Cheatsheet Cloud

Fondasi cloud platform untuk senior backend engineer yang bekerja dengan Java/JAX-RS, Kubernetes, managed services, dan enterprise deployment.

AWS vs Azure Mental Model

Pemetaan konsep inti AWS dan Azure agar engineer tidak salah membaca boundary, identity, resource ownership, dan networking.

Landing Zone and Environment Strategy

Strategi landing zone, account/subscription separation, environment isolation, dan operational boundary untuk enterprise systems.

Cloud Networking Foundation

Fondasi cloud networking untuk memahami subnet, routing, NAT, firewall, DNS, ingress, egress, dan private connectivity.

AWS VPC Deep Dive

27 min

Pendalaman AWS VPC untuk backend engineer: subnet, routing, gateway, security group, NACL, endpoint, PrivateLink, Route 53 private hosted zone, dan flow logs.

Azure VNet Deep Dive

26 min

Pendalaman Azure VNet untuk backend engineer: subnet, UDR, NSG, Azure Firewall, Private Endpoint, Private Link, Private DNS, dan Network Watcher.

DNS in AWS and Azure

DNS publik, privat, hybrid, split-horizon, resolver, private endpoint DNS, Kubernetes CoreDNS, TTL, dan DNS failover untuk enterprise Java/JAX-RS systems.

Load Balancing in AWS

AWS load balancing untuk enterprise backend: ALB, NLB, target group, listener, rule, health check, TLS termination, SNI, sticky session, cross-zone, IP/instance target, ALB ingress, dan NLB Kubernetes Service.

Load Balancing in Azure

Azure load balancing untuk enterprise backend: Azure Load Balancer, Application Gateway, AGIC, Front Door awareness, Traffic Manager awareness, backend pool, health probe, listener, routing rule, TLS termination, WAF, private/public frontend, AKS ingress integration, dan source IP preservation.

API Gateway and API Management

API Gateway dan Azure API Management untuk enterprise backend: gateway vs ingress vs reverse proxy, AWS API Gateway, Azure APIM, route, stage/environment, usage plan, subscription key, JWT/OIDC, rate limiting, transformation, versioning, developer portal, private API, dan backend integration.

End-to-End Traffic Flow

24 min

Alur request dari client sampai Java/JAX-RS endpoint melalui DNS, edge, WAF, gateway, load balancer, ingress, Kubernetes Service, EndpointSlice, pod, TLS termination, header propagation, dan timeout chain.

Private Connectivity and Private Endpoint

Private endpoint mental model untuk AWS VPC Endpoint, AWS PrivateLink, Azure Private Endpoint, Azure Private Link, private DNS, routing, SG/NSG, pod-to-private-service call, on-prem-to-private-endpoint call, private API, registry, database, object storage, dan troubleshooting.

Hybrid and On-Prem Connectivity

25 min

VPN, AWS Site-to-Site VPN, Azure VPN Gateway, AWS Direct Connect, Azure ExpressRoute, Transit Gateway, Virtual WAN, BGP, CIDR overlap, routing domain, firewall, DNS forwarding, latency, MTU, TLS trust, dan hybrid deployment pattern untuk enterprise Java/JAX-RS systems.

Cloud Identity Foundation

23 min

Fondasi cloud identity untuk backend engineer: identity provider, principal, user, group, role, service account, service principal, managed identity, federation, trust policy, permission policy, RBAC, ABAC/tag-based access, least privilege, temporary credential, dan token audience.

AWS IAM Deep Dive

Pendalaman AWS IAM untuk senior backend engineer: IAM user, group, role, policy, trust policy, permission boundary, STS, AssumeRole, condition, resource-based policy, cross-account access, CloudTrail, Access Analyzer, dan debugging AccessDenied.

Azure Identity and RBAC Deep Dive

Pendalaman Azure identity untuk senior backend engineer: Microsoft Entra ID, app registration, service principal, managed identity, Azure RBAC, role assignment, scope, custom role, federated credential, PIM awareness, Conditional Access awareness, Activity Log, dan debugging AuthorizationFailed.

