Compute, Storage and Networking in Cloud Environments

3 Nov 2026, 19:0915 min readby ITYantra Admin

# Compute, Storage and Networking in Cloud Environments ## Introduction Cloud computing delivers three fundamental infrastructure resources—compute, storage, and networking—as on-demand services. U

# Compute, Storage and Networking in Cloud Environments

Introduction

Cloud computing delivers three fundamental infrastructure resources—compute, storage, and networking—as on-demand services. Understanding how these core services work, their options, and how they integrate is essential for designing and operating cloud environments.

This tutorial provides a comprehensive guide to cloud compute services (virtual machines, containers, serverless), cloud storage services (block, file, object), and cloud networking services (VPC, subnets, load balancers, CDN, DNS). You will learn how to select, configure, and integrate these services for cloud workloads.

By the end of this guide, you will understand cloud compute, storage, and networking offerings and be able to design integrated cloud infrastructure.

Technical Background

Cloud Service Models

| Model | Abstraction Level | Customer Responsibility | Provider Responsibility | Examples | |-------|-------------------|------------------------|------------------------|----------| | IaaS | Infrastructure | OS, middleware, applications, data | Physical hardware, virtualization | EC2, Azure VMs, GCE | | PaaS | Platform | Applications, data | OS, middleware, runtime | App Service, App Engine, Heroku | | SaaS | Software | Usage, configuration | Everything | Office 365, Salesforce, Gmail |

Cloud Compute Options

| Option | Abstraction | Startup Time | Scaling | Management Overhead | Best For | |--------|-------------|--------------|---------|---------------------|----------| | Virtual Machine | OS level | Minutes | Minutes | High (OS patching) | Legacy apps, lift-and-shift | | Container | Process level | Seconds | Seconds | Medium (container image) | Microservices, DevOps | | Serverless/FaaS | Function level | Milliseconds | Automatic | Low (code only) | Event-driven, sporadic workloads | | Bare Metal | Hardware level | Hours | Hours | High | High performance, compliance |

Cloud Storage Options

| Type | Access Protocol | Use Case | Performance | Durability | |------|-----------------|----------|-------------|------------| | Block | iSCSI, NVMe-oF | Databases, VM boot disks | High IOPS, low latency | High (replicated) | | File | NFS, SMB | File shares, home directories, content management | Medium | High | | Object | REST/S3 API | Backups, media, archives, data lakes | High throughput | Very High (11 nines) |

Cloud Networking Options

| Component | Purpose | Example | |-----------|---------|---------| | VPC | Isolated network space | AWS VPC, Azure VNet, GCP VPC | | Subnet | Network segment within VPC | Public, private, database subnets | | Security Group | Instance-level firewall | AWS Security Groups | | Network ACL | Subnet-level firewall | AWS NACLs | | Load Balancer | Traffic distribution | ALB, NLB, CLB | | CDN | Content delivery at edge | CloudFront, Azure CDN, Cloud CDN | | DNS | Name resolution | Route 53, Azure DNS, Cloud DNS | | NAT Gateway | Outbound internet for private subnets | NAT Gateway |

Prerequisites

  • Understanding of cloud service models
  • Familiarity with virtualization and networking
  • Cloud provider account (or evaluation account)
  • Knowledge of IP addressing and DNS

Architecture

Three-Tier Cloud Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Internet / Users                         │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                      Edge Layer                             │
│              (CDN, WAF, DNS, Public LB)                     │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                    Public Subnet                            │
│              (NAT Gateway, Bastion Host)                    │
└─────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────┐
│                    Private Subnets                          │
│                                                                 │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐          │
│  │   Web Tier  │  │  App Tier   │  │   DB Tier   │          │
│  │  (VMs/K8s)  │  │  (VMs/K8s)  │  │ (Managed DB)  │          │
│  └─────────────┘  └─────────────┘  └─────────────┘          │
│                                                                 │
│  Storage: Object (S3) + Block (EBS) + File (EFS)              │
└─────────────────────────────────────────────────────────────┘

Step-by-Step Implementation

Step 1: Provision Cloud Compute

**Purpose**: Create and configure compute resources (VMs, containers, serverless).

**Commands** (AWS EC2):

# Launch single EC2 instance
aws ec2 run-instances \
    --image-id ami-0abcdef1234567890 \
    --instance-type t3.medium \
    --key-name my-key \
    --security-group-ids sg-xxxx \
    --subnet-id subnet-xxxx \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server},{Key=Environment,Value=production}]'

