Hands-on Labs

Guided production scenarios with step-by-step environments.

Simulate Pay-as-you-go vs Buying Servers

Cloud computing is the on-demand delivery of compute, storage, networking and software over the internet, billed like a utility instead of bought like hardware.

4steps 25 minbeginner

Discover Regions and Availability Zones

A region is an isolated geographic cluster of data centers; availability zones are isolated data centers within it. Resilient designs span AZs; compliant designs care about regions.

5steps 25 minbeginner

Sketch and Validate a Cloud Account Structure

Accounts, organizations, folders and projects create the containment boundaries that make IAM policies, budgets and audits comprehensible. Structure the boundaries before you need them.

3steps 25 minintermediate

Inspect an Instance Fleet Read-Only

EC2, containers (ECS/EKS/Fargate) and Lambda are the compute tiers of AWS. Choosing between them is choosing between control, portability and ops burden.

4steps 30 minbeginner

Prove S3 Consistency and Lifecycle Behavior

S3 for objects, EBS for instance disks, EFS/FSx for shared files, Glacier for archive. Picking the right store is about granularity, latency, durability and price.

5steps 30 minintermediate

Build a Least-Privilege Role and Prove It

IAM is how AWS decides who can do what. Users, groups, roles, policies, and trust relationships — get these five wrong and everything from security to debugging gets worse.

6steps 30 minintermediate

Map a VPC Topology (Read-Only or Terraform Plan)

A VPC is a private network: CIDR blocks, subnets in AZs, route tables, gateways and security layers decide how traffic gets anywhere — and what gets to reach your resources at all.

5steps 30 minintermediate

Provision a DynamoDB Table Read-Only and Local

RDS for relational, DynamoDB for key-value, Aurora for MySQL/Postgres at scale. Managed databases trade some control for patch-free ops, backups and HA wiring.

4steps 25 minbeginner

Deploy a Hello-World Lambda End-to-End

API Gateway + Lambda + DynamoDB + S3 + SQS is the canonical AWS serverless stack. Events in, code runs, state is managed — you pay per use and scale with zero servers.

5steps 30 minintermediate

Scope an RBAC Role with the Azure CLI

Management groups, subscriptions, resource groups and Azure RBAC define how Azure organizes access and billing. Entra ID houses identities; roles grant scoped permissions; Azure Policy enforces guardrails.

5steps 25 minbeginner

Autoscale a VMSS with the CLI

Azure VMs are IaaS machines with SKU families; VMSS is autoscaling VMs in zones. Know VM sizes, images, disks, and how VMSS + Autoscale keep the right number of machines.

5steps 30 minintermediate

Build a VNet with NSGs and Peering

VNets, subnets, NSGs, peering, Load Balancer and Application Gateway form Azure networking. VPN/ExpressRoute connect on-prem; Private Endpoint keeps traffic off the internet.

5steps 35 minintermediate

Deploy an App and Swapping Slots

App Service runs managed web apps with scaling, TLS and staging slots; Functions runs event-driven code with consumption pricing. Together they cover most PaaS/Serverless needs.

5steps 35 minadvanced

Walk the Project Hierarchy and a Budget

GCP is organized as an org → folder → project tree. IAM binds roles to members at any level, billing rolls up per project, and folders/org policies set guardrails.

4steps 25 minbeginner

Create a MIG Behind a Health Check (or Plan)

Compute Engine is GCP's IaaS: machine families, images, disks and instance groups with autoscaling. Managed instance groups autoheal and spread across zones; autoscaling scales on utilization.

5steps 35 minintermediate

Build a VPC with Instance Templates and a Firewall (Plan)

GCP VPCs are global: one network with regional subnets, global routing, firewall rules, Cloud NAT and VPC peering. Interconnect/Cloud VPN link on-prem; private service connect keeps PaaS private.