Kubernetes Workload Identity on AWS and Azure

Runtime identity untuk pod di EKS dan AKS melalui AWS IRSA, EKS OIDC, STS, Azure Workload Identity, federated identity credential, managed identity, SDK credential chain, token projection, credential rotation, dan troubleshooting.

AWS SDK for Java

AWS SDK for Java mental model untuk senior backend engineer: client builder, region provider, credential provider chain, STS credential, AssumeRole, endpoint override, HTTP client, timeout, retry, throttling, pagination, async client, error handling, metrics, logging, dan production review.

Azure SDK for Java

27 min

Azure SDK for Java mental model: DefaultAzureCredential, managed identity, service principal, endpoint configuration, HTTP pipeline, retry, timeout, throttling, pagination, async client, error handling, and diagnostics for enterprise Java/JAX-RS systems.

Object Storage: AWS S3 and Azure Blob

26 min

Object storage mental model for enterprise Java/JAX-RS systems: AWS S3, Azure Blob Storage, bucket, container, object/blob, metadata, versioning, lifecycle, storage class/tier, multipart upload, presigned URL, SAS token, access policy, encryption, event notification, large file handling, private access, and production review checklist.

File and Binary Handling from Java Services

Production-grade file and binary handling for Java/JAX-RS services using streaming upload/download, multipart requests, object storage, metadata persistence, presigned URL/SAS patterns, private access, virus scanning integration, memory safety, failure handling, observability, and PR review discipline.

Config Management in AWS and Azure

Production-grade configuration management for enterprise Java/JAX-RS systems using environment variables, Kubernetes ConfigMaps, AWS Systems Manager Parameter Store, AWS AppConfig, Azure App Configuration, feature flags, labels, versioning, runtime reload, caching, safe defaults, rollback, drift detection, and failure-aware operations.

Secret Management in AWS and Azure

24 min

Production-grade secret management for enterprise Java/JAX-RS systems using AWS Secrets Manager, AWS Systems Manager SecureString, Azure Key Vault, secret versioning, rotation, caching, Kubernetes External Secrets, Secrets Store CSI Driver, workload identity, audit, reload, and failure-aware operations.

Key Management and Encryption

Production-grade key management and encryption for enterprise Java/JAX-RS systems using encryption in transit, encryption at rest, AWS KMS, Azure Key Vault Keys, customer-managed keys, service-managed keys, envelope encryption, key policy, key permission, rotation, TLS certificates, HSM awareness, and operational failure modeling.

Container Registry: ECR and ACR

24 min

Container registry production model: ECR, ACR, image tag, digest, authentication, vulnerability scanning, signing, retention, replication, private access, and outage handling.

Compute Options for Backend Engineers

23 min

Compute selection framework for enterprise backend engineers: VM, container, Kubernetes, serverless function, batch job, managed service, EC2, Azure VM, Lambda, Azure Functions, ECS, Azure Container Apps, EKS, and AKS.

EKS Foundation

Fondasi Amazon EKS untuk senior backend engineer: managed control plane, node group, Fargate profile, add-on, VPC CNI, CoreDNS, kube-proxy, ECR integration, IRSA, security group, dan cluster endpoint.

EKS Networking

21 min

EKS networking dengan VPC CNI, pod IP from VPC, subnet IP exhaustion, security group, AWS Load Balancer Controller, ALB ingress, NLB service, Route 53, private cluster endpoint, public cluster endpoint, dan NetworkPolicy support consideration.

EKS Storage, Autoscaling, and Operations

EKS production operations: EBS CSI, EFS CSI, StorageClass, PersistentVolume, Cluster Autoscaler, Karpenter, node upgrade, add-on upgrade, pod disruption, Spot node awareness, CloudWatch Container Insights, Prometheus, dan operational runbook.

AKS Foundation

13 min

Fondasi Azure Kubernetes Service: managed control plane, node pool, system/user node pool, VM scale set, Azure CNI, kubenet awareness, ACR integration, managed identity, workload identity, cluster endpoint, add-on, dan operational boundary.