# Describe running instances
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" "Name=tag:Name,Values=web-server"

# Stop instance
aws ec2 stop-instances --instance-ids i-xxxx

# Start instance
aws ec2 start-instances --instance-ids i-xxxx

# Terminate instance
aws ec2 terminate-instances --instance-ids i-xxxx

# Create AMI from instance
aws ec2 create-image --instance-id i-xxxx --name "web-server-ami" --description "Production web server image"

**Commands** (ECS/Fargate containers):

# Create ECS cluster
aws ecs create-cluster --cluster-name production

# Register task definition
aws ecs register-task-definition --family web-app --container-definitions file://container-def.json

# Run task
aws ecs run-task --cluster production --task-definition web-app --count 2 --network-configuration file://network-config.json

# Create service (for long-running tasks)
aws ecs create-service --cluster production --service-name web-app --task-definition web-app --desired-count 3 --launch-type FARGATE --network-configuration file://network-config.json

**Commands** (Lambda serverless):

# Create Lambda function
aws lambda create-function \
    --function-name process-image \
    --runtime python3.11 \
    --role arn:aws:iam::123456789012:role/lambda-role \
    --handler lambda_function.lambda_handler \
    --code S3Bucket=my-code-bucket,S3Key=lambda-code.zip \
    --timeout 30 \
    --memory-size 256

# Invoke Lambda
aws lambda invoke --function-name process-image --payload '{"key":"value"}' response.json

# Create event trigger (S3 upload)
aws lambda create-event-source-mapping --function-name process-image --event-source-arn arn:aws:s3:::my-bucket

**Expected output**: Compute resources running workloads.

**Verification**:

  • Instances/tasks/functions in running state
  • Health checks passing
  • Auto-scaling (if configured) responding to load

Step 2: Provision Cloud Storage

**Purpose**: Create and configure storage resources (object, block, file).

**Commands** (AWS S3 - Object Storage):

# Create bucket
aws s3 mb s3://my-company-data --region us-east-1

# Enable versioning
aws s3api put-bucket-versioning --bucket my-company-data --versioning-configuration Status=Enabled

# Enable default encryption
aws s3api put-bucket-encryption --bucket my-company-data --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

# Upload object
aws s3 cp document.pdf s3://my-company-data/documents/

# Set lifecycle policy (transition to Glacier after 30 days)
aws s3api put-bucket-lifecycle-configuration --bucket my-company-data --configuration file://lifecycle.json

# List objects
aws s3 ls s3://my-company-data/documents/ --recursive

# Download object
aws s3 cp s3://my-company-data/documents/document.pdf ./document.pdf

**lifecycle.json**:

{
  "Rules": [
    {
      "ID": "TransitionToGlacier",
      "Status": "Enabled",
      "Filter": {"Prefix": "archives/"},
      "Transitions": [
        {"Days": 30, "StorageClass": "GLACIER"}
      ]
    }
  ]
}

**Commands** (AWS EBS - Block Storage):

# Create EBS volume
aws ec2 create-volume --size 500 --volume-type gp3 --availability-zone us-east-1a --encrypted --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=db-volume}]'

# Attach volume to instance
aws ec2 attach-volume --volume-id vol-xxxx --instance-id i-xxxx --device /dev/sdf

# Create snapshot
aws ec2 create-snapshot --volume-id vol-xxxx --description "Database backup $(date +%Y%m%d)"

# Create volume from snapshot
aws ec2 create-volume --snapshot-id snap-xxxx --availability-zone us-east-1a --volume-type gp3

# Modify volume (increase size)
aws ec2 modify-volume --volume-id vol-xxxx --size 1000

**Commands** (AWS EFS - File Storage):

# Create EFS file system
aws efs create-file-system --creation-token my-efs --performance-mode generalPurpose --throughput-mode bursting

# Create mount target
aws efs create-mount-target --file-system-id fs-xxxx --subnet-id subnet-xxxx --security-groups sg-xxxx

# Mount on EC2 instance
sudo mkdir -p /mnt/efs
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-xxxx.efs.us-east-1.amazonaws.com:/ /mnt/efs

**Expected output**: Storage resources created and accessible.

**Verification**:

  • Bucket exists with versioning and encryption
  • Volume attached and mounted on instance
  • File system mounted and accessible from multiple instances

Step 3: Provision Cloud Networking

**Purpose**: Create VPC, subnets, routing, and security for cloud resources.

**Commands** (AWS VPC):

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=production-vpc}]'

