Components#
Every production system is some assembly of the same five primitives, compute, networking, storage, security, and observability. The operator who can name them on contact maps any infrastructure (their own, the target’s, the defended one) to the same parts list under different branding.
Build tooling out of these primitives, attack tooling that ignores them, and the operator can move between offence, defense, and engineering work without re-learning the vocabulary.
Primitives#
Every provider ships the same five primitives under its own brand names. Learn the primitive once and the brand name is just a lookup.
Primitive |
What it provides |
|---|---|
Compute |
Somewhere for code to run, from bare metal through VMs, containers, and microVMs down to functions and edge isolates. |
Networking |
The path packets take and the address a service answers on, built from VPCs, load balancers, DNS, CDNs, and service meshes. |
Storage |
Where state lives, across block volumes, shared file systems, object buckets, and managed databases. |
Security |
Who may do what and the boundary that enforces it, spanning identity, keys, policy, and the audit trail behind them. |
Observability |
What the running system reveals about itself, through logs, metrics, traces, and profiles. |
Composition#
Providers rarely sell a bare primitive. They compose several into a managed component and bill it as one product. A managed database is a compute engine on a block volume, reachable over a private network endpoint, gated by identity and encryption, and instrumented with metrics and slow-query logs. Pull it apart and all five primitives are in there.
The composition also fixes the attack surface. A component inherits the weaknesses of every primitive it stands on, so the operator who knows the parts list knows where to push. The common managed components and the primitives each is built on:
Component |
Compute |
Networking |
Storage |
Security |
Observability |
|---|---|---|---|---|---|
Load balancer |
· |
✓ |
· |
✓ |
✓ |
API gateway |
· |
✓ |
· |
✓ |
✓ |
Object storage |
· |
✓ |
✓ |
✓ |
✓ |
Message queue |
· |
✓ |
✓ |
✓ |
✓ |
Secrets manager |
· |
✓ |
✓ |
✓ |
✓ |
Serverless function |
✓ |
✓ |
· |
✓ |
✓ |
Managed database |
✓ |
✓ |
✓ |
✓ |
✓ |
Kubernetes service |
✓ |
✓ |
✓ |
✓ |
✓ |
Networking, security, and observability sit in every row; a provider never ships a component without a network path, an access boundary, and telemetry. Components differ mainly in whether they add compute, storage, or both.
VMs, containers, functions, edge. Selection guide for which compute fits which workload.
Load balancers, reverse proxies, DNS, CDNs, service meshes. The bulk of production traffic.
Block, file, object, database. Picked by access pattern.
Edge, network, identity, application, data, audit. Each control expected to fail into the next.
Logs, metrics, traces, profiles. Ask new questions of the running system without redeploying.