How to use this book

Who this book is for

This book is a textbook for engineers and operators who design, build, and run infrastructure that ships AI and web services to the world, protects them from failures and attacks, and enables people inside and outside an organization to connect safely. Its primary readers are full-stack and backend engineers who have written application code using coding agents or modern web frameworks, infrastructure and security practitioners responsible for adopting and rolling out internal AI tools and developer networks (ZTNA and VPNs), and DevOps and platform engineers who want to manage multiple environments consistently through Infrastructure as Code (IaC). It assumes you understand application development at roughly the Blue Belt (AI App Builder) or Red Belt (LLM API Developer) level and have a working familiarity with Linux, networking, and cloud deployment fundamentals. With that background, you can use this single volume to master the entire syllabus of the AI & Cloud Infrastructure Specialty (AIN) course from start to finish.

Infrastructure in the AI era resembles traditional web infrastructure on the surface, yet differs at several decisive points. First, coding agents allow teams to ship new application features multiple times a day, but if a single environment variable leaks into a client bundle or a single database Row Level Security (RLS) policy is omitted, every customer record can be exposed in a matter of seconds. Second, because LLM streaming responses and multi-step tool calls hold connections open much longer than classic web requests, serverless function execution time limits, regional placement, and database connection pooling modes determine whether a service stays up or collapses under load. Third, settings configured by clicking around in a cloud console quickly turn into unrepeatable shadow infrastructure, making declarative code such as Terraform and keyless OIDC deployment pipelines essential baseline skills. Fourth, the way organizations protect internal wikis, model gateways, and development databases is rapidly shifting away from traditional perimeter VPNs toward outbound-only tunnels, mesh VPNs, and Zero Trust Network Access (ZTNA).

This book does not cover physical hardware repair for on-premises servers or physical-layer construction such as laying fiber-optic cables in data centers. Instead, it thoroughly examines the five core layers that modern AI and web service teams confront every day—managed application and data platforms (Vercel and Supabase), Infrastructure as Code (Terraform and CI/CD), global DNS and edge networks (Route 53 and Cloudflare), internal network security and remote access (adopting and deploying ZTNA and VPNs), and infrastructure reliability, secrets management, and incident response—walking through both the underlying architectural principles and concrete workplace decisions.

How this book is organized

The main text covers the five domains of the exam blueprint in order, dedicating one chapter to each domain.

• Chapter 1, Managed Application and Data Platforms (Foundations: Vercel & Supabase) covers the internal mechanics and security boundaries of the managed platforms used to launch products quickly. You will learn environment separation between Preview and Production, the boundary between NEXT_PUBLIC_ variables and server-only secrets, Deployment Protection and automation bypasses for webhooks and E2E tests, function region placement (icn1) and physical distance to the database, Fluid Compute and streaming, Supavisor transaction mode (port 6543) versus session mode (port 5432), USING and WITH CHECK clauses in Row Level Security (RLS), separation between the anon key and the service_role key, Auth redirect allowlists, and signed URLs for private Storage buckets.
• Chapter 2, Infrastructure as Code and Deployment Automation (Intermediate: Terraform & IaC) moves beyond manual console clicks and teaches how to control infrastructure through declarative code. It covers the role of the state file (terraform.tfstate), S3 remote backends and state locking, modularization and per-environment state isolation, reading terraform plan symbols (in-place updates ~ versus replacements -/+), prevent_destroy and moved/import blocks, preventing plaintext secret exposure inside state files, detecting and remediating configuration drift, and building keyless deployment pipelines using GitHub Actions OIDC (AssumeRoleWithWebIdentity).
• Chapter 3, Global DNS and Edge Networks (Advanced: Route 53 & Cloudflare) designs every gateway a user request crosses before reaching your server. You will study Route 53 A, AAAA, CNAME, and Alias records (and how Alias resolves the Zone Apex constraint), routing policies (Simple, Weighted, Latency, and Failover) paired with health checks, lowering TTLs in advance for zero-downtime migrations, DNSSEC and CAA records, Cloudflare proxied (orange cloud) versus DNS-only (grey cloud) modes, SSL/TLS modes (the dangers of Flexible versus Full (Strict) with Origin CA and mTLS), WAF and rate limiting, preventing cache poisoning on personalized APIs and SSE streams, and observing and falling back across model traffic using Workers, Queues, and AI Gateway.
• Chapter 4, Internal Network Security and Remote Access (In Practice: Adopting and Deploying ZTNA & VPNs) tackles the practical engineering required to connect corporate internal assets and remote work environments safely. You will learn the lateral movement risks of traditional perimeter VPNs and Zero Trust architecture (NIST SP 800-207), outbound-only connectors that close all inbound firewall ports (cloudflared Cloudflare Tunnel), WireGuard-based mesh VPNs (Tailscale) including subnet routers, DERP relays, and ACLs, split tunneling to resolve home router subnet collisions (192.168.x.x) and split-horizon DNS to keep internal domain names hidden from public resolvers, IdP integration (SSO, MFA, and automatic offboarding via SCIM) combined with device posture checks, and how to distribute enterprise TLS inspection root CA certificates to developer endpoints and CLI tools (NODE_EXTRA_CA_CERTS, SSL_CERT_FILE) without breaking developer workflows.
• Chapter 5, Infrastructure Reliability, Secrets Management, and Incident Response teaches the operational discipline required to keep a live service running without interruption. You will learn zero-downtime secret rotation with dual-key acceptance and emergency revocation, designing RPO and RTO around snapshot backups and Point-in-Time Recovery (PITR) with regular restore drills, zero-downtime database schema migrations using the Expand-Contract (Parallel Change) pattern while old and new application code coexist, distributed tracing with OpenTelemetry and scrubbing sensitive fields from logs, anomaly alerts and hard spending caps for cloud and AI usage, and incident isolation, rollback runbooks, and blameless postmortems.