# Create public subnet
aws ec2 create-subnet --vpc-id vpc-xxxx --cidr-block 10.0.1.0/24 --availability-zone us-east-1a --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-subnet-1a}]'

# Create private subnet
aws ec2 create-subnet --vpc-id vpc-xxxx --cidr-block 10.0.10.0/24 --availability-zone us-east-1a --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-subnet-1a}]'

# Create internet gateway
aws ec2 create-internet-gateway --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=prod-igw}]'
aws ec2 attach-internet-gateway --internet-gateway-id igw-xxxx --vpc-id vpc-xxxx

# Create NAT gateway (in public subnet)
aws ec2 create-nat-gateway --subnet-id subnet-xxxx --allocation-id eipalloc-xxxx --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=prod-nat}]'

# Create route tables
aws ec2 create-route-table --vpc-id vpc-xxxx --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=public-rt}]'
aws ec2 create-route --route-table-id rtb-xxxx --destination-cidr-block 0.0.0.0/0 --gateway-id igw-xxxx

aws ec2 create-route-table --vpc-id vpc-xxxx --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=private-rt}]'
aws ec2 create-route --route-table-id rtb-yyyy --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-xxxx

# Associate subnets with route tables
aws ec2 associate-route-table --subnet-id subnet-public --route-table-id rtb-xxxx
aws ec2 associate-route-table --subnet-id subnet-private --route-table-id rtb-yyyy

**Commands** (Security Groups):

# Create security group for web tier
aws ec2 create-security-group --group-name web-sg --description "Web tier security group" --vpc-id vpc-xxxx
aws ec2 authorize-security-group-ingress --group-id sg-xxxx --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-xxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

# Create security group for app tier
aws ec2 create-security-group --group-name app-sg --description "App tier security group" --vpc-id vpc-xxxx
aws ec2 authorize-security-group-ingress --group-id sg-yyyy --protocol tcp --port 8080 --source-group sg-xxxx

# Create security group for database tier
aws ec2 create-security-group --group-name db-sg --description "Database security group" --vpc-id vpc-xxxx
aws ec2 authorize-security-group-ingress --group-id sg-zzzz --protocol tcp --port 3306 --source-group sg-yyyy

**Commands** (Load Balancer):

# Create target group
aws elbv2 create-target-group --name web-tg --protocol HTTP --port 80 --vpc-id vpc-xxxx --target-type instance --health-check-protocol HTTP --health-check-path /health

# Register targets
aws elbv2 register-targets --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/xxxx --targets Id=i-xxxx Id=i-yyyy

# Create application load balancer
aws elbv2 create-load-balancer --name web-alb --subnets subnet-xxxx subnet-yyyy --security-groups sg-alb-xxxx --subnet-mappings SubnetId=subnet-xxxx SubnetId=subnet-yyyy

# Create listener
aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/web-alb/xxxx --protocol HTTP --port 80 --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/xxxx

**Expected output**: VPC with public/private subnets, security groups, load balancer, and routing.

**Verification**:

  • Resources in correct subnets with correct security groups
  • Load balancer healthy checks passing
  • Private instances reach internet via NAT gateway
  • Public instances accessible via load balancer

Step 4: Integrate Compute, Storage, and Networking

**Purpose**: Connect compute instances to storage and networking resources.

**Example Workflow**:

# 1. Launch EC2 instance in private subnet with app security group
aws ec2 run-instances --image-id ami-xxxx --instance-type t3.medium --subnet-id subnet-private --security-group-ids sg-app --key-name my-key --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=app-server}]'

# 2. Create and attach EBS volume for application data
aws ec2 create-volume --size 100 --volume-type gp3 --availability-zone us-east-1a
aws ec2 attach-volume --volume-id vol-xxxx --instance-id i-xxxx --device /dev/sdf

# 3. Mount and format volume on instance
# (SSH into instance)
sudo mkfs.ext4 /dev/xvdf
sudo mkdir -p /data
sudo mount /dev/xvdf /data

# 4. Configure instance to access S3 bucket
# Attach IAM role with S3 permissions to instance
aws ec2 associate-iam-instance-profile --instance-id i-xxxx --iam-instance-profile Name=app-s3-role

# 5. Register instance with load balancer target group
aws elbv2 register-targets --target-group-arn arn:aws:elbv2:... --targets Id=i-xxxx

# 6. Verify end-to-end connectivity
curl http://<load-balancer-dns-name>/health

**Expected output**: Application accessible end-to-end through load balancer, using attached storage and S3.

**Verification**:

  • Load balancer health check passes
  • Application responds via load balancer DNS
  • Application can read/write attached EBS volume
  • Application can access S3 bucket via IAM role

