Full Stack Engineering · Day 5

Cloud & AI Agents Masterclass

Understand what cloud is, where every major service belongs, how to design a secure solution, and how AWS, Microsoft and Google run production AI agents.

Cloud fundamentalsAWS · Azure · Google CloudArchitectureSecurityFinOpsAI agentsMCP & SDKs

Cloud turned infrastructure into an on-demand utility.

The revolution was programmable capacity: provision in minutes, pay for use, scale automatically and discard safely.

Data center

Buy servers, predict peak demand and operate everything.

Virtualization

Share hardware across isolated virtual machines.

Public cloud

Rent compute, storage, networks and managed platforms through APIs.

Cloud native

Containers, serverless, automation, observability and managed AI.

Cloud is an operating model: self-service, network access, shared pools, rapid elasticity and measured usage.

Think in layers, locations and responsibility.

Service model

IaaS: control the OS. PaaS: deploy code. Serverless: run on demand. SaaS: use the application.

Deployment model

Public, private, hybrid or multi-cloud—chosen because of real constraints.

Location model

A region contains isolated availability zones; edge locations serve users nearby.

Managed does not mean responsibility-free. Providers secure the cloud; customers secure identities, configuration, applications and data in the cloud.

Every cloud catalog is built from familiar categories.

Compute

VMs, containers, Kubernetes, functions and app platforms.

Data

Object storage, relational, NoSQL, cache, warehouse and streaming.

Network

Virtual networks, DNS, load balancers, gateways, CDN and private links.

Platform

Identity, secrets, monitoring, messaging, DevOps, analytics and AI.

Need	Start with	Reason
Conventional or legacy server	Virtual machine	OS-level control
Portable web/API service	Managed containers	Container portability with less operations
Bursty event-driven code	Function/serverless	Scale to demand
Transactional system of record	Managed relational DB	Constraints and transactions
Files, media, backups, lake	Object storage	Durable blobs at massive scale
Decouple services	Queue or pub/sub	Survive spikes and temporary failures

Cloud is an ecosystem, not a rack of rented servers.

A successful platform joins governance, identity, networking, compute, data, delivery and operations into one repeatable operating model.

The complete cloud ecosystem from organization to operations

Layer	Core question	Capabilities
Organization & governance	Who owns the platform and which rules apply?	Account hierarchy, standards, policy, compliance and risk
Identity & security	Who or what can access which resource?	Federation, MFA, roles, workload identity, secrets and threat detection
Network & edge	How do users and services communicate?	VPC/VNet, DNS, CDN, WAF, load balancing and private endpoints
Compute & integration	Where does code run and how is work connected?	VMs, containers, functions, APIs, queues and event buses
Data & AI	Where is truth stored and intelligence created?	Databases, object stores, warehouses, models and vector search
Operations & FinOps	How do we know it works and what it costs?	Telemetry, SLOs, incidents, budgets and unit economics

Platform engineering

Paved roads, reusable IaC, approved images, golden CI/CD and a service catalog give teams safe self-service.

Partner ecosystem

Marketplaces, SaaS integrations, partners, training, certification and support affect adoption.

Data gravity

Existing identity, data and skills often matter more than a small difference in compute price.

Evaluate the complete operating ecosystem—not merely the service catalog.

Learn categories first; translate product names second.

Category	AWS	Microsoft Azure	Google Cloud
Virtual machines	EC2	Virtual Machines	Compute Engine
Object storage	S3	Blob Storage	Cloud Storage
Kubernetes	EKS	AKS	GKE
Functions	Lambda	Azure Functions	Cloud Run functions
Managed containers	ECS/Fargate, App Runner	Container Apps	Cloud Run
Relational DB	RDS/Aurora	Azure SQL	Cloud SQL/AlloyDB
NoSQL	DynamoDB	Cosmos DB	Firestore/Bigtable
Warehouse	Redshift	Fabric/Synapse	BigQuery
Messaging	SQS/SNS/EventBridge	Service Bus/Event Grid	Pub/Sub/Eventarc
Secrets	Secrets Manager	Key Vault	Secret Manager
Monitoring	CloudWatch/X-Ray	Azure Monitor/App Insights	Cloud Monitoring/Trace
Foundation models	Amazon Bedrock	Microsoft Foundry	Vertex AI

Equivalent does not mean identical. Compare regions, quotas, identity, integration, operating effort, latency and total cost.

Choose the constraint, then the platform, then the service.

1. Constraints

Residency, compliance, latency, availability, contracts and team expertise.

2. Workload

Traffic shape, state, runtime, batch versus online, models and data gravity.

