Cloud Computing Foundations

Introduction

Cloud computing is a way of obtaining computing capabilities—such as processing, storage, databases, networking, and software—over a network, usually the Internet, rather than owning and operating all supporting infrastructure locally. The central idea is not simply that a server is located elsewhere. Cloud computing combines shared infrastructure, virtualisation, automation, network access, measured usage, and service management into an operational model in which resources can be requested and released as business needs change.

For organisations, this shift changes technology from a collection of purchased assets into a set of services. A business can acquire computing capacity in minutes, pay according to an agreed pricing model, and allow a provider to operate much of the underlying infrastructure. However, cloud adoption does not remove responsibility. It redistributes responsibility among the cloud provider, the customer, users, software vendors, and regulators.

This chapter establishes the foundation required for later study of cloud architecture and services.

Learning objectives

After studying this chapter, you should be able to:

• describe the evolution from traditional computing to cloud computing;
• explain the essential characteristics and common service and deployment models;
• distinguish benefits from limitations and risks;
• apply the shared-responsibility principle;
• use important cloud terminology accurately;
• explain the business drivers behind cloud adoption; and
• evaluate cloud decisions using technical, financial, governance, and organisational considerations.

The evolution of cloud computing

Cloud computing emerged from several developments rather than from one invention.

Mainframe time-sharing. Early organisations used large central computers shared by many users. Time-sharing demonstrated that computing could be delivered as a pooled service, although access was commonly through specialised terminals and capacity was limited.

Personal computers and client–server systems. During the personal-computer era, processing and data moved closer to users. Client–server architectures divided work between user devices and servers, but organisations still had to buy, configure, secure, and maintain their own equipment.

The Internet and web applications. Widespread networks made it practical to access applications remotely. Web-based software reduced the need to install software on every workstation and established the expectation that services could be reached through a browser.

Virtualisation. Virtualisation allows one physical machine to host multiple logically isolated virtual machines. This improves utilisation and permits workloads to be created, moved, resized, or retired without changing physical hardware. Virtualisation is important to cloud computing, but it is not synonymous with cloud computing: a virtual machine in a private server room is not automatically a cloud service.

Utility computing and managed services. Providers began offering computing capacity as an on-demand utility. Increasing automation, large-scale data centres, high-speed networks, container technology, and application programming interfaces (APIs) made self-service infrastructure commercially viable.

Modern cloud platforms. Current platforms offer infrastructure, managed databases, analytics, artificial intelligence services, security tools, and serverless execution. Resources can be provisioned programmatically and integrated into automated delivery pipelines.

This history shows a progressive abstraction: users increasingly request outcomes or services rather than directly managing physical components.

What cloud computing means

A widely used definition describes cloud computing as a model that enables convenient, on-demand network access to a shared pool of configurable computing resources—such as networks, servers, storage, applications, and services—that can be rapidly provisioned and released with minimal management effort or provider interaction.

Several ideas are contained in this definition:

• On demand: a customer can obtain resources when required.
• Network access: services are reachable through appropriate networks and client devices.
• Resource pooling: provider resources serve multiple customers using logical isolation and allocation controls.
• Rapid elasticity: capacity can expand or contract in response to demand.
• Measured service: usage is monitored, controlled, and often billed according to consumption.

These properties describe a service model, not merely a location or purchasing arrangement.

Essential characteristics

Self-service provisioning

A customer or authorised application can create resources through a portal, command-line tool, API, or infrastructure-as-code system. Self-service reduces waiting for manual infrastructure teams. It also creates governance requirements: without approval controls, users may create insecure or unnecessarily expensive resources.

Broad network access

Cloud services are designed for access over networks using standard mechanisms. Access may be through browsers, mobile applications, private links, or APIs. Broad access increases flexibility but makes identity management, endpoint security, and network design central concerns.