AKS Networking

14 min

AKS networking untuk senior backend engineer: Azure CNI, pod IP dari VNet/overlay, subnet IP planning, NSG, UDR, Azure Load Balancer, Application Gateway, AGIC, Azure Front Door awareness, Azure DNS, private cluster, private endpoint, NetworkPolicy, dan production troubleshooting.

AKS Storage, Autoscaling, and Operations

AKS production operations untuk storage, scaling, upgrade, disruption, observability, Key Vault CSI, and runbook: Azure Disk CSI, Azure Files CSI, StorageClass, PersistentVolume, Cluster Autoscaler, node pool scaling, node pool upgrade, PDB, Spot node pool, Azure Monitor Container Insights, Log Analytics, dan operational readiness.

Managed PostgreSQL on AWS and Azure

Amazon RDS for PostgreSQL, Aurora PostgreSQL awareness, Azure Database for PostgreSQL Flexible Server, private access, HA, backup, PITR, replica, maintenance, monitoring, and Java backend connection behavior.

Managed Messaging on AWS and Azure

21 min

Amazon MSK, MSK Connect, Amazon MQ for RabbitMQ, Azure Event Hubs Kafka-compatible endpoint awareness, self-managed Kafka/RabbitMQ on EKS/AKS, private connectivity, auth/security, monitoring, scaling, retention, broker upgrade, and cost.

Managed Redis on AWS and Azure

Production-oriented guide to managed Redis/Valkey on AWS and Azure for Java/JAX-RS backend systems: cluster mode, replication, failover, backup, encryption, AUTH/ACL, private networking, tuning, monitoring, scaling, maintenance, cost, and failure handling.

Monitoring and Logs: CloudWatch and Azure Monitor

15 min

Production-oriented monitoring and logging guide for AWS CloudWatch and Azure Monitor in Java/JAX-RS, EKS, AKS, Kubernetes, and enterprise backend systems. Covers metrics, logs, alerts, dashboards, container logs, application logs, platform logs, retention, cost, querying, and cross-service correlation.

Distributed Tracing and Application Observability

15 min

Distributed tracing dengan trace, span, correlation ID, OpenTelemetry, AWS X-Ray awareness, Azure Application Insights awareness, HTTP, Kafka/RabbitMQ, cloud SDK, sampling, dan high-cardinality risk.

Audit, Governance, and Cloud Policy

Cloud governance dengan CloudTrail, Azure Activity Log, AWS Config awareness, Azure Policy, SCP, management group policy, tagging, resource lock, compliance evidence, audit trail, change traceability, policy-as-code, dan drift detection.

Cloud Security Baseline

14 min

Security baseline untuk cloud backend: least privilege, network isolation, private endpoint, encryption, secret rotation, logging, audit, WAF, DDoS awareness, exposure review, vulnerability management, dan incident response.

WAF, Edge Security, and DDoS Protection

AWS WAF, Azure Web Application Firewall, managed rules, custom rules, rate-based rules, bot protection awareness, DDoS protection, allowlist, geo restriction, header inspection, path restriction, false positive, dan WAF logging.

CI/CD and Cloud Deployment

14 min

Cloud deployment pipeline: build, image push, artifact promotion, environment promotion, approval, OIDC federation, Terraform, Helm, GitOps, smoke test, dan rollback.

Infrastructure as Code

13 min

IaC production discipline dengan Terraform, Bicep awareness, CloudFormation awareness, ARM template awareness, module, state, remote backend, state locking, plan, apply, drift, import, destroy protection, dan secret in state risk.

GitOps with Cloud and Kubernetes

GitOps untuk Kubernetes dan cloud deployment dengan Argo CD, Flux, Helm values, Kustomize overlay, environment promotion, sync wave, health check, drift detection, rollback, dan secret integration.

Service-to-Service Communication

Komunikasi antar service melalui internal DNS, private endpoint, load balancer, ingress, API gateway, mTLS, JWT, service identity, header propagation, timeout, retry, circuit breaker, egress policy, dan cross-region/cross-cloud call.