3. Operations

Prefer the highest-level managed service that meets the requirement safely.

Context signal	Natural starting point—not a rule
Large existing AWS estate	AWS
Microsoft 365, Entra, .NET and Azure data	Microsoft Azure
BigQuery, data/AI, Kubernetes and Google ecosystem	Google Cloud
Small team and uncertain traffic	Managed app/container platform + managed database
Regulated workload	The provider meeting residency, evidence, controls and support requirements

Multi-cloud duplicates identity, networking, observability and skills. Use it only for a concrete business or risk reason.

Architect from user journey to failure modes.

Users→DNS + CDN + WAF→Gateway / load balancer→Stateless app→DB + cache + object store

Synchronous

Keep user-facing requests short, bounded and observable.

Asynchronous

Queue durable work; make consumers idempotent and retry-safe.

Control plane

IaC, CI/CD, secrets, logs, metrics, traces, alerts and audit.

Draw trust boundaries, data flows, dependencies and recovery paths—not only product icons.

Design for failure, scale and cost together.

Reliability

Multi-zone deployment, health checks, timeouts, backups and tested recovery.

Performance

Measure latency, cache deliberately, batch calls and remove network hops.

Scale

Stateless compute, queues, partitioned work and backpressure.

Cost

Tag resources, budget, right-size, autoscale and delete idle environments.

Question	Artifact
How much data can we lose?	Recovery Point Objective (RPO)
How long can recovery take?	Recovery Time Objective (RTO)
What does healthy mean?	SLIs and SLOs
What if a dependency slows?	Timeout, circuit breaker, queue, graceful degradation
Who owns the bill?	Tags, budgets, dashboards and unit economics

Security is defense in depth, starting with identity.

Identity

Short-lived credentials, least privilege, MFA and workload identities.

Data

Classify, encrypt, restrict, rotate secrets and audit access.

Detection

Central logs, configuration policy, threat signals and incident playbooks.

For AI systems, retrieved documents and tool responses are untrusted input. Defend against prompt injection, excessive agency, leakage and unsafe calls.

Agent risk	Practical control
Destructive tool call	Allowlist, scoped identity, policy check and human approval
Sensitive data in prompts	Classification, redaction, access-aware retrieval and retention
Prompt injection from content	Treat content as data; validate tool arguments
Unexpected behavior	Evals, traces, versioned prompts, canary and rollback

IAM separates identity proof from permission.

Authentication proves who or what made the request. Authorization decides whether that principal may perform an action on a resource under the current conditions.

IAM request journey from human or workload to audit log

Concept	Meaning	Example
Identity	Human or workload known to the system	Alice; orders-api
Principal	Authenticated identity making this request	Alice's temporary role session
Group	Administrative collection of people	FinanceTeam
Role	Assumable set of permissions	BillingReadOnly
Workload identity	Non-human identity without embedded keys	Managed identity/service account
Policy	Rules over principal, action, resource and conditions	Allow read of one secret

Humans

Federate from the company identity provider, require MFA, assume temporary roles and use privileged-access workflows.

Workloads

Attach a managed identity, service account or role to the runtime. Never bake keys into code or images.

Audit

Record identity, session, requested action, target, decision, source and result in protected logs.

Request→Authenticate→Principal→Authorize→Resource→Audit

IAM evaluates principal, action, resource and conditions.

IAM policy evaluation and least privilege feedback loop

Explicit deny

Any applicable explicit deny overrides an allow.

Explicit allow

With no deny, at least one applicable allow must match.

Implicit deny

If no policy grants access, the default decision is deny.

Effective permission is an intersection

Organization guardrails, resource policies, identity policies, permission boundaries and session policies combine to determine the maximum permission. Conditions can restrict network, device, time, region, tags, authentication strength and resource attributes.

Bad pattern	Better design
Shared administrator account	Named identity + federation + temporary privileged role
Long-lived key in CI	OIDC/workload federation with short-lived token
Action:* Resource:*	Exact actions on tagged or named resources
Direct user permissions	Groups and roles aligned to job functions
Permanent production access	Just-in-time, approved and expiring access

Least privilege is a loop: start narrow → observe legitimate denials → add the exact permission → review usage → expire what is no longer needed.

Build the secure foundation before deploying workloads.

Secure landing zone and Zero Trust architecture

A landing zone establishes account structure, identity federation, networking, centralized logging, encryption, budgets and policy guardrails before application teams deploy.

Verify explicitly

Evaluate identity, device, workload, location and risk for every request.

Least privilege

Use short-lived, just-in-time and just-enough access.

Assume breach

Segment networks, protect logs, limit blast radius and rehearse containment.