Resource pooling and multitenancy

Providers pool physical resources and allocate them dynamically among customers. Tenants may share hardware while remaining logically separated. Isolation is achieved through mechanisms such as access controls, virtual networks, hypervisors, encryption, and workload boundaries. Multitenancy improves utilisation and lowers cost, but customers must understand the provider’s isolation, compliance, and data-handling practices.

Elasticity and scalability

Scalability is the ability of a system to handle increased workload by adding resources or improving its design. Scaling may be vertical (larger individual resources) or horizontal (more instances). Elasticity adds the ability to adjust capacity automatically or quickly as demand changes. A system can be scalable without being highly elastic if changes require lengthy manual intervention.

Measured service

Cloud platforms record consumption such as compute time, storage volume, requests, network transfer, or licensed users. Measurement supports monitoring and billing. It also enables FinOps practices, in which teams manage cloud expenditure as an ongoing operational responsibility.

Automation and programmability

APIs and declarative configuration allow infrastructure and services to be managed as code. Automation improves repeatability and supports continuous integration and delivery. It can also reproduce errors rapidly; therefore, code review, testing, policy enforcement, and controlled permissions are essential.

Cloud service models

Service models describe the portion of the technology stack managed by the provider and the portion managed by the customer.

Boundaries vary by provider. A managed database, for example, removes many database administration tasks but does not eliminate the customer’s responsibilities for schema design, data classification, access permissions, or lawful use.

IaaS offers control and flexibility but requires more administration. SaaS offers convenience but usually provides less control over architecture and update timing. PaaS occupies a middle position and may increase developer productivity while creating dependence on a provider’s interfaces and operating model.

Deployment models

• Public cloud: infrastructure is operated by a provider for many customers and accessed through public or private network connections.
• Private cloud: cloud technologies and self-service capabilities are dedicated to one organisation. It may be operated internally or by a third party.
• Hybrid cloud: two or more distinct environments are connected so that workloads, data, or management processes can interact.
• Community cloud: infrastructure is shared by organisations with common requirements, such as a sector, mission, or regulatory context.
• Multicloud: an organisation uses services from multiple cloud providers. This may improve access to specialised capabilities but increases integration and governance complexity.

A deployment label does not by itself indicate security, cost, or suitability. Those properties depend on architecture, controls, contracts, workload requirements, and operational competence.

Benefits of cloud computing

Agility and speed

Teams can provision environments quickly and test ideas without waiting for hardware procurement. This shortens the path from concept to service and supports experimentation.

Elastic capacity

Cloud resources can respond to variable demand. A retailer may increase application capacity during a seasonal event and reduce it afterward. Elasticity is valuable when demand is uncertain, although automatic scaling must be correctly configured and monitored.

Financial flexibility

Cloud can convert some capital expenditure into operating expenditure and reduce the need to maintain underused capacity. This is not a guarantee of lower total cost. Consumption charges, data transfer, premium managed services, support plans, compliance controls, and staff skills all affect total cost of ownership.

Access to advanced capabilities

Providers offer global networks, managed databases, data platforms, security services, and machine-learning tools that may be costly for a small organisation to build independently.

Resilience options

Multiple availability zones, regions, backups, and replication can support continuity. Resilience must be designed and tested; simply moving an application to the cloud does not automatically make it highly available.

Focus on organisational value

Managed services can reduce routine infrastructure administration, allowing teams to focus on applications, analysis, customer experience, and business processes.

Limitations and risks

Cloud services introduce trade-offs.

Dependency and portability. Applications may depend on proprietary APIs, data formats, or operational practices. Moving workloads can require redesign, data transfer, testing, and retraining.

Cost unpredictability. Usage-based pricing can produce unexpected bills, especially through uncontrolled scaling, high storage growth, or network egress. Budgets, alerts, quotas, tagging, and regular review are needed.

Availability and connectivity. A provider outage or loss of network connectivity can interrupt service. Critical systems require suitable architectures, recovery procedures, and tested alternatives.

Security exposure. Misconfigured storage, excessive permissions, compromised credentials, vulnerable code, and insecure interfaces remain serious risks. Cloud security is a shared activity, not a product automatically supplied by the provider.

