
• With a target-tracking policy at 60% CPU and a baseline of 3,000 rps, steady-state instances ≈ ceil(3,000 ÷ (800 × 0.6)) = ceil(6.25) = 7 — so autoscaling runs 7 instances most of the day and 16-24 at peak instead of paying for peak capacity all month.

Where it is used

• Indian IT services and GCCs: TCS, Infosys, Wipro, HCLTech, LTIMindtree, Tech Mahindra, Accenture and Capgemini run cloud migration and managed-services practices; fresher roles are Cloud Engineer, Cloud Support Associate, DevOps Engineer and Cloud Administrator, usually with a mandated AWS/Azure associate certification in the first year.
• Consumer internet and fintech: Flipkart, Zomato, Swiggy, PhonePe, Paytm, Razorpay, Zerodha, Dream11 and Hotstar run autoscaling fleets, CDNs and managed data stores on Indian regions — IPL and festival-sale traffic is the standard scaling case study.
• BFSI and insurance: banks, NBFCs and insurers use cloud under RBI/IRDAI outsourcing norms with data localisation, encryption with customer-managed keys, audit rights and documented exit plans; hybrid and multi-cloud are common.
• Government and public digital infrastructure: MeghRaj/GI Cloud, NIC National Cloud and MeitY-empanelled providers host state portals, e-governance and public service platforms; tenders specify STQC audit and in-India data storage.
• Analytics, AI and SaaS products: BigQuery/Redshift/Synapse warehouses, Databricks on cloud object storage, and SageMaker/Vertex AI/Azure AI for model training and inference; Indian SaaS firms (Zoho being a notable self-hosted exception, Freshworks, Chargebee, Postman) build on these platforms.
• Education and jobs market: campus placement tests include cloud MCQs; AICTE/NEAT, NPTEL and provider academies (AWS Academy, Microsoft Learn, Google Cloud Skills Boost) are the common free routes to lab experience.

Interview questions

• Q: What is the difference between a region and an availability zone? A: A region is a geographic location containing multiple data centres; an availability zone is one or more isolated data centres within that region with independent power, cooling and networking, so spreading instances across AZs survives a single data-centre failure.
• Q: Explain the shared responsibility model with an example. A: The provider secures the cloud infrastructure while the customer secures configuration and data — for example, AWS keeps S3 durable and patched, but if you set a bucket policy to public and leak data, that is your responsibility.
• Q: What is the difference between a security group and a network ACL in AWS? A: A security group is stateful, attaches to an instance/ENI and supports allow rules only; a network ACL is stateless, attaches to a subnet and supports both allow and deny rules, so return traffic must be allowed explicitly.
• Q: When would you choose serverless over a virtual machine? A: For spiky, event-driven or low-volume workloads where scaling to zero and per-request billing beat paying for idle capacity; a steady, high-throughput or long-running workload with heavy startup cost is usually cheaper and more predictable on provisioned compute or containers.
• Q: How do you cut a cloud bill that has doubled? A: Read the cost explorer/cost analysis by tag and service first, then right-size over-provisioned instances, commit on the steady baseline, move batch to spot, schedule non-production shutdown, tier cold object data, cut egress with caching/CDN, and delete orphaned disks, snapshots and idle load balancers.
• Q: What is the difference between vertical and horizontal scaling in the cloud? A: Vertical scaling means moving to a bigger instance type (usually needs a restart and has a ceiling); horizontal scaling adds more instances behind a load balancer, which is what autoscaling and cloud-native design rely on.
• Q: Why should you not store access keys in application code? A: Keys in code leak through repositories and images and rarely get rotated; instead attach an IAM role, Azure managed identity or GCP service account so the platform issues short-lived credentials automatically.
• Q: Compare the account hierarchies of AWS, Azure and GCP. A: AWS groups accounts under organisational units in an Organization; Azure nests subscriptions under management groups inside an Entra ID tenant, with resource groups inside each subscription; GCP puts projects under folders in an organisation — the billing and isolation unit is the account, subscription and project respectively.
• Q: A workload has 99.99% availability requirement. How do you design for it? A: Define RPO/RTO, remove single points of failure by running stateless instances in at least three AZs behind a managed load balancer, use a multi-AZ managed database with automated failover, automate recovery and deployments, and remember that serial components multiply so every tier must also be redundant.
• Q: What is egress cost and why does it matter? A: It is the per-GB charge for data leaving the provider's network (and across regions/AZs); it dominates data-heavy bills, pushes architectures towards keeping compute near data, and is a practical source of vendor lock-in.
• Q: What does an SLA of 99.9% actually promise you? A: About 43.2 minutes of allowed downtime per 30-day month, and the remedy for a breach is a service credit against your bill — not compensation for lost business — and it applies only if your deployment meets the SLA's architectural conditions.
• Q: What Indian regulations affect where you put a workload? A: The DPDP Act, 2023 for personal data, RBI's directive requiring payment system data to be stored in India, CERT-In's 2022 directions on 6-hour incident reporting and 180-day in-India log retention, and MeitY/STQC empanelment for government workloads.
• Q: What is the difference between Cloud Run and a Kubernetes cluster? A: Cloud Run runs stateless containers fully managed with per-request autoscaling to zero and no cluster to operate; GKE/EKS/AKS give full Kubernetes control — stateful sets, operators, custom scheduling — at the cost of running and upgrading the cluster yourself.

Common mistakes

• Reciting service names without the concept: an answer must say what object storage *is*, not just that AWS calls it S3.
• Mixing up the hierarchies — calling an Azure subscription an "account", or putting resource groups in AWS.
• Assuming multi-AZ means multi-region, or that storing data in Mumbai alone satisfies disaster recovery.
• Forgetting egress and request charges in cost sums, and quoting monthly cost as rate × 720 or × 744 inconsistently (use 730 hours unless told otherwise).
• Treating availability as additive — stacking redundant tiers multiplies serial availabilities down, so one weak tier caps the system.
• Leaving test resources, elastic IPs, snapshots and NAT gateways running after a lab and then blaming the free tier for a bill.
• Hardcoding credentials or opening SSH/RDP (port 22/3389) and database ports to 0.0.0.0/0 in lab work — the single most common interview red flag.
• Quoting market share, free-tier credits, prices or certification fees as fixed facts; these change every quarter and should be stated as approximate.

Related topics

Cloud computing basics · Containers: Docker and Kubernetes · DevOps and CI/CD basics · Monitoring and site reliability engineering · Linux command line essentials · IT service management and ITIL