FOUNDATIONS TRACK · RELEASING DECEMBER 2026
Cloud Building Blocks 101: The Four Major Clouds
The pieces every cloud is made of, what AWS, Azure, Google Cloud and Oracle call each one, and the questions a compliance professional asks about it.
All coursesOpens December 2026
You will get the most from it if you are…
- Governance, risk and compliance professionals who know controls and frameworks but not the cloud's parts
- Internal auditors and assessors preparing to examine a cloud estate
- Risk and vendor managers who read provider documentation and attestation reports
- Security and compliance leads inheriting workloads on more than one cloud
What it covers.
- 01The shape of a cloudRegions and zones, accounts and the organization above them, service models, and the control plane
- 02Identity and accessWho can do what: the identity service, roles, the most powerful accounts, and workload identities
- 03ComputeVirtual machines, images, autoscaling, dedicated hosts and serverless functions, and who patches what
- 04Storage and keysObject, block, file and archive storage, backup, the key services, and retention locks
- 05NetworkingVirtual networks, filters and firewalls, load balancers, private links and DNS
- 06Containers and KubernetesManaged Kubernetes, registries, serverless containers and the software supply chain
- 07Databases and data servicesManaged relational, NoSQL and warehouse services: patching, backup, encryption and location
- 08Logging, monitoring and the security servicesThe control-plane audit log, posture and threat services, and what to do on Monday
8 short lessons, part by part.
The shape of a cloud
- Regions, accounts and the two planes
- Describe regions and zones, and the account, subscription, project and compartment each provider uses, with the organization above them
- Place a service on the NIST service models and say how responsibility shifts between them
- Tell the control plane from the data plane, and say why the control plane matters most for governance
Job aid: The shape of a cloud: a one-page guide
Identity and access
- Who can do what
- Name each provider's identity service and permission model
- Explain why the most powerful accounts and emergency access need special handling, with multifactor authentication
- Tell a person's identity from a workload's, and say why long-lived keys are a finding
Job aid: Identity and access: a one-page guide
Compute
- Machines, images and functions
- Name each provider's virtual machine, image, autoscaling, dedicated host and serverless function services
- Explain how patching responsibility shifts from virtual machines to serverless functions
- Ask for evidence that holds up when machines come and go automatically
Job aid: Compute: a one-page guide
Storage and keys
- Where data rests, and who holds the keys
- Name each provider's object, block, file, archive and backup services
- Tell provider-managed keys from customer-managed keys and hardware security modules, and say what each changes
- Explain retention locks and what makes them evidence for records rules
Job aid: Storage and keys: a one-page guide
Networking
- Virtual networks and the paths between them
- Name each provider's virtual network, traffic filters, firewall, load balancer, private connection, private endpoint and DNS services
- Explain why exported rules and flow logs are better evidence than a network diagram
- Ask whether private connections and private endpoints are encrypted and enforced
Job aid: Networking: a one-page guide
Containers and Kubernetes
- Containers, clusters and the supply chain
- Explain in plain words what a container, an image, a registry and an orchestrator are
- Name each provider's managed Kubernetes, registry, serverless container and image scanning services
- Say where the shared responsibility line falls in each Kubernetes mode, and what evidence to ask for about the supply chain
Job aid: Containers and Kubernetes: a one-page guide
Databases and data services
- Managed databases and where the data sits
- Name each provider's managed relational, NoSQL and data warehouse services, including 2024 to 2025 renames and retirements
- Explain who patches and who backs up in a managed database compared with one the customer runs on a virtual machine
- Ask where every copy of the data physically sits, including replicas and backups
Job aid: Databases and data services: a one-page guide
Logging, monitoring and the security services
- The record, the watchers and Monday
- Name each provider's control-plane audit log and state its default retention
- Tell posture services from threat services, and detective controls from preventive ones, on each cloud
- Leave with a short list of first steps to take in your own organization
Job aid: Logging, monitoring and the security services: a one-page guide
How it is delivered.
- Narrated lessons in short parts you can take one at a time
- A one-page job aid for each lesson
- A short check at the end of each lesson
- A lens for your role: security, cloud architecture or compliance
The courses open in December 2026.
Narration is AI-generated (OpenAI's Cedar voice). The courses teach preparation and method; they certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor or regulator.