Boundary	Purpose
Organization / tenant	Company-wide governance, billing and policy
Management group / organizational unit	Policy inheritance by business purpose
Account / subscription / project	Workload, billing and blast-radius isolation
Production / non-production / security / shared services	Separate duties and trust zones
Resource tags and folders	Ownership, environment, data class and cost attribution

Give each agent runtime and tool its own minimum identity. Never turn a model-facing identity into an all-powerful application identity.

Cloud is an API; the console is only one client.

Explore

Console and Cloud Shell help humans discover and diagnose.

Automate

CLI, SDK and REST let scripts and applications call services.

Reproduce

Terraform and native IaC make infrastructure reviewable.

Operate

CI/CD uses workload identity to deploy approved changes.

Check current cloud identity

# AWS
aws sts get-caller-identity

# Microsoft Azure
az account show

# Google Cloud
gcloud auth list
gcloud config get-value project

Python SDK: upload to Amazon S3

import boto3

s3 = boto3.client("s3")
s3.upload_file("report.pdf", "workshop-files", "reports/report.pdf")
url = s3.generate_presigned_url(
    "get_object",
    Params={"Bucket": "workshop-files", "Key": "reports/report.pdf"},
    ExpiresIn=900,
)
print(url)

Infrastructure as code

resource "aws_s3_bucket" "workshop" {
  bucket = "company-workshop-files"
  tags = { environment = "training", owner = "platform-team" }
}

resource "aws_s3_bucket_versioning" "workshop" {
  bucket = aws_s3_bucket.workshop.id
  versioning_configuration { status = "Enabled" }
}

MCP standardizes how an agent discovers and invokes tools. It does not replace authentication, authorization, policy or audit.

A model predicts; an agent pursues a goal through tools and state.

Model

Understands context and proposes the next action.

Instructions

Define role, boundary, output and escalation.

Tools

Read or change the world through APIs and enterprise systems.

Loop

Observe → reason → act → inspect → stop, continue or ask.

Framework-neutral agent loop

state = {"goal": user_request, "messages": []}

while not state.get("done"):
    decision = model.decide(state, tools=allowed_tools)
    if decision.requires_approval:
        decision = human.review(decision)
    result = tools.call(decision.tool, decision.arguments)
    state["messages"].append({"decision": decision, "result": result})
    state["done"] = policy.stop(state)

return model.answer(state)

Use the least autonomous option that solves the problem.

Decision tree for choosing an AI agent implementation option

Need	Start with	You operate
One request and response	Model API	Prompt, validation and call
Fixed predictable steps	Workflow/orchestrator	Logic, retries and integrations
Bounded tool-using assistant	Managed agent service	Instructions, tools, data and policy
Long-running/background agent	Managed agent runtime	Agent code, deployment and evaluation
Coordinated specialists	Code-first multi-agent framework + runtime	Topology, state, handoffs and failures
Existing enterprise suite	SaaS copilot/studio	Configuration, connectors and governance

The autonomy ladder

Answer→Retrieve→Recommend→Act with approval→Act within policy→Coordinate

Move upward only when the business value of autonomy exceeds the added security, evaluation and operational burden.

Runtime

Does it need streaming, long tasks, background work, durable state or isolation?

Interoperability

Are tools functions, REST APIs, MCP servers, enterprise connectors or other agents?

Control

Can identity propagate? Can traces and evals export? Can models and tools be versioned independently?

A production agent is a system, not a prompt.

Runtime

Isolation, streaming, long-running work, scale, retries and deployment.

Context

Session state, memory, retrieval, files and enterprise knowledge.

Control

Identity, policy, approvals, guardrails, traces, evaluations and releases.

The model may be replaceable. Durable engineering value lives in tools, data, policy, evaluation and operations.

RAG, tools, memory, MCP and A2A solve different problems.

Concept	Purpose	Example
RAG	Retrieve relevant knowledge before generation	Find the correct refund policy
Tool/function	Perform a bounded operation	Read an order or issue a refund
Memory	Carry useful state across steps or sessions	Remember language with consent
MCP	Standard agent-to-tool/context interface	Expose CRM search through an MCP server
A2A	Agent-to-agent collaboration	Delegate fraud review to a specialist agent

Protocols improve interoperability. Production still needs identity propagation, least privilege, schema validation, rate limits, audit and failure handling.

The safe path separates reasoning from execution.

Channel→Identity + gateway→Agent runtime→Policy / approval→Tool

Read path

Identity-aware retrieval returns only permitted information.

Write path

Validate arguments, enforce policy, approve and record.

Learning path

Traces feed evaluations, incident analysis and controlled releases.