Compliance and data sovereignty. Laws or contracts may constrain where data is stored, processed, or transferred. Organisations must understand jurisdictions, retention duties, audit rights, breach notification, and deletion procedures.

Operational complexity. Cloud makes resources easy to create, but large environments can become difficult to understand. Poorly governed accounts, networks, identities, and services generate technical debt.

Skills and organisational change. Cloud requires competence in automation, security, architecture, cost management, and service operations. A migration may fail if it changes technology but not processes and responsibilities.

The shared-responsibility principle

The shared-responsibility principle states that security and operational duties are divided between provider and customer. The provider is responsible for security of the cloud—such as physical facilities, hardware, and core service infrastructure. The customer is responsible for security in the cloud—such as identities, data, configurations, and workloads. The exact boundary depends on the service model.

A useful practical rule is: never assume that a provider’s certification or service availability transfers all responsibility to the customer’s organisation. The customer must read service documentation, configure controls, monitor activity, and maintain evidence.

Common terminology

An availability zone is an isolated location within a cloud region, designed to reduce the impact of local failures. A region is a geographic area containing one or more provider facilities or zones. A virtual machine is a software-defined computer running on shared physical hardware. A container packages an application and its dependencies while sharing the host operating-system kernel. An image is a template used to create a machine or workload. An instance is a running resource created from an image or configuration.

An API is a defined interface through which software requests services. An SDK is a software development kit that helps programmers use an API. Infrastructure as code (IaC) represents infrastructure configuration in machine-readable files. Orchestration coordinates deployment and operation of multiple resources or containers. Serverless means that the provider manages server provisioning and capacity decisions; servers still exist, but customers focus on code or services.

High availability concerns reducing service interruption during expected component failures. Disaster recovery concerns restoring service after a significant disruptive event. Recovery time objective (RTO) is the maximum targeted time to restore service. Recovery point objective (RPO) is the maximum targeted amount of data loss measured in time. For example, an RPO of 15 minutes means the organisation aims to lose no more than approximately 15 minutes of transactions, subject to the design and its limits.

A service-level agreement (SLA) is a contractual commitment concerning service performance or availability. An SLA is not identical to a system’s actual reliability and normally includes exclusions and remedy conditions.

Business drivers and decision-making

Cloud adoption is usually driven by a combination of factors:

1. Demand uncertainty: variable or rapidly growing workloads benefit from elastic capacity.
2. Time to market: self-service resources accelerate development and release.
3. Modernisation: managed services can replace ageing systems and improve maintainability.
4. Global reach: providers offer regional presence and distributed delivery options.
5. Financial strategy: organisations may seek reduced capital commitments or more transparent service costing.
6. Workforce and collaboration: cloud applications support distributed teams and standardised access.
7. Innovation: data, analytics, automation, and AI services become easier to adopt.
8. Continuity: replicated designs and managed backup services can strengthen recovery capabilities.

A sound business case compares alternatives rather than assuming that cloud is always best. It should assess workload suitability, migration effort, licensing, security, compliance, performance, skills, exit costs, and five-year operating implications where appropriate. Non-financial benefits—such as faster delivery or improved resilience—should be identified explicitly rather than hidden in a simple infrastructure-cost comparison.

An illustrative case: a growing online retailer

Background. Northstar Retail, a fictional medium-sized retailer, operates an online store from two company-owned servers. Sales increase sharply during holiday campaigns, while normal-day utilisation is low.

Problem. The retailer experiences slow response during peaks, spends heavily on hardware upgrades, and has informal backup procedures. The technology team proposes moving everything to a public cloud immediately.

Analysis. A direct migration could preserve existing weaknesses. The team first classifies customer and payment data, confirms regulatory and contractual requirements, measures normal and peak workload, and identifies dependencies. Payment processing is outsourced to a compliant specialist, reducing the retailer’s handling of payment-card data. Product content and order data require different availability and recovery designs.