5steps 30 minintermediate

Deploy a Container to Cloud Run

Cloud Run runs containers on-demand with per-request billing and VPC support; Cloud Functions is FaaS for events. Together they deliver serverless on GCP with autoscaling to zero when idle.

5steps 30 minintermediate

Plan a VPC CIDR and Subnet Layout

A Virtual Private Cloud is your isolated slice of the cloud's network. CIDR, subnets, gateways and routing define what your resources can reach and who can reach them.

4steps 25 minbeginner

Design a CIDR Tree for a Multi-Environment Estate

CIDR math decides how many addresses a subnet holds and whether networks overlap. A good plan leaves headroom, maps tiers and zones predictably, and never collides with on-prem or peers.

4steps 30 minintermediate

Model SG and NACL Evaluation as a Decision Table

Security groups filter at the resource; NACLs filter at the subnet. Stateful vs stateless, allow vs deny, evaluation order — knowing these decides whether traffic flows or mysteriously times out.

4steps 25 minintermediate

Peer Two VPCs and Verify Routes

Peering joins two VPCs; Transit Gateway or a hub VNet joins many. Direct peering is fast and cheap but non-transitive; hubs add inspection and centralization at the cost of design complexity.

4steps 30 minintermediate

Compare NAT vs Endpoint Egress Cost

Egress is where private workloads touch the internet. Cloud NAT (GCP), NAT gateway (AWS), and Azure NAT/outbound rules provide managed outbound connectivity with stable IPs and cost control.

4steps 25 minintermediate

Using a Private Hosted Zone Locally

Cloud DNS is the directory of your network: public domains, private zones for VPC-internal names, health-based routing, and CDN/LB integration. Getting resolution wrong is a silent application failure.

4steps 25 minintermediate

Model an Identity Matrix Locally

IAM starts with principals: users, groups, roles and service identities. Who or what can act in your cloud, and how they prove who they are, is the identity layer everything else hangs on.

4steps 25 minbeginner

Write and Simulate a Policy

Roles are identities you assume; policies are the rules that say what roles can do. Trust relationships, policy structure, effective permissions and the deny rule are the mechanics of every authorization decision.

4steps 30 minintermediate

Scope a Policy Down with Conditions

Least privilege grants the minimum permissions a workload needs. It's implemented with resource scoping, condition keys, short-lived credentials, and aggressive use of deny-defaults — then enforced with monitoring.

4steps 30 minadvanced

Model Workload Identity for CI

Federation maps an external identity provider to cloud roles: SAML for corps, OIDC/OAuth for CI and apps. SSO gives humans one login; workload identity gives machines short-lived tokens. Together they abolish long-lived keys.

3steps 30 minintermediate

Lock Down a Machine Identity

Machines need identities too: service accounts, managed identities and instance profiles. The trick is giving each workload its own least-privilege machine identity, rotated and short-lived.

4steps 25 minintermediate

Provision Your First Cloud VM from the CLI

A VM is a virtual computer that runs an operating system on shared physical hosts. Cloud providers expose them as instances (EC2), VMs (Azure) and Compute Engine (GCP) with sizes, images and networking.

4steps 25 minbeginner

Match Instances to Workloads by Family

Instance types are grouped into families tuned for CPU, memory, storage or GPU. Choosing the right family and size directly controls cost, latency and throughput of every workload.

3steps 20 minintermediate

Design and Simulate an Autoscaling Policy

Autoscaling grows or shrinks instance fleets to match demand: target tracking keeps average CPU sensible; scheduled scaling covers known peaks; and the scaling process itself fails in characteristic ways you must design around.

3steps 30 minintermediate

Build an Interruption-Tolerant Spot Worker

Spot (AWS), and preemptible (GCP) compute is spare capacity sold at a steep discount — but the provider may reclaim it. Idempotent, resumable workloads harvest real savings; fragile ones get evicted.

