AI & Cloud Infrastructure Course

Contents

1. How to use this book
2. Chapter 1. Managed Application and Data Platforms (Foundations: Vercel & Supabase)

   Vercel environment separation: The boundary between Preview and Production · Environment variables and the NEXT_PUBLIC_ exposure boundary · Deployment Protection and designing automation bypasses · Function region placement, execution time limits, Fluid Compute, and streaming · Supabase Postgres and Supavisor connection pooling: 6543 vs. 5432 · Row Level Security (RLS): How USING and WITH CHECK actually work · Trust boundaries between the anon key and the service_role key · Supabase Auth callback allowlists and mobile/web authentication flows · Supabase Storage: Public vs. private buckets and signed URLs · Serverless cold starts, DB TLS handshakes, and transaction-local context · RLS performance traps and bypass patterns in multi-tenant AI services

3. Chapter 2. Infrastructure as Code and Deployment Automation (Intermediate: Terraform & IaC)

   The declarative model and the core Terraform workflow · The role and structure of the state file (terraform.tfstate) · Remote backends and state locking · Module design and version pinning · Environment isolation: Per-directory state separation vs. workspaces · Reading terraform plan output and blocking destructive changes (prevent_destroy) · Zero-downtime refactoring and adopting existing resources: moved and import blocks · Plaintext secret exposure in state files and managing sensitive variables · Detecting and remediating configuration drift · Keyless CI/CD pipelines with GitHub Actions OIDC · Attack surfaces in PR-driven infrastructure automation (the Atlantis pattern) and plan artifact integrity · Reducing state file blast radius at scale

4. Chapter 3. Global DNS and Edge Networks (Advanced: Route 53 & Cloudflare)

   The DNS resolution path and core record types: Why you cannot put a CNAME at the Zone Apex · Route 53 routing policies and health checks for zero-downtime traffic control · Zero-downtime domain and server migrations: The law of lowering TTLs in advance · Cloudflare proxied (orange cloud) vs. DNS-only (grey cloud) modes and hiding the origin IP · SSL/TLS encryption modes: Why you must never use Flexible and why Full (Strict) is the standard · WAF, rate limiting, and bot controls while protecting legitimate webhooks · CDN cache rules and preventing cache poisoning on dynamic APIs and streams · Cloudflare Workers and Queues: Edge computing and decoupling asynchronous work · Cloudflare AI Gateway: Observability, caching, rate limiting, and fallback for LLM traffic · DNS weighted routing vs. HTTP edge routing in zero-downtime blue-green migrations · Origin IP leak paths and complete Origin Lockdown

5. Chapter 4. Internal Network Security and Remote Access (In Practice: Adopting and Deploying ZTNA & VPNs)

   Limits of traditional perimeter VPNs and Zero Trust (NIST SP 800-207) · Outbound-only connectors: cloudflared (Cloudflare Tunnel) and eliminating inbound ports · Mesh VPNs (WireGuard & Tailscale): Subnet routers, DERP relays, and least-privilege ACLs · Split tunneling and resolving home router subnet collisions (RFC 1918) · Split-Horizon DNS and preventing internal domain exposure · IdP integration (SSO & MFA) and automatic offboarding with SCIM · Device posture and enforcing endpoint security health · Deploying enterprise root CA certificates and fixing developer CLI & coding agent TLS errors · Keyless access with short-lived SSH certificates and session auditing · Balancing developer productivity and security controls: A phased ZTNA rollout strategy

6. Chapter 5. Infrastructure Reliability, Secrets Management, and Incident Response

   Zero-downtime secret and certificate rotation: The dual-key acceptance pattern · Scheduled rotation vs. emergency revocation during an active key leak · Backup strategies and Point-in-Time Recovery (PITR): Designing RPO, RTO, and restore drills · Zero-downtime schema migrations: The Expand-Contract (Parallel Change) pattern · The three pillars of observability and OpenTelemetry distributed tracing · Log scrubbing and redacting sensitive information · Cost and usage anomaly alerts and circuit breakers · Incident isolation/rollback runbooks and blameless postmortems · A zero-lock DDL checklist for operating PostgreSQL at scale · Tiered health checks and graceful degradation in multi-region, multi-vendor AI services

7. Appendix A. Glossary
8. Appendix B. Self-check answers and explanations
9. Appendix C. Exam day guide
10. Appendix D. Official references