Cloud Building Blocks 202: Reading Cloud Architecture

• Name the AWS group shapes and say how Azure diagrams show the same scopes: management group, subscription, region, virtual network and subnet
• Read an architecture diagram top to bottom, from the cloud and the accounts down to the subnets, and say what it leaves out
• Treat a diagram as a claim and the exported configuration as the evidence, and explain where this course's overlay comes from

Job aid: Reading a provider diagram: a one-page guide

• Explain how a landing zone acts as a common control provider with its own authorization boundary, and recognize the older terms general support system and major application when a document still uses them
• Find the landing zone on an AWS and an Azure diagram and say what each shared account or subscription does
• Read an inheritance matrix, and describe who authorizes the platform and how a workload's plan relies on it

Job aid: The landing zone as a common control provider: a one-page guide

• Define the application boundary as the workload and what it depends on to operate, in the cloud, on site and off site, and say who sets it
• Find dependencies from four sources: configuration, network flows, contracts and interviews
• Sort each dependency into inside the boundary, a documented interconnection under NIST SP 800-47 Rev. 1, or out of scope with a written reason, and test that reason

Job aid: The application boundary: a one-page guide

• Read a data flow diagram flow by flow, and pick out each flow that crosses a boundary
• Say where encryption in transit starts and ends at a load balancer, on a private line and at a database, and why a private path is not an encrypted one
• Describe the boundary, network and data flow diagrams an assessor expects, and how the 2026 FedRAMP rules restate the need

Job aid: Reading data flows for boundary crossings: a one-page guide

• Explain why an architecture review that stays on the icons misses most of what goes wrong
• Walk any icon with three questions: who operates it, what process changes it, what technology enforces it
• Place the provider, the platform team, the application team and vendors across the boundary, using the responsibility matrix

Job aid: Walking a diagram: people, process, technology

• Explain why NIST SP 800-53 Revision 5 sits underneath most sector rules, and name its current release
• Lay the main control families over an architecture diagram, and say what each tag asks
• Say, family by family, what a workload usually inherits and what stays its own

Job aid: NIST SP 800-53 families on an architecture diagram: a one-page guide

• Read a sector diagram for the shared platform, the application boundary and its dependencies, using the same method as Bramblewood's claims diagram
• Say what your own sector's rules add to the boundary: a zone, a validated boundary, an assessment scope, a perimeter, a hold or a certified offering
• Trace your sector's rulebook back to the NIST publication underneath it, and say plainly where the sector's own text governs

Job aid: Your sector's boundary: what each rulebook adds, and the NIST underneath

• Explain whose authorization covers provider hardware on your floor, and why the physical side and the link back to the region sit inside your boundary
• Read a diagram with two common control providers and one application boundary that crosses both clouds
• Place a software service at the edge of the boundary: what the provider's assurance covers, and what you configure and must still evidence

Job aid: Reading hybrid, multi-cloud and software-service boundaries

• Name the four documents in an architecture package and read the diagram, system plan, exported configuration and inheritance matrix against each other
• Find the gaps on a package diagram by tracing each boundary, dependency and crossing to the other three documents
• Write a finding plainly, stating what, where, the evidence and the owner, without grading or approving the system

Job aid: Reviewing an architecture package: a one-page guide