3steps 35 minadvanced

Run a Right-Sizing Analysis on a Toy Fleet

Right-sizing matches running resources to actual demand using utilization data, and recovering idle resources is usually the fastest, safest cost win in any cloud estate.

3steps 30 minintermediate

Land, Version and Ingest Files into Object Storage

Object storage (S3, Blob Storage, GCS) stores files as objects in flat buckets with rich metadata and HTTP access. It's the backbone of data lakes, static hosting and backups.

4steps 25 minbeginner

Create, Attach, Snapshot and Resize a Block Volume

Block storage (EBS, managed disks, Persistent Disk) is a virtual hard drive attached to a VM over the network. It offers raw devices, snapshots, IOPS tiers and the durability semantics a filesystem expects.

4steps 30 minintermediate

Write and Simulate a Storage Lifecycle Policy

Storage tiers trade price for access latency. Lifecycle policies age data automatically from hot to archive and delete it when obsolete — turning 'cleanup' from a manual chore into a declarative rule.

4steps 25 minintermediate

Harden an Object Store and Share via Presigned URL

Storage security is layered: identity (who can call the API), encryption (data at rest and in transit), and access boundaries (public access blocks, policies, presigned URLs). Most storage breaches are accidental public exposure.

4steps 30 minintermediate

Design a Backup Policy and Prove It with a Restore Drill

Backups protect against deletion, corruption and ransomware; archives keep long-lived copies cheap. The discipline is RPO/RTO-aware: what you need back, how much you can lose, and how fast.

4steps 25 minintermediate

Provision, Tune and Query a Managed Database

Managed relational databases (RDS, Azure SQL, Cloud SQL) run PostgreSQL/MySQL/SQL Server for you: automated backups, patches, HA and storage scaling, so the team owns schema and queries — not the operating system.

4steps 30 minbeginner

Design and Stress a NoSQL Access Pattern

NoSQL services (DynamoDB, Cosmos DB, Firestore/Bigtable) trade joins and ACID breadth for horizontal scale and flexible schemas. Choosing the right NoSQL store means matching access patterns, not just picking a name.

4steps 30 minintermediate

Plan and Simulate a Database Failover

Database HA means automatic failover with bounded downtime: synchronous standby, health-based promotion, application reconnect, and drained queueing. The trick is testing the failover, not assuming it.

4steps 25 minintermediate

Automate Backup and Practice a PITR Restore

Database backups combine automated snapshots, transaction-log PITR and physical/logical exports. Knowing exactly what to restore — a table, a database, a point-in-time — determines your RPO and recovery speed.

4steps 30 minintermediate

Stand Up a Balancer, Register Targets, Watch Health Checks

A load balancer is the front door that spreads incoming traffic across a fleet of instances, runs health checks, handles failures, and gives you one stable DNS name to point clients at.

4steps 30 minbeginner

Pick L4 vs L7 for Three Workloads

Layer 4 balancers forward packets/TCP by IP+port with minimal intelligence; layer 7 balancers read HTTP(S) content (paths, headers, cookies) to route precisely. Knowing which one serves which protocol shape is the core decision.

3steps 15 minintermediate

Design and Stress a Health-Check Profile

Target groups define the fleet a balancer routes to; health checks are its eyes on that fleet. Correct health-check design (path, thresholds, interval) prevents draining live traffic to a half-dead box.

4steps 25 minintermediate

Toggle Stickiness and Measure the Distribution Skew

Sticky sessions (session affinity) pin a client to a backend so its session state survives — but sticky load distribution can under-utilize the fleet. Cookie-based (L7) and source-IP (L4) affinity differ in what they preserve and their failure modes.

4steps 25 minintermediate

Traverse and Debug the DNS Chain

DNS maps human names (app.example.com) to IPs through a hierarchy of resolvers. Every cloud service touchpoint — LBs, databases, endpoints — is ultimately an A/AAAA/CNAME record.