All three clouds provide the pieces; they package them differently.

Layer	AWS	Microsoft	Google Cloud
Model platform	Amazon Bedrock	Microsoft Foundry	Vertex AI
Managed agent path	Bedrock Agents / AgentCore	Foundry Agent Service	Agent Builder / Agent Engine
Code-first	Framework-flexible; Strands common	Microsoft Agent Framework	Agent Development Kit
Enterprise tools	AgentCore Gateway, Lambda, APIs	Foundry tools, Functions, Logic Apps	ADK tools, Cloud Run, APIs
Identity	IAM + AgentCore Identity	Entra ID + managed identity	Cloud IAM + service accounts
Observability	CloudWatch + AgentCore	App Insights / Azure Monitor	Cloud Trace/Logging + Agent Engine

Feature maturity changes quickly. Verify region availability, quotas, preview status and pricing before committing.

AWS: Bedrock for models; AgentCore for operating agents.

Build

Use Bedrock models, Bedrock Agents or a code-first framework.

Run

AgentCore Runtime hosts isolated agent workloads and long-running interactions.

Govern

Gateway, Identity, Memory, Policy, Guardrails, Observability and evaluations.

App→API + identity→AgentCore Runtime→Bedrock model→Gateway → APIs

Natural fit for an existing AWS estate wanting model choice and modular, framework-flexible agent infrastructure.

Microsoft: Foundry agents connected to the enterprise identity plane.

Build

Microsoft Agent Framework orchestrates code-first workflows; Foundry also supports prompt agents.

Run

Foundry Agent Service manages agents; hosted agents run custom agent code where available.

Connect

Foundry tools, Toolbox/MCP, Functions and Logic Apps with Entra and App Insights.

Teams / app→Entra + API Management→Foundry Agent Service→Models + AI Search→Tools / MCP

Natural fit when Microsoft 365, Entra, Azure data services and enterprise governance are central.

Google Cloud: ADK to build, Agent Engine to operate.

Build

ADK is a code-first framework for agents, workflows, tools, sessions and multi-agent patterns.

Run

Vertex AI Agent Engine provides runtime, sessions, memory, evaluation and observability.

Connect

Vertex models and grounding, BigQuery, Search, Cloud Run tools, MCP and A2A.

App→IAM + gateway→Agent Engine→Gemini / Vertex AI→BigQuery / tools

Natural fit for Google data/AI ecosystems, code-first agent development and open interoperability.

Agents require a continuous build–evaluate–release–operate loop.

Production AI agent build evaluate release and operate lifecycle

Metric lane	Measure
Task quality	Correctness, relevance, groundedness and completion
Tool behavior	Correct tool, parameter accuracy, success, idempotency and side effects
Retrieval	Recall, ranking, permission filtering, citation and freshness
Safety	Policy violations, injection success, leakage and harmful action rate
Runtime	P50/P95 latency, timeout, retry and availability
Economics	Tokens, model/tool calls and cost per completed task
Business	Resolution, containment, satisfaction and human workload

Golden cases

Normal, ambiguous, denied, missing-data, timeout, duplicate, hostile-content and escalation scenarios.

Correlated traces

Link model, retrieval, tools, policy and approval with exact version metadata.

Progressive release

Offline gates, canary cohort, online comparison, human oversight and tested rollback.

Evaluate the complete trajectory and business outcome—not just whether the final answer sounds good.

Select the smallest platform that safely closes the loop.

Question	A strong answer contains
Where is authoritative data?	Systems, residency, permissions and freshness
What may the agent do?	Allowlisted tools, read/write boundary, approval and rollback
What must persist?	Session state, durable memory, consent and retention
How do we know it works?	Golden tasks, tool correctness, quality, safety, latency and cost
How will it run?	Runtime, identity, network, secrets, observability and recovery

Complete example: customer-support agent

Customer + SSO→Agent→Policy RAG→Order tool→Refund approval

Read safely

Retrieve policies and orders using caller permissions; cite source and freshness.

Act safely

Validate limits, approve sensitive actions and make retries idempotent.

Improve safely

Trace, evaluate representative cases, canary releases and keep rollback ready.

Final mental model: Cloud gives programmable building blocks. Architecture connects them around requirements. Security limits every identity and data path. Agents add a reasoning loop—but production quality comes from tools, policy, evaluation and operations.

Name the workload and constraints.
Choose the category before the product name.
Prefer managed services when their limits fit.
Draw user, data, trust and failure flows.
Automate infrastructure and deployment.
Measure reliability, security, quality and unit cost continuously.

Put everything together with the cloud.

