Cloud Deployment for ML (AWS-First) · 55 min · AWS S3 · AWS IAM · AWS Free Tier

Cloud Foundations for ML Engineers

You can't deploy what you can't reason about. Learn the four primitives, then everything else is composition.

Hiring signal: Speaks the cloud vocabulary recruiters and architects screen for

What you will learn

Explain regions, availability zones, and the shared responsibility model
Use S3 for ML data and artifacts and know when not to
Apply IAM roles and least-privilege policies
Choose among VM, serverless, container, and managed-ML compute
Build a back-of-envelope cost model for an ML deployment

The Problem

"Deploy it to the cloud" is in 35%+ of ML job postings, and it's the gap that most often ends a promising resume screen. The cloud looks like an ocean of 200+ services with cryptic names, so beginners freeze. But ML engineers don't need all of it — they need a confident grasp of four primitives (storage, identity, compute, networking) and a cost model. Everything else is a specific composition of those.

This lesson gives you the mental model and vocabulary to deploy with intent instead of copying a tutorial you don't understand.

The Concept

The Four Primitives: Everything Is Composition

The cloud looks like 200+ services with cryptic names. But every cloud deployment — from a simple API to a multi-region ML pipeline — is built from the same four primitives. Learn these and you can reason about any cloud service by asking "which primitive is this?"

Storage is where data and artifacts live. Object storage (S3, GCS, Blob) for files like model weights, datasets, and logs. Block storage (EBS) for databases and filesystems. The key property: storage persists independent of compute — you can store a 10GB model file, spin up a compute instance, load the model, and the file remains when the instance terminates.

Identity is who or what is allowed to do what. IAM (Identity and Access Management) controls permissions: which users can access which resources, which services can talk to which other services. This is the security boundary — getting identity wrong means either your service can't function (too restrictive) or anyone can access your data (too permissive).

Compute is where code runs. Virtual machines (EC2), containers (ECS/Fargate), serverless functions (Lambda), or managed ML endpoints (SageMaker). The choice is about control vs. convenience: EC2 gives you full control but you manage everything; Lambda gives you zero management but limits what you can run.

Networking is how traffic reaches the compute. VPCs (Virtual Private Clouds) define network boundaries, load balancers distribute traffic, API Gateways expose HTTPS endpoints. Networking is often the hardest primitive to learn because it's invisible — you can't see a VPC, but a misconfigured one means your service is either unreachable or exposed to the internet without protection.

Every cloud deployment is built from four primitives:

You need to deploy a FastAPI model-serving app to AWS. Match each requirement to the right primitive: (1) store the 2GB model file, (2) allow only authenticated API calls, (3) run the FastAPI process, (4) expose HTTPS to the internet.

Storage = S3 (object storage for model artifacts). Identity = IAM (policies control who/what can call the API). Compute = EC2 or ECS/Fargate (runs the FastAPI process). Network = VPC + API Gateway or Load Balancer (exposes HTTPS endpoint, handles routing). These four primitives map to every cloud provider.

Storage   : where data and artifacts live          (AWS: S3)
Identity  : who/what is allowed to do what          (AWS: IAM)
Compute   : where code runs                          (AWS: EC2 / Lambda / ECS / SageMaker)
Network   : how traffic reaches the compute          (AWS: VPC, API Gateway, load balancers)

And two structural facts shape everything:

Regions & AZs           : the cloud is many data centers; you pick a region (latency,
                          cost, data residency). AZs give redundancy within a region.
Shared responsibility   : the provider secures the cloud (hardware, hypervisor);
                          YOU secure what's in it (IAM, data, app config).

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Build It, Use It, Ship It, Evaluation, Exercises, Key Terms, Common Pitfalls, Interview Framing — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.