Cloud SDK Reliability Patterns

Reliability pattern untuk AWS/Azure SDK: timeout, retry, backoff, jitter, throttling, rate limit, circuit breaker, bulkhead, pagination, partial failure, idempotency, request signing, credential refresh, dan regional endpoint failure.

Private Egress and Outbound Control

Egress control untuk Kubernetes dan cloud workloads: NAT Gateway, Azure NAT Gateway, firewall, proxy, NO_PROXY, private endpoint, VPC endpoint, NetworkPolicy, allowlist, domain filtering, TLS inspection, cloud SDK through proxy, dan egress cost.

Cloud Cost Fundamentals

Cloud cost model untuk backend systems: compute, storage, data transfer, NAT Gateway, load balancer, logs, metrics, managed database, managed broker, cross-AZ, cross-region, idle resource, overprovisioning, dan tag-based cost allocation.

Performance and Capacity Planning

Capacity planning untuk cloud backend: latency, throughput, regional placement, AZ placement, network path, cross-zone traffic, connection pooling, cloud SDK timeout, managed service capacity, Kubernetes node capacity, database, broker, Redis, dan load testing.

Availability and Resilience

Availability design untuk cloud backend: Availability Zone, Multi-AZ, region failure, service quota, throttling, retry storm, circuit breaker, failover, graceful degradation, blast radius, dependency isolation, SLO/SLA, dan error budget.

Backup, Restore, and Disaster Recovery

Disaster recovery untuk cloud systems: backup, snapshot, PITR, restore drill, cross-region replication, RPO, RTO, failover, DNS cutover, data consistency, dependency order, DR runbook, DR test, dan DR evidence.

Multi-Region and Cross-Cloud Awareness

Multi-region dan cross-cloud design: active-passive, active-active, regional failover, data replication, event replication, DNS failover, latency routing, split-brain, consistency trade-off, dan AWS-Azure integration.

On-Prem and Hybrid Deployment

Hybrid deployment untuk enterprise systems: on-prem, cloud, corporate firewall, private DNS, internal CA, proxy, air-gapped deployment, cloud control plane dependency, SDK from on-prem, private access, dan hybrid observability.

Cloud Quotas and Limits

8 min

Cloud quota dan limit yang sering menjadi failure mode: service quota, API throttling, IP exhaustion, ENI limit, load balancer limit, target group limit, private endpoint limit, IAM policy size, secret size, request rate, log ingestion, quota increase process, dan monitoring.

Incident Response in AWS and Azure

5 min

Incident response untuk cloud issues: severity, customer impact, outage, region/AZ issue, IAM/RBAC, secret, certificate, DNS, load balancer, private endpoint, database, broker, Kubernetes, rollback, dan RCA.

Troubleshooting Playbook

23 min

Production-safe debugging playbook untuk pod cannot call cloud service, credential missing, access denied, token expired, private endpoint unreachable, DNS wrong IP, TLS failure, throttling, SDK timeout, object upload failure, secret/config failure, 502/503/504, registry pull failure, dan missing logs.

Security, Privacy, and Compliance Review

21 min

Review security, privacy, dan compliance untuk cloud backend: IAM/RBAC, network exposure, public IP, private endpoint, secret, encryption, key management, audit log, retention, PII in logs, object storage policy, dan evidence.

PR Review and Architecture Decision Checklist

Checklist senior engineer untuk mereview PR dan ADR yang menyentuh cloud networking, VPC/VNet, DNS, load balancer, API gateway, private endpoint, IAM/RBAC, workload identity, secret/config, object storage, SDK, observability, cost, resilience, DR, dan security.

AWS/Azure Mapping Cheat Sheet

28 min

Mapping praktis AWS dan Azure untuk account/subscription, IAM/managed identity, VPC/VNet, SG/NSG, DNS, load balancer, API gateway/APIM, PrivateLink, registry, object storage, observability, secrets/config, dan Kubernetes.

30/60/90-Day Cloud Onboarding Plan