Frontend, mobile, backend, databases and AI agents are deployed, connected, secured, scaled and observed through one cloud operating foundation.

Complete full-stack product architecture connecting web mobile backend data cloud and AI agents

Layer	Primary responsibility	Must not own
Web frontend	Rendering, interaction, client state and accessibility	Secrets or authoritative business rules
Mobile app	Navigation, lifecycle, offline cache and device APIs	Trusted authorization decisions
Edge and gateway	TLS, WAF, routing, throttling and token checks	Core business workflow
Backend services	Authorization, validation, transactions, APIs and events	Presentation-specific rendering
Relational database	Orders, payments, users, constraints and ACID changes	UI state or semantic search
NoSQL, cache and object storage	Fast lookups, sessions, documents, media and files	Replacing the system of record without design
Vector database	Embeddings, similarity search and RAG metadata	Authoritative permissions or transactions
AI agent runtime	Reasoning, orchestration, memory and governed tools	Unlimited database or infrastructure access
Cloud platform	IAM, network, secrets, deployment, resilience, telemetry and cost	Application requirements and domain meaning

One architecture, three cloud implementations

Architecture capability	AWS example	Microsoft Azure example	Google Cloud example
Web frontend and CDN	S3 + CloudFront	Static Web Apps/Storage + Front Door	Cloud Storage/Firebase Hosting + Cloud CDN
API entry	API Gateway + WAF	API Management + Front Door WAF	API Gateway/Apigee + Cloud Armor
Backend runtime	ECS/Fargate, Lambda or EKS	Container Apps, Functions or AKS	Cloud Run, functions or GKE
Transactional database	RDS/Aurora	Azure SQL Database/PostgreSQL	Cloud SQL/AlloyDB
Cache and messaging	ElastiCache + SQS/EventBridge	Azure Cache + Service Bus/Event Grid	Memorystore + Pub/Sub/Eventarc
Object storage	S3	Blob Storage	Cloud Storage
AI model and agent	Bedrock + AgentCore	Microsoft Foundry + Agent Service	Vertex AI + Agent Engine
Identity and secrets	IAM + Secrets Manager	Entra/Managed Identity + Key Vault	Cloud IAM + Secret Manager
Observability	CloudWatch/X-Ray	Azure Monitor/Application Insights	Cloud Monitoring/Logging/Trace

These are concrete implementations of the same logical architecture. Select services by constraints, workload shape and operating maturity—not by copying every row blindly.

The architecture in one sentence

Web / mobile presents→Gateway protects→Backend decides→Databases remember→Agent reasons through tools→Cloud operates

The backend remains the policy and transaction boundary. The frontend requests; the database persists; the agent invokes bounded tools; cloud IAM decides whether every call is permitted.

One user action across the complete stack

End-to-end journey of a customer asking where an order is

Frontend or mobile: captures “Where is my order?”, carries the access token and displays loading state.
Cloud edge: DNS/CDN/WAF receives the request; the gateway validates, throttles and routes it.
Backend: authenticates the principal, authorizes order access and loads transactional data.
Databases: relational storage remains authoritative; a cache may accelerate safe repeat reads.
AI agent: retrieves permitted policy context from vector search and calls a narrowly scoped shipment tool.
Backend response: validates tool output, applies policy, redacts sensitive data and returns a stable contract.
UI: updates state and renders success, empty, error or retry behavior.
Operations: correlated logs, metrics, traces, audits and costs describe the journey.

Identity flows

User identity reaches the backend; services and tools use separate workload identities.

Data has owners

Transactional truth, cached copies, files, vector knowledge and agent memory have different roles.

Failures are normal

Timeouts, bounded retries, idempotency, queues and graceful UI states contain failure.

Everything is observable

One correlation ID connects browser, gateway, backend, database, agent and tool traces.

The API contract connecting every layer

GET /api/orders/ORD-1042/status
Authorization: Bearer <user-token>
X-Correlation-ID: 7f4a...

{
  "orderId": "ORD-1042",
  "status": "IN_TRANSIT",
  "estimatedDelivery": "2026-08-28",
  "explanation": "Your parcel has left the Bengaluru hub.",
  "source": "shipment-tracking",
  "asOf": "2026-08-26T14:40:00Z"
}

Never connect the frontend or model directly to production databases. Route access through authenticated, authorized and observable backend capabilities.

Final six-question architecture review

Who is the user or workload principal?
Which backend capability owns this action?
Which data store is authoritative, and which stores are derived?
What may the agent read or change—and where is approval required?
What happens when a dependency is slow, unavailable or called twice?
How will telemetry, audits and cost prove what happened?