4steps 20 minbeginner

Model Routing Policies and Their Failover Behavior

Beyond simple lookups, DNS answers can be chosen by latency, geography, weight or failover state. These policies turn the resolver's question into an intelligent routing decision — the cheapest global load balancing you can buy.

3steps 25 minintermediate

Build and Qualify a DNS Failover Design

DNS is stateless and can't know a server is down — so managed DNS adds health checks that probe endpoints and exclude unhealthy records from answers, powering region-level failover.

3steps 25 minadvanced

Request, Validate and Bind a Domain (DNS-01)

Pointing a custom domain at cloud services means wiring DNS records (CNAME/alias) and provisioning TLS certificates verified via DNS or HTTP. ACM/Key Vault/Certificate Manager centralize issuance, renewal and rotation.

4steps 25 minintermediate

Wire a Static Site Through a CDN Edge

A CDN caches copies of your content on edge servers near users, so most requests never touch your origin. CloudFront, Azure CDN/Front Door and Cloud CDN all model the same split: edge cache + origin + distribution.

4steps 45 minbeginner

Measure Cache-Control Without an Exploding Cache

TTLs decide how long stale-but-accepted content lives; invalidation is the emergency brake that forces fresh checks. Versioned assets make long TTLs safe; unversioned paths make invalidation a daily ritual.

3steps 30 minbeginner

Normalize Caching with an Edge Function

Edge functions move small bits of logic — rewriting, signing, A/B gating, geolocation — next to users instead of round-tripping to the origin. CloudFront Functions, Lambda@Edge, Cloudflare Workers and Google edge runtimes trade limits for sub-ms subnets.

4steps 45 minintermediate

Trigger Your First Function from an Object Write

Function-as-a-Service runs single-purpose handlers on ephemeral compute: AWS Lambda, Azure Functions, Google Cloud Functions/Cloud Run. You write code, the platform owns servers, scaling, and runtime patches.

4steps 40 minbeginner

Measure Cold vs Warm in Your Own Function

A cold start is the latency spike when no execution environment is warm. Init work, runtime size, memory and provisioned concurrency all shift the p95; most of the fix is architecture, not a panel.

4steps 30 minintermediate

Fan-Out with a Bus and Prove Idempotency

EDA decouples producers from consumers via a bus: SNS/EventBridge, Event Grid, Pub/Sub. Producers publish facts; consumers subscribe. Delivery is at-least-once, so idempotency and retry/poison handling are contracts, not features.

3steps 45 minintermediate

Orchestrate a Resumable Job in a State Machine

Functions are stateless; durable workflows (Step Functions, Logic Apps, Workflows) bring state as orchestrated sequences with retries, human approval, and exact progress tracking. Long-running, resumable, auditable serverless — built from stateless bricks.

3steps 40 minadvanced

Build, Multi-Stage, and Run an Image

A container packages an app with its runtime into a portable, isolated unit sharing the host kernel. Images are layers; containers are running instances with cgroups and namespaces keeping them apart.

4steps 40 minbeginner

Deploy a Managed Container Service

ECS, Azure Container Apps, and Cloud Run run containers without you running the control plane. They trade full workload autonomy for deployment, scaling, and patching simplicity.

3steps 40 minintermediate

Push, Pin, and Scan an Image

A registry stores, verifies and serves images: ECR, ACR, Artifact Registry, GHCR. Governance lives here — immutability, signing, scanning, replication, and fine-grained pull permissions.

4steps 40 minintermediate

Harden a Container and Prove the Drop

Defense in depth across image → runtime → cluster: least-privilege images, scanning + signing gating, seccomp/AppArmor/SELinux profiles, read-only roots, non-root users, and runtime threat detection.

4steps 45 minadvanced

Spin a Cluster and Watch Reconcile

Kubernetes is a control plane + worker nodes: the API server is the source of truth, controllers reconcile desired vs current state, and the scheduler places Pods. Managed offers (EKS, AKS, GKE) run this for you.

