Letra ChicaAzureAWSGCP
Translatearchitectures.Not justservices.
Complete patterns across Azure, AWS and GCP: where the analogy breaks, with official sources, verification dates, list prices and Terraform that compiles.
Today’s fine print
AzureScale-to-zero async worker with dead-letterThe scale rule authenticates with the identity property, not authFor the scale rule to use a managed identity, set the identity property instead of auth. The portal doesn't support it: use IaC or CLI.AWSSecretless CI/CD deployments (OIDC federation)IAM requires a sub condition, but accepts one that still leaves the door openGitHub's issuer is the same for every organization: without scoping sub, any GitHub repository could assume your role. That's why IAM rejects creating or updating a trust policy for that provider when the sub (or job_workflow_ref) condition is missing or is just a wildcard. But "repo:*" or "repo:my-org/*" pass validation. The real boundary is yours to set: this module uses StringEquals with one sub per environment.GCPSecretless CI/CD deployments (OIDC federation)Without attribute_condition, GitHub's shared issuer lets any repo inGitHub uses one issuer for all its customers, so validating the issuer isn't enough. Google requires a condition restricting tokens to your organization or repository. In Terraform the field is listed as optional and, without a condition, every valid credential from the issuer is accepted. Also, every claim you use in the condition or in a principalSet must be mapped in attribute_mapping.
Why it exists
Tables say S3 “is” Blob Storage. They don’t tell you where it breaks.
Side-by-side comparatorTwo or three clouds per pattern: the same diagram, what implements each role, fine print, cost and Terraform.Decision matrixTick what you need (FIFO, private networking, cross-zone HA) and see which SKU meets it on each cloud and what it costs.Migration and ADRA source-to-target checklist and a MADR Architecture Decision Record, with the fine print cited.Certification practiceBlind mode and spaced-repetition flashcards, filtered by exam: AZ-104, AZ-700, SAA-C03, ACE.A dictionary with gapsServices, concepts and a Terraform resource map, with explicit gaps and what isn’t 1:1.Open and offlineA JSON dataset, an MCP server for your agent, embeddable widgets and offline saving to study anywhere.
Patterns
5 published patterns.
Publishedmessagingserverless12 gotchasScale-to-zero async worker with dead-letterA worker processes messages from a queue, scales on queue length (down to zero), stores results in object storage and sets aside failing messages.Monthly floor with no traffic: Azure USD 9.81 · AWS USD 0 · GCP USD 0AzureAWSGCPPublishedidentityci-cd15 gotchasSecretless CI/CD deployments (OIDC federation)A GitHub Actions job deploys to the cloud with Terraform using its OIDC token, with no client secrets or access keys stored in the repository.Monthly floor with no traffic: Azure USD 0 · AWS USD 0 · GCP USD 0AzureAWSGCPPublishednetworkingdns14 gotchasHybrid private DNS (on-premises ↔ cloud)On-premises resolves the cloud's private zones (Private Endpoints included) and the cloud resolves the corporate domain, with no self-managed DNS servers in the cloud.Monthly floor with no traffic: Azure USD 363 · AWS USD 365 · GCP USD 0.40AzureAWSGCPPublishedstoragelifecycle17 gotchasPrivate object ingestion with expiration (TTL)A workload uploads files to a private bucket, keyless, over a private network, and files delete themselves after N days.Monthly floor with no traffic: Azure USD 7.80 · AWS USD 0 · GCP USD 0AzureAWSGCPPublishedcontainerspostgres16 gotchasZero Trust private web API with passwordless PostgreSQLAn HTTP container reachable only from the private network, connecting to PostgreSQL with its workload identity instead of a username and password.Monthly floor with no traffic: Azure USD 24.39 · AWS USD 74.21 · GCP USD 51.01AzureAWSGCP
The most valuable contribution
It isn’t a new pattern. It’s re-verifying a gotcha.
Clouds change. Open the official source, confirm it still holds and update verified_at.