Approach. The retailer adopts a phased architecture: a managed database with automated backups, horizontally scalable application instances behind a load balancer, object storage for images, centralised identity with multifactor authentication, and monitoring with cost alerts. Infrastructure is defined as code. Two availability zones are used for the main service, while a separate recovery plan addresses regional disruption. The team conducts load tests and restores backups before the seasonal launch.

Outcome. The retailer can add application capacity during campaigns and remove it afterward. Operational visibility improves, and recovery procedures become testable. Costs are not automatically minimal: data transfer, database capacity, observability, and support services require continuous review.

Learning points. The case demonstrates that cloud value comes from an appropriate operating model, not from relocation alone. Security classification, shared responsibilities, automation, resilience testing, and cost governance must be designed together.

Governance, ethics, and responsible use

Cloud governance defines who may create resources, which configurations are permitted, how data is handled, and how performance and cost are reviewed. Effective controls include central identity management, least privilege, multifactor authentication, encryption where appropriate, logging, vulnerability management, policy-as-code, resource tagging, backup testing, and documented incident response.

Ethical and legal concerns include privacy, surveillance, discriminatory automated decisions, accessibility, data ownership, and environmental impact. AI services can intensify these issues because training data, model outputs, and automated decisions may be difficult to explain or correct. Organisations should establish human oversight, data-protection review, documented accountability, and a process for challenging harmful outcomes.

Cloud data centres consume energy and water, and their environmental impact depends on workload efficiency, provider energy sources, hardware life cycles, and utilisation. Sustainable practice includes right-sizing, shutting down idle resources, selecting efficient architectures, and considering regional environmental information where available.

Best-practice foundation

A beginner organisation should:

• define business and technical requirements before selecting services;
• establish accounts, identity, naming, tagging, and approval standards;
• use least privilege and multifactor authentication from the beginning;
• automate repeatable deployments and review infrastructure code;
• monitor reliability, security, performance, and cost together;
• classify data and verify regulatory and contractual obligations;
• design backups and recovery objectives explicitly, then test restoration;
• document provider and customer responsibilities;
• plan portability and exit requirements for important workloads; and
• improve architecture iteratively using evidence from operations.

Chapter Summary

Cloud computing delivers pooled, network-accessible computing resources through on-demand, automated, elastic, and measured services. It evolved from time-sharing, client–server computing, the Internet, virtualisation, and utility computing. IaaS, PaaS, SaaS, and FaaS differ mainly in the division of management responsibility, while public, private, hybrid, community, and multicloud describe deployment arrangements.

Cloud can improve agility, elasticity, access to advanced capabilities, resilience, and organisational focus. It can also create portability, availability, cost, security, compliance, skills, and complexity risks. The shared-responsibility principle is essential: providers secure the underlying cloud, while customers secure their data, identities, configurations, and workloads according to the service model. Successful adoption is therefore a business and governance decision as well as a technical migration.

Key Terms

Cloud computing: Delivery of computing resources as network-accessible services.

Virtualisation: Abstraction that allows multiple logical computing environments to share physical hardware.

Elasticity: Ability to increase or decrease capacity in response to changing demand.

Scalability: Ability to handle greater workload through additional or improved resources.

Multitenancy: Use of shared infrastructure by multiple logically isolated customers.

IaaS: Service model providing configurable infrastructure resources.

PaaS: Service model providing a managed application platform.

SaaS: Complete software application delivered as a service.

FaaS: Event-driven execution model in which the provider manages runtime capacity.

Public cloud: Provider-operated cloud shared by multiple customers.

Private cloud: Cloud environment dedicated to one organisation.

Hybrid cloud: Connected combination of distinct cloud or non-cloud environments.

API: Defined software interface for requesting or exchanging capabilities.

Infrastructure as code: Machine-readable management of infrastructure configuration.

Region: Geographic area containing cloud infrastructure locations.

Availability zone: Isolated location designed to limit the effect of local failures.

SLA: Contractual commitment about specified service performance or availability.

RTO: Target maximum time to restore a service.