4steps 40 minbeginner

Rollout, Rollback, and Probe Gating

Pods are atomic groups of containers with a shared network namespace; Deployments manage rollout/rollback via ReplicaSets; StatefulSets, DaemonSets, Jobs, CronJobs cover stateful, node-scoped and ephemeral work.

4steps 40 minintermediate

Wire a Service and Resolve It by DNS

Pods are ephemeral, so Services supply stable DNS + virtual IP: ClusterIP (indirect), NodePort (host-port), LoadBalancer (cloud LB), ExternalName. kube-proxy (iptables/ipvs/eBPF) wires ClusterIP; CoreDNS resolves names.

4steps 30 minbeginner

Scale Pods with the HPA on Real CPU

Workloads scale via the pod autoscaler (CPU/memory/custom metrics); clusters scale capacity via node autoscalers adding/removing pooled instances. Together they react to load predictably — if configured and budgeted.

4steps 35 minintermediate

Route Hosts Through an Ingress Controller

Ingress is a Layer-7 API: hostname + path → backend Service, plus TLS and rewrites — enforced by an ingress controller (nginx, ingress-nginx, AWS LB, GKE Ingress) that installs the actual router.

4steps 40 minintermediate

Provision a Tiny Stack Idempotently

IaC treats infrastructure as reviewable, repeatable, reversible artifacts: code in git, applied by pipelines, diffed against reality, and audited. The core win is reproducibility and blast-radius control, not just 'scripts for cloud'.

4steps 40 minbeginner

One Template, Two Environments

Templates (HCL, CloudFormation, bicep, Pulumi code) reduce an environment to a parameterized blueprint: variables, locals, module reuse, conditionals, and loops keep one tree standing in for N environments.

4steps 40 minintermediate

Share and Lock State Across Two Runs

IaC state is the tool's memory and the source of a plan's 'reality'. Remote backends with locking, backup, and audit are non-negotiable in teams; misuse of state is the top reason infra tools bite.

4steps 40 minadvanced

Sync a Cluster from Git and Watch Self-Heal

GitOps makes git the single source of desired state: a reconciler (ArgoCD, Flux) continuously syncs the cluster/cloud to what the repo declares, with automatic drift repair and auditable history.

4steps 45 minadvanced

Run the Core Loop on a Real Provider

Terraform is a declarative IaC engine: HCL describes resources, the provider talks to the cloud, and plan/apply turn intent into reality. Learn the hair gets — init, plan, apply, destroy — plus core constructs: resources, data sources, variables, outputs.

4steps 40 minbeginner

Watch Force-New vs In-Place on a Resource

Providers are SDKs from cloud APIs into Terraform's graph; resources map API objects. Understanding provider schema, resource behaviors (in-place vs force-new), and data sources is the difference between readable plans and 'why did it recreate?' mysteries.

4steps 35 minintermediate

Remote State with Lock for a Team

State is Terraform's memory; remote backends make it accurate and team-safe. Locking prevents concurrent applies; versioning enables rollback; workspaces/folders isolate environments. Treat state as a secret and a backup.

4steps 40 minadvanced

Publish and Version a Module Locally

Modules package reusable infrastructure: typed input variables, outputs as contracts, and local resources composed into a standalone unit. Registry, private, and in-repo modules are the difference between one team's working answer and an org's repeatable platform.

4steps 35 minadvanced

Shred-Proof Recovery: Restore + Import Drill

Production Terraform is a relationship: a mono-repo of stack dirs, per-env backends, plan-gated applies, drift scans, terraform-docs/READMEs, and releases. Learn the daily rhythm — plan, review, apply, verify, and the ops side (drift, state surgery, catastrophic recovery).

4steps 45 minadvanced

Stand Up the Detection Baseline

Cloud security starts with a clear split of responsibility, identity-first access, encryption, and logging. Core services — IAM, Key Management, Config audit, GuardDuty/Security — form a baseline every environment needs.

