InfrastructureSubsection
Cloud
Three providers, deliberately not compared by service catalogue — those converge, and a feature table is out of date the month it is written. Each page takes one durable mechanism instead: how AWS decides whether a request is allowed and how far a mistake spreads, what a boundary in GCP costs to draw, and why Azure splits the directory from the resources. Learn those three and the catalogues stop mattering.
What is inside
Every page in this group, with what each one covers.
- AWSHow a request is authorised and how far a mistake reaches — the two questions every AWS design is really answering.IAMBlast radius
- GCPThe resource hierarchy as the unit of everything: where a boundary goes, and what it costs to move one later.HierarchyProjects
- AzureTwo planes that people constantly conflate: the directory that knows who you are, and the resources you act on.Two planesEntra
Where to start
- New to a providerRead only the one you are on, and read the mechanism rather than the service list — that is what will still be true next year.
- Designing accounts and projectsGCP for the hierarchy and AWS for the blast radius — the same decision, argued from two directions.
- Permissions keep surprising youYour provider’s authorisation model. On Azure specifically, the two-plane split explains most of the confusion.
Elsewhere in the section
- InfrastructureInfrastructure is everything that turns code into something running that you can observe, change and roll back. This section covers 11 topics in four groups: DevOps and the pipeline that builds one artifact and promotes it unchanged, the three major clouds and how each contains a mistake, MLOps — the same problems again for a model instead of a binary — and the monitoring that makes an incident answerable at three in the morning.
- DevOpsGetting a change from a developer’s machine to a running system, repeatably and without ceremony. Three topics that stack: the pipeline that decides whether a change is safe, the image format that makes "it works on my machine" a testable claim, and the scheduler that keeps the result running. Each page is about the mechanism rather than a tool’s configuration syntax, which is what transfers when you change tools.
- MonitoringTwo pages with a clean line between them. Logging owns the record — what gets written down and whether a question asked three weeks later has an answer. Alerting starts where a condition has to reach a person, which makes it a question about interrupting somebody rather than about thresholds. Read them in that order: you cannot alert usefully on data you never structured.
Found this useful?
Share it with someone who is working on the same problem.