RPO: Target maximum period of data loss measured in time.

Shared responsibility: Division of security and operational duties between provider and customer.

Review Questions

Short Answer Questions

1. What distinguishes cloud computing from simply owning a virtual machine?
2. State the five essential characteristics commonly associated with cloud computing.
3. How do scalability and elasticity differ?
4. What is the purpose of an API in cloud computing?
5. Define RTO and RPO.

Long Answer Questions

1. Explain the evolution from mainframe time-sharing to modern cloud platforms.
2. Compare IaaS, PaaS, SaaS, and FaaS in terms of control and responsibility.
3. Discuss four benefits and four limitations of cloud adoption.
4. Explain the shared-responsibility principle using identity, data, operating-system, and physical-infrastructure examples.
5. Describe how governance can control security, compliance, and cloud expenditure.

Analytical / Application Questions

1. A university expects enrolment-related traffic to peak for two weeks each year. Which cloud characteristics and service choices could address this pattern, and what risks must be governed?
2. A company wants to move a regulated database to a public cloud. Construct a decision checklist covering data location, access control, backup, provider assurance, recovery, and exit planning.
3. Using the Northstar Retail case, identify two design decisions that improve resilience and two controls that reduce the risk of unexpected cost. Explain your reasoning.

Multiple Choice Questions with Answers

Question 1

Which characteristic allows cloud resources to be automatically adjusted as demand changes?

A. Elasticity

B. Multitenancy

C. Portability

D. Colocation

Correct Answer: A. Elasticity

Question 2

In an IaaS model, which responsibility normally remains with the customer?

A. Maintaining the provider’s physical data-centre power

B. Patching the guest operating system

C. Replacing failed physical disks

D. Managing the hypervisor

Correct Answer: B. Patching the guest operating system

Question 3

What is the main purpose of infrastructure as code?

A. To remove the need for all security controls

B. To represent and deploy infrastructure through repeatable machine-readable definitions

C. To guarantee that cloud services are free

D. To replace all application source code

Correct Answer: B. To represent and deploy infrastructure through repeatable machine-readable definitions

Question 4

Which deployment model combines distinct environments, such as a private environment and a public cloud, with integration between them?

A. Community cloud

B. Hybrid cloud

C. Single-tenant SaaS

D. Local computing

Correct Answer: B. Hybrid cloud

Question 5

Under the shared-responsibility principle, which item is primarily the customer’s responsibility in most cloud models?

A. Physical security of the provider’s buildings

B. Power supply to the provider’s servers

C. Configuration of customer identities and permissions

D. Manufacture of provider hardware

Correct Answer: C. Configuration of customer identities and permissions

Question 6

What does an RPO of 15 minutes express?

A. The service must be restored within 15 minutes

B. The system may intentionally remain unavailable for 15 minutes

C. The target maximum data loss is approximately 15 minutes of transactions

D. The provider must respond to every request within 15 minutes

Correct Answer: C. The target maximum data loss is approximately 15 minutes of transactions

Question 7

Which is a likely risk of uncontrolled consumption-based cloud usage?

A. Unexpected expenditure

B. Guaranteed hardware ownership

C. Permanent elimination of network dependency

D. Removal of all compliance duties

Correct Answer: A. Unexpected expenditure

Question 8

Which service model generally provides the customer with a complete application managed by the provider?

A. IaaS

B. PaaS

C. SaaS

D. Bare metal hosting

Correct Answer: C. SaaS

Question 9

Why is a provider’s security certification not sufficient by itself for customer security?

A. Certifications eliminate the need for contracts

B. Customers still configure identities, data controls, and workloads

C. Cloud providers cannot implement physical security

D. Certifications apply only to personal computers

Correct Answer: B. Customers still configure identities, data controls, and workloads

Question 10

Which business driver is most directly associated with adding capacity during a seasonal sales peak and removing it afterward?

A. Elastic demand management

B. Data sovereignty

C. Hardware depreciation

D. Software copyright

Correct Answer: A. Elastic demand management