4steps 40 minbeginner

Prove Envelope Encryption End-to-End

Encryption protects data in two states: at rest (storage encryption via KMS) and in transit (TLS between hops). Key management, algorithm choice, and rotation policies decide how much the encryption actually buys you.

4steps 40 minintermediate

Rotate a Secret Without the App Blinking

Secrets — API keys, DB passwords, tokens — need a live store with rotation and audit, not environment files. Secrets Manager, Key Vault, and Secret Manager share the pattern: versioned values, rotation schedules, granular access, and client caching with graceful re-read.

4steps 40 minintermediate

Scan Compliance and Reconcile Drift

Compliance frameworks (SOC2, ISO 27001, HIPAA, FedRAMP) are contracts; cloud governance is the machinery that proves you keep them — inventory, policies, drift detection, and evidence automation.

4steps 40 minintermediate

Tabletop the First 15 Minutes

IR is a game plan for being attacked, not a wish: detection → containment → eradication → recovery → lessons. Cloud IR leans on native speed: isolate resources, snapshot evidence, revoke keys, restore from immutable snapshots, and quarantine the attack path.

4steps 45 minadvanced

Write, Fire, and Mute an Alert

Metrics are the fastest path to 'it's broken' — counters, gauges, histograms plus rulers that turn thresholds into pages. Alert design is the craft: fire on symptom burn-rates, not on might-y-have-issues noise.

4steps 30 minintermediate

Emit, Collect, and Query Structured Logs

Logs are the event record; structured logs (JSON) are searchable, alertable, and correlate with traces. The craft: request/context details, small logging budgets, sampling, and architecture from app → collector → store → SIEM.

3steps 30 minintermediate

Trace One Request Across Two Handlers

Distributed tracing follows one request across services using propagated trace-ids and spans. APM layers on metrics/dashboards: service maps, error rates, and latency breakdowns that turn 'the checkout is slow' into 'the payments call is slow'.

3steps 35 minintermediate

Run a Synthetic Incident with a Runbook

The last mile: alert delivery (escalation, dedupe, routing), on-call rotations (the human side: coverage, handoffs, availability), and runbooks (the step-by-step that turns a page into a fix). Blameless postmortems close the loop.

3steps 30 minintermediate

Deliver an AZ-Failover Drill for a Web Tier

Inside one region, spread compute and data across ≥2 AZs (each a real independent facility: power, network, HVACC). LB + stateless fleet + AZ-redundant data is the canonical pattern; multi-AZ DBs and instance seeding/ASG round out the design.

4steps 35 minintermediate

Build a Health-Checked DNS Failover Pair

DNS is the tip of failover: health-checked failover policies point traffic at healthy endpoints, while low TTLs keep the flip fast. Combine LB-level health checks with DNS-level secondary routing for layer-agnostic resilience.

4steps 30 minintermediate

Failover a Localish Postgres Pair With Quorum

The database is the HA crown jewel: sync replication with auto-failover (managed multi-AZ), read replicas for load, and quorum-based avoids of split-brain. Understand RPO/RTO semantics of each pattern and test failover regularly.

4steps 45 minadvanced

Design + Drill a 3-AZ Blueprint

Putting the pieces together: reference architectures for 2- and 3-AZ (plus paired region) service tiers, with availability math, blast-radius planning, 'AZ-drain' drills, and the budget vs. nines tradeoff. Design is the practice of picking failures.

3steps 45 minadvanced

Write and Time a Basic Recovery Runbook

Disaster recovery is the plan for when your whole region goes away: RPO (how much data you can afford to lose) and RTO (how fast you must be back). Backups, replication, and a rehearsed recovery plan turn catastrophe into an operational event.

