SysPad › Lessons
Learn cloud architecture, service by service
Short interactive lessons on the cloud services you design with: what each one does, where it becomes the bottleneck, and what it costs. Free, no account.
Each lesson is a short read with diagrams, flashcards and a quiz, and every service it covers is on the SysPad canvas, so you can place it in an architecture and simulate the traffic straight afterwards. The sections below follow the path a request takes through a system rather than the alphabet.
Diagram lessons
Start here. These cover how to model traffic arriving at a system, and how to stand in for anything the catalog does not name.
- Users: The entry point of the diagram - marks where traffic originates.
Networking lessons
How a request reaches your compute. Load balancers, API gateways, DNS and private connectivity, and which of them adds latency rather than capacity.
- Application Load Balancer: Layer-7 load balancer for HTTP/HTTPS traffic.
- Network Load Balancer: Layer-4 load balancer for TCP, UDP, and TLS traffic.
- Route 53: Scalable DNS and health checking.
- Amazon API Gateway: Amazon API Gateway.
- AWS AppSync: Managed GraphQL API with real-time subscriptions.
- NAT Gateway: Managed Network Address Translation for private subnet egress traffic.
- Transit Gateway: Regional network transit hub that interconnects VPCs, VPNs and Direct Connect through a single routing point (hub-and-spoke instead of a mesh of peerings).
- Global Accelerator: Anycast edge entry that routes users to the nearest AWS edge and carries traffic over the AWS backbone to your endpoints, improving latency and failover.
- VPC Endpoint (PrivateLink): Reaches a service privately from inside the VPC, keeping traffic off the public internet and off NAT.
- Direct Connect: Dedicated private network link between on-premises and AWS for consistent bandwidth and lower, more predictable latency than the public internet.
- Gateway Load Balancer: Transparent L3 load balancer that fans traffic across a fleet of virtual security appliances (firewall, IDS/IPS) over GENEVE.
- Internet Gateway: The VPC front door: lets resources in public subnets reach and be reached from the internet.
- Edge Functions (CloudFront): Code at the CDN edge.
- Kong Gateway: Kong API gateway / reverse proxy (self-hosted or Kong Konnect).
- Vercel: Frontend cloud - global CDN for static assets plus serverless/edge functions for SSR and APIs.
CDN and edge lessons
Serving from the edge instead of the origin. Cache hit ratios, origin shielding, and how much load a cache actually removes from what sits behind it.
- CloudFront: Global Content Delivery Network with 600+ edge locations.
- Cloudflare: Cloudflare edge network - CDN, WAF, and reverse proxy in front of your origin.
Compute lessons
Servers and containers you size yourself. How instances, tasks and Kubernetes nodes turn CPU and memory into throughput, and where the ceiling sits.
- EC2 Instance: Virtual server in the cloud.
- ECS Fargate: Serverless container compute.
- EKS Cluster: Managed Kubernetes control plane with an EC2 worker node group.
- AWS Batch: Managed batch job scheduler.
- AWS App Runner: DEPRECATED BY AWS: App Runner entered maintenance mode in March 2026 and is closed to new customers since April 2026.
Serverless lessons
Code that runs per request with nothing to size. Concurrency limits, cold starts, and the point where paying per invocation stops being the cheaper option.
- AWS Lambda: Event-driven serverless compute.
Orchestration lessons
Coordinating work that outlives a single request. State machines, workflow engines and schedulers, and how retries change the load a downstream service sees.
- AWS Step Functions: Serverless workflow orchestration.
Database lessons
Where state lives and what it costs to read. Relational, key-value, cache, search and graph stores, their consistency choices, and the connection and partition limits that saturate first.
- DynamoDB: Fully managed NoSQL key-value and document database.
- RDS: Managed relational database service.
- Amazon Aurora: MySQL/PostgreSQL-compatible relational database with up to 5× MySQL or 3× PostgreSQL performance.
- Amazon ElastiCache: AWS-managed in-memory store for caching, sessions, pub/sub, and leaderboards.
- ElastiCache (Memcached): Multi-threaded in-memory key-value cache.
- DynamoDB Accelerator (DAX): Write-through in-memory cache in front of DynamoDB.
- DocumentDB: MongoDB-compatible managed document database.
- Neptune: Managed graph database for highly connected data (Gremlin, openCypher, SPARQL).
- Redshift: Columnar MPP data warehouse for analytics.
- OpenSearch Service: Managed search and log-analytics engine (OpenSearch / Elasticsearch).
- Timestream: Serverless time-series database.
- Keyspaces (Cassandra): Serverless, Apache Cassandra-compatible wide-column database.
- MemoryDB for Redis: Durable, Redis-compatible in-memory database - a primary datastore, not just a cache.
- RDS Proxy: Fully-managed connection pooler for RDS and Aurora.
- MongoDB Atlas: MongoDB Atlas - fully-managed document database.
