Skip to content

Cloud side track

Optional, Friday afternoons, from week 9. You start it once you're deploying for real, so the ideas land on something you've just done, and week 11's AWS deploy is quick instead of a detour. It isn't a certification push. If a main week is full, skip that Friday without guilt.

Course: AWS Cloud Practitioner Essentials on AWS Skill Builder: free, self-paced, with videos and short knowledge checks. You need a free Skill Builder account. Do a module or two each Friday; it doesn't have to line up with the topics below.

Each Friday: about an hour of the course, then about an hour applying one idea to your own app. Write one paragraph about it in notes/cloud.md: what the idea is, what you changed, and how you'd explain it in an interview.

Concepts

Shared responsibility. The cloud provider looks after its buildings, machines and networks. You look after what you put on them: who can reach your service, what your code does, where your secrets go, and how much you let it spend.

Pay as you go. You pay for what runs, by the second, request or gigabyte. That's cheap for a small project and dangerous for a forgotten one. Alerts tell you about spending; only limits stop it.

Identity and access (IAM). Every action in a cloud is done by an identity (you, a service account, a role) that has been allowed to do it. "Least privilege" means each identity gets only what its job needs, so a leaked credential can do little harm.

Week 9 Friday — Billing alerts, everywhere you can spend

You now have three bills: Anthropic, Google Cloud and, from week 11, AWS. Each has an alert, and each alert works differently.

  1. Anthropic: check that the organisation spend limit and the scam-checker workspace limit from week 9 are set, with alerts. These are true limits: requests stop at them.
  2. Google Cloud: open your budget from week 9 Thursday and check the alert thresholds and the email address. A Google Cloud budget only alerts; it never stops anything.
  3. AWS: if you're going to do week 11, create the account now so it's ready. Turn on multi-factor authentication for the root user (how), then create a monthly cost budget with email alerts. Note how much free credit the account came with on the Free Tier page.

In notes/cloud.md: a table of your three bills, each with its alert, its hard limit if it has one, and what happens when you reach it.

Week 10 Friday — IAM: who may do what

  1. List what each Google Cloud identity you made in week 9 may do:

    gcloud projects get-iam-policy "$(gcloud config get project)" \
  --flatten="bindings[].members" --format="table(bindings.role, bindings.members)"

    For each line, ask: does this identity need this role? The deployer should be able to deploy but not read secrets; the runtime service account should be able to read its secrets but not deploy.

  2. AWS: stop using the root user. Create an everyday admin identity for yourself, either through IAM Identity Center, which AWS recommends, or an IAM user with MFA, and sign in with that from now on. Skim IAM best practices.

  3. Compare the two clouds' words for the same ideas: a Google Cloud service account against an AWS role, and a role binding against a policy attached to a role. You'll use both in week 11.

In notes/cloud.md: one paragraph on least privilege, using your deployer and runtime identities as the example.

Week 11 Friday — Logs

  1. Your JSON logs now land in two places: Cloud Logging and CloudWatch Logs. In Cloud Logging's Logs Explorer, filter on jsonPayload.verdict="scam" and open one entry to see its fields. In CloudWatch, re-run Thursday's Logs Insights query.

  2. Check how long each keeps your logs. By default, CloudWatch Logs keeps log data indefinitely, which costs money and keeps data longer than you need. Set 30 days on the service's log group:

    aws logs put-retention-policy --log-group-name <your log group> --retention-in-days 30

  3. Search both for anything that looks like personal data: a phone number, an email address, an NRIC. There should be none, because you only log ids and numbers. If you find one, find the line of code that logged it and fix it.

In notes/cloud.md: how long each cloud keeps your logs, and why keeping less is safer.

Week 12 Friday — Secrets: rotate one

Rotating a secret means replacing it on purpose, before anyone has a chance to misuse it. Do it once now, while nothing is urgent, so you know the steps when something is.

  1. In the Claude Console, create a new cloud-run key.

  2. Add it to Secret Manager as a new version, and redeploy so the service picks it up:

    read -rs KEY && printf '%s' "$KEY" | gcloud secrets versions add anthropic-api-key --data-file=- && unset KEY
gcloud run services update scam-checker-api --region asia-southeast1 \
  --update-secrets ANTHROPIC_API_KEY=anthropic-api-key:latest

  3. Check the live site still works, then disable the old key in the Console. Watch the Console's Usage page: the old key's line should go quiet.

In notes/cloud.md: the rotation steps as a checklist, and how long the whole thing took.

Week 13 Friday — Budget caps

Week 9 Friday was about alerts. This one is about limits that actually stop spending, and their side effects.

  1. List every limit you have: the Anthropic spend limits, --max-instances 2 on Cloud Run, maxTaskCount of 1 on ECS. Each caps cost, and each also caps how many users you can serve at once.
  2. Read about AWS budget actions, which can apply a restrictive IAM policy automatically when a budget is crossed. Decide whether you'd use one for this project, and why.
  3. Check that nothing is still running on AWS that you don't need.

In notes/cloud.md: for each limit, what it protects you from and what it costs your users when it's reached.

The exam, if you want the badge

After week 13, and only if you want it, you could sit the AWS Certified Cloud Practitioner exam. At the time of writing it costs US$100, lasts 90 minutes and has 65 multiple-choice questions, taken at a Pearson VUE test centre or online with a proctor. The course above, your week 11 deploy and these notes are good preparation; Skill Builder's exam-prep material helps with the question style.

Leave the Associate-level certifications until a role you're targeting asks for one. A deployed product with a cost report shows more than a badge does.