Configuration Examples

Cloud Resource Tagging Strategy

Tags:
  Environment: production | staging | development
  Application: web | api | database | worker
  Owner: team-name
  CostCenter: cc-12345
  ManagedBy: terraform | console | script
  Backup: daily | weekly | none

VPC Architecture Example

VPC: 10.0.0.0/16
├── Public Subnet 1: 10.0.1.0/24 (us-east-1a) - ALB, NAT Gateway
├── Public Subnet 2: 10.0.2.0/24 (us-east-1b) - ALB, NAT Gateway
├── Private App Subnet 1: 10.0.10.0/24 (us-east-1a) - App servers
├── Private App Subnet 2: 10.0.11.0/24 (us-east-1b) - App servers
├── Private DB Subnet 1: 10.0.20.0/24 (us-east-1a) - Databases
└── Private DB Subnet 2: 10.0.21.0/24 (us-east-1b) - Databases

Storage Tiering Example

Hot (frequently accessed):    EBS gp3, S3 Standard
Warm (infrequently accessed): EBS st1/sc1, S3 Standard-IA
Cold (archival):              S3 Glacier, S3 Glacier Deep Archive

Verification

Resource Verification Commands

# Compute
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running"
aws ecs list-clusters
aws lambda list-functions

# Storage
aws s3 ls
aws ec2 describe-volumes
aws efs describe-file-systems

# Networking
aws ec2 describe-vpcs
aws ec2 describe-subnets
aws ec2 describe-security-groups
aws elbv2 describe-load-balancers

Expected Results

  • All resources in expected state (running, available, active)
  • Resources tagged correctly for cost allocation
  • Security groups allow only required traffic
  • Load balancer targets healthy
  • Storage encrypted and versioned where applicable

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | Instance unreachable | Security group or NACL blocking | `aws ec2 describe-security-groups` | Add inbound rule | Instance reachable | | Cannot access S3 | IAM permissions or bucket policy | `aws s3api get-bucket-policy` | Fix IAM role or bucket policy | S3 accessible | | Volume not attached | Instance in different AZ | `aws ec2 describe-volumes` | Create volume in same AZ | Volume attached | | Load balancer unhealthy | Target port or health check wrong | `aws elbv2 describe-target-health` | Fix health check or application | Targets healthy | | High latency | Cross-AZ traffic or undersized instance | CloudWatch metrics | Place resources in same AZ; scale up | Latency improved | | Storage costs high | No lifecycle policy | `aws s3api get-bucket-lifecycle-configuration` | Add lifecycle rules | Costs reduced | | Cannot resolve DNS | DHCP options or VPC DNS disabled | `aws ec2 describe-vpcs` | Enable DNS resolution | DNS resolves |

Best Practices

1. **Use managed services**: Prefer RDS, DynamoDB, S3 over self-managed alternatives. 2. **Design for AZ failure**: Distribute resources across multiple AZs. 3. **Implement least privilege**: Security groups and IAM roles should grant minimum required access. 4. **Tag all resources**: Enable cost allocation, automation, and management. 5. **Use encryption everywhere**: Enable encryption at rest and in transit by default. 6. **Implement lifecycle policies**: Transition data to cheaper storage tiers automatically. 7. **Right-size resources**: Monitor utilization and adjust instance sizes. 8. **Use spot instances**: For fault-tolerant workloads to reduce costs. 9. **Implement health checks**: Load balancer and Auto Scaling health checks ensure availability. 10. **Document architecture**: Maintain architecture diagrams and infrastructure as code.

Conclusion

Cloud compute, storage, and networking are the three foundational services of cloud computing. Compute provides processing power (VMs, containers, serverless), storage provides data persistence (block, file, object), and networking provides connectivity (VPC, subnets, load balancers). Understanding how to select, configure, and integrate these services is essential for building scalable, reliable, and secure cloud applications. Infrastructure as code, automation, and continuous monitoring enable managing these services at scale.

References

  • AWS Documentation (https://docs.aws.amazon.com/)
  • Azure Documentation (https://learn.microsoft.com/azure/)
  • Google Cloud Documentation (https://cloud.google.com/docs/)
  • Cloud Architecture Center (https://cloud.google.com/architecture/)
  • Well-Architected Framework (AWS/Azure/GCP)
#cloud-computing#compute#storage#networking#IaaS#cloud-services#virtual-machines#object-storage#block-storage#VPC