- PlanetScale: PlanetScale - managed MySQL on Vitess with horizontal sharding.
- Redis Cloud: Redis Cloud - fully-managed Redis from Redis Inc.
- Redis (self-managed): Self-managed Redis / Valkey in-memory data store running on your own infrastructure (EC2, Kubernetes, or bare metal).
- Tiger (TimescaleDB): Tiger / TimescaleDB - a PostgreSQL time-series database (hypertables, columnar compression, continuous aggregates).
- Firebase (Firestore): Google Firebase - Firestore document DB + Auth, the classic student/startup backend.
- Supabase: Managed Postgres + Auth + Realtime ("open-source Firebase").
- Neon Postgres: Serverless Postgres - scale-to-zero, branching, built-in connection pooling.
- Algolia: Hosted instant search (the typeahead-interview classic).
Storage lessons
Objects, blocks and file systems. Durability, throughput ceilings and access patterns, and why the requests against storage usually cost more than the bytes.
- S3: Virtually unlimited object storage.
- S3 Glacier: Low-cost archival object storage.
- EBS Volume: Network-attached block storage for a single EC2 instance.
- EFS: Elastic, fully managed NFS file system shared by thousands of clients across AZs.
- FSx: Managed high-performance file systems: Lustre for HPC/ML, Windows File Server (SMB), NetApp ONTAP, and OpenZFS.
- Storage Gateway: Hybrid cloud storage bridging on-prem apps to S3/EBS/Glacier through a local cache.
Messaging lessons
Decoupling producers from consumers. Queues, topics, streams and delivery, and how a buffer turns a traffic spike into a backlog instead of an outage.
- SQS: Fully managed message queue.
- SNS: Pub/sub messaging for fan-out to SQS, Lambda, HTTP, email, and SMS.
- EventBridge: Serverless event bus connecting AWS services, SaaS apps, and custom applications.
- Kinesis Data Streams: Real-time data streaming for logs, events, and clickstreams.
- Kinesis Data Firehose: Serverless delivery stream that buffers records and loads them into S3, Redshift, or OpenSearch.
- Amazon MSK: Fully managed Apache Kafka.
- Amazon MQ: Managed message broker for ActiveMQ and RabbitMQ.
- Redis Streams: Append-only log with consumer groups (XADD / XREADGROUP) - a lightweight, in-memory Kafka-style stream inside Redis.
- Amazon SES: Managed email sending (and receiving) at scale - the email leg of notification systems.
- Twilio SMS: Programmable SMS.
Analytics lessons
Querying data you already collected. Warehouses, query engines and scan-based pricing, and why a report is a different workload from a request.
- Amazon Athena: Serverless SQL queries directly over data in S3.
- AWS Glue: Serverless Spark ETL.
- Amazon EMR: Managed Spark/Hadoop/Hive cluster on EC2 - a primary node plus core nodes.
- Snowflake: Snowflake cloud data warehouse - typically the analytics sink at the end of a data pipeline.
- Databricks: Databricks lakehouse - analytics and ML compute, usually the sink of a data pipeline.
- BigQuery: Google BigQuery - serverless data warehouse, a common analytics sink.
- Amazon QuickSight: Serverless BI dashboards on top of Athena/Redshift/S3.
- ClickHouse: Columnar OLAP database for real-time analytics, self-hosted or ClickHouse Cloud.
- Apache Pinot: Real-time distributed OLAP store for user-facing analytics: high QPS at low latency, ingesting continuously from Kafka.
AI and machine learning lessons
Model inference as a dependency. Hosted and self-managed models, token pricing, and the latency an inference call adds to a request path.
- SageMaker Endpoint: Managed real-time ML inference endpoint.
- Amazon Bedrock: Serverless foundation-model inference (Claude, Llama, Titan…).
- OpenAI API: OpenAI LLM API - a synchronous inference dependency.
- Anthropic (Claude): Anthropic Claude API - a synchronous LLM inference dependency.
Security lessons
Controlling who reaches what. Authentication, secrets, keys and request filtering, and where each one sits in the path a request takes.
- AWS WAF: Web Application Firewall protecting against SQL injection, XSS, bots, and rate abuse.
- Cognito: Managed user identity: sign-up, sign-in, MFA, social federation, and JWT token issuance.
- AWS KMS: Managed encryption keys.
- Secrets Manager: Managed secrets with rotation (DB credentials, API keys).
- Auth0: Auth0 identity provider - token issuance and validation as a third-party dependency.
Monitoring lessons
Knowing what the system is doing. Metrics, logs and traces, what they cost at volume, and which of the three answers which question.
- Amazon CloudWatch: Metrics, logs, alarms and dashboards.
- Datadog: SaaS observability (metrics, APM, logs).
Payments lessons
Taking money inside a request flow. The third-party call, the latency it adds, and what happens to the order when it fails.
- Stripe: Stripe payments API - a synchronous third-party dependency on the request path.