Every chapter follows the exact same ten-section structure. Learning objectives and Introduction frame the problem; Key concepts and Going deeper unpack the mechanisms and advanced trade-offs; and two Workplace scenarios trace concrete engineering decisions inside realistic organizations. These are followed by Common mistakes that trip up candidates on the exam and in production, Summary at a glance for quick review the day before the test, Check the official docs for primary-source verification, Self-check questions (with full answers and explanations in Appendix B), and two Hands-on tasks where you design configurations yourself.

The exam at a glance

The AI & Cloud Infrastructure Specialty (AIN) exam consists of 35 questions to be answered in 60 minutes. Questions that test foundational principles or the correctness of a single configuration setting carry 2 points, while analytical questions that require weighing multiple constraints simultaneously (availability, security, latency, cost, and deployment order) to choose the optimal architecture carry 3 points. Earned points are converted to a raw score out of 100; a score of 75 or higher is required to pass, and your score report displays a grade from 1 to 9 alongside your raw score. The free practice set contains 10 questions with a 25-minute time limit.

Although Chapter 3 carries the highest individual weight at 25%—with Chapters 1, 2, and 4 at 20% each and Chapter 5 at 15%—actual exam questions cut across multiple layers. For example, a question on Cloudflare cache rules (Chapter 3) connects directly to Vercel Cache-Control headers and Supabase authentication cookies (Chapter 1), while a question on hiding an internal development database from the public internet (Chapter 4) ties into updating Terraform security groups (Chapter 2) and executing a zero-downtime connection cutover (Chapter 5). Read the chapters not as isolated components, but as one living system in which user requests travel through DNS and the edge to reach applications and databases, managed as declarative code and protected by internal access controls and operational discipline.

What the questions look like

The exam paper uses five multiple-choice question formats, and in every question you select the single best option among five numbered choices (①–⑤).

The most common trap in infrastructure exam questions is an option that makes the feature work on the surface while violating security boundaries or zero-downtime requirements. For instance, options such as "fix the RLS permission error by calling Supabase from the client with the service_role key," "lower the DNS TTL on migration day and change the IP record immediately," "run ALTER TABLE RENAME COLUMN before deploying the new application code," or "set Cloudflare SSL mode to Flexible so you do not have to install a certificate on the origin server" appear to clear the immediate error, but in reality they cause catastrophic data breaches or service outages. Always ask first: "Does this choice preserve production security boundaries and high availability?"

Six-week study plan

This recommended schedule assumes one hour a day, five days a week. If you already have hands-on cloud operations experience, you can combine weeks 1 and 2 for a fast review and spend extra time on weeks 3 through 5.

Notation and sources

The cloud platform features, protocols, and standards explained in this book were verified against each vendor's official documentation on October 21, 2026.

1. Product names, CLI commands, environment variables, HTTP headers, configuration keys, and SQL/HCL syntax keywords retain their exact official spelling (NEXT_PUBLIC_, x-vercel-protection-bypass, Supavisor, terraform.tfstate, prevent_destroy, Full (Strict), cloudflared, NODE_EXTRA_CA_CERTS).
2. Technical terms are introduced with clear definitions and their standard acronyms on first use, and used consistently throughout the book (for example, Row Level Security (RLS), Zero Trust Network Access (ZTNA), Point-in-Time Recovery (PITR), and Expand-Contract / Parallel Change).
3. Rather than focusing on pricing tier limits or console button coordinates that vendors change frequently, the book emphasizes enduring architectural principles, network protocols, and security boundaries.
4. All companies, institutions, services, domain names, and incidents appearing in the main text and workplace scenarios are fictional examples invented for educational purposes.
5. Code blocks show the essential structural patterns needed for understanding; before applying them to a production system, cross-check the latest vendor documentation listed in each chapter's Check the official docs section and in Appendix D.