3steps 30 minbeginner

Walk a Warm-Standby Cutover

The recovery ladder: backup & restore (slowest), pilot light (skeleton), warm standby (scaled-down), multi-site hot standby, active-active (near-zero downtime). Each step trades cost for speed; pick per workload RTO.

4steps 40 minintermediate

Promote a Cross-Region Replica (Simulated)

Real DR architectures in the wild: cross-region DB replication (Aurora Global, Azure SQL geo, Spanner), RDS promote-and-cutover, frontend + CDN/DNS rerouting, data-plane state (uploads, queues) migration, and the 'do we really go active-active?' decision with conflict resolution.

4steps 40 minadvanced

Tabletop + One-Service DR Drill

The plan is only as real as the drill: tabletop tests, full fallover drills, restore tests, chaos-game days. Frequency, scope, measure-against-RTO, blameless after-action — this is where DR becomes muscle memory.

3steps 30 minintermediate

Route Users to Their Nearest 'Region'

Sending each user to the best region: latency-based DNS, global load balancers, CDN ingress, and Anycast (for edge). Understand routing policies (geoproximity, latency, weighted), TTL, and traffic steering by context (health, cost, compliance).

4steps 30 minintermediate

Stand Up and Cut Over a Warm Standby

The disciplined cross-region DR model: one region serves (active), the other stands ready (passive — warm or pilot). A lean always-on skeleton, replication live, promote + cutover rehearsed. The pragmatic RTO sweet-spot between backup-only and active-active.

3steps 40 minintermediate

Sync Two 'Regions' and Reconcile

The data plumbing of multi-region: DB replication models (log-shipping, snapshot, synchronous), object replication (CRR), cache invalidation across regions, queue replay, and idempotent reconciliation. Every pattern trades latency, cost, and consistency; the measure is lag + conflicts + RPO.

3steps 35 minadvanced

Tag a Stack and Stand a Budget

How cloud bills actually work: pay-per-use, usage tiers, type-specific pricing (compute-seconds, GB-months, egress), and the billing consoles that make it legible. The three pillars of the practice: attribution (tags), forecasting (budgets), and levers (this module covers all).

3steps 30 minbeginner

Size a Commitment From a Fake Baseline

The biggest lever on steady workloads: Reserved Instances, Savings Plans, Committed Use Discounts — pay less for agreeing to steady use. Know the models, size commitments on baselines (not spikes), manage coverage/renewal, and handle migration risk with convertible/elastic options.

3steps 30 minintermediate

Run a Mini FinOps Review

Cost as a shared culture: FinOps principles (visibility, ownership, accountability), budget hierarchies, showback/chargeback, tagging governance, and the monthly review that turns the bill into decisions. Guardrails catch abuse; plans fund the roadmap.

3steps 30 minintermediate

Adapt a Reference Architecture to a Workload

The battle-tested shapes to start from: 3-tier web, event-driven, data/analytics, microservices, serverless. Understand the canonical diagram, when it fits, and its classic failure modes — then adapt, don't reinvent.

3steps 40 minintermediate

Score a Tradeoff and Write its ADR

Every architecture is a set of tradeoffs. Learn to argue them explicitly: consistency vs availability, cost vs resilience, latency vs consistency, control vs managed, time-to-ship vs rigor. Constraints (budget, team, compliance, SLA) turn 'ideal' into 'feasible with a KPI.'

3steps 30 minintermediate

Model a Data Tier by Access Pattern

Data shapes the architecture: choose the right store (relational vs NoSQL vs analytics) by access patterns, design read/query scaling with materialized views + caching, and keep the data tier honest with backups, replication, and lifecycle. Data topology = architecture majority.

3steps 35 minadvanced

Stand an Outbox + Idempotent Consumer

Decoupling via events: pub/sub topologies, event sourcing and outbox patterns, exactly-once-vs-idempotent delivery, dead-lettering, and the 'what do I do while the event does its thing' async mental model. Events make systems scale + stay consistent — with discipline.

3steps 40 minadvanced