Clouds,
mapped.

Start with the shape, not the product catalogue.

AWS, Azure, and Google Cloud are general-purpose infrastructure clouds. Databricks usually runs on one of them and specialises in data engineering, analytics, governance, and AI. Treating all four as peers is the first mistake this guide will prevent.

Pick one home cloud; learn the mappings second

A beginner becomes useful faster by building the same small system repeatedly on one platform, then translating it. If you already have some Azure exposure, deepen Azure until identity, networking, storage, deployment, and logs feel routine. Then use this map to acquire AWS and GCP vocabulary without relearning distributed systems from zero.

Where does a resource live?

Every cloud has two overlapping maps: an administrative hierarchy for ownership, policy, and billing; and a physical scope for region, zone, and network. A database can inherit permission from its administrative ancestors while still being unreachable because of its physical network.

The closest boundary translations

These are working analogies, not exact equivalences. Most importantly, an Azure resource group has no exact AWS equivalent, and a Databricks workspace does not replace its host cloud account/subscription/project.

Same capability, different product grammar.

Use this as a translation index, not a procurement decision. Rows mean “solves a related class of problem,” not “feature-for-feature equivalent.” Databricks cells are intentionally blank where the platform expects its host cloud to provide the primitive.

There are often several valid matches because clouds split products at different seams. Example: an “API backend” might be Lambda + API Gateway on AWS, one Azure Function, a Cloud Run service on GCP, or a Databricks App backed by Lakebase for a data-centric internal tool.

The foundations beneath every service name.

Regions and zones are failure boundaries

A region is a separate geographic area. A zone is an isolated datacenter group inside a region. Multi-zone protects against a zonal failure; multi-region protects against larger failures and may satisfy residency or latency requirements. It also costs more and introduces replication choices.

The network difference worth memorising

This is why copied diagrams fail: an AWS “one subnet per AZ” pattern should not be transplanted literally into Azure or GCP.

Control plane versus data plane

Choose a data model before a database brand

Who is asking to do what, to which resource?

Cloud permission systems become less mysterious when every request is written as a sentence: principal P wants action A on resource R under conditions C. Authentication proves P. Authorisation evaluates policies. Networking still decides whether P can reach R.

The identity choreography for an application

1. Your human/federated identity signs in to the CLI. Avoid root users and long-lived access keys.
2. Your deployment identity creates compute, storage, logs, and a runtime identity. Creating role assignments is often a separate privilege.
3. A narrow policy grants the runtime identity only required actions on the precise data path.
4. The platform injects short-lived credentials or exposes a metadata/token endpoint to the workload.
5. The SDK’s default credential chain obtains and refreshes tokens. No secret is committed to source.
6. The target service evaluates permission, conditions, public-access controls, and network policy; audit systems record the call.

A 403 / AccessDenied debugging ladder

What “create a bucket” actually means.

Object storage is the common first primitive because it exposes every important cloud concept at once: administrative scope, region, global naming, data model, encryption, public access, runtime identity, and a separate data endpoint.

AWS: private S3 bucket

Bucket names are globally unique, but the bucket lives in one selected region. New buckets default to Bucket owner enforced object ownership (ACLs disabled) and no public access; retain Block Public Access unless public object hosting is truly intended.

Official walkthroughGetting started with Amazon S3 ↗

Copy# Use a globally unique lowercase name; keep your chosen region explicit.
REGION="ap-southeast-2"
BUCKET="cloud-lab-$RANDOM-$RANDOM"

aws sts get-caller-identity
aws s3 mb "s3://$BUCKET" --region "$REGION"
aws s3api put-public-access-block --bucket "$BUCKET" \
  --public-access-block-configuration \
  'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

printf '{"hello":"aws"}' | aws s3 cp - "s3://$BUCKET/hello.json"
aws s3api head-object --bucket "$BUCKET" --key hello.json

The CLI is acting as your current human/federated principal. A Lambda function should not reuse that identity; it assumes its own execution role with permission such as s3:PutObject on arn:aws:s3:::bucket/prefix/*.

Azure: private blob container

Azure adds a wrapper: the globally unique Storage Account hosts Blob, Queue, Table, and File services. A blob path is https://account.blob.core.windows.net/container/blob. Control-plane Contributor rights do not by themselves grant OAuth data access.

Official walkthroughBlob Storage quickstart for Python ↗

CopyRG="cloud-storage-lab"
REGION="australiaeast"
STORAGE="cloudlab$RANDOM$RANDOM" # 3–24 lowercase letters/digits

az account show --output table
az group create --name "$RG" --location "$REGION"
az storage account create --name "$STORAGE" --resource-group "$RG" \
  --location "$REGION" --sku Standard_LRS --kind StorageV2 \
  --allow-blob-public-access false --min-tls-version TLS1_2

STORAGE_ID=$(az storage account show -g "$RG" -n "$STORAGE" --query id -o tsv)
ME=$(az ad signed-in-user show --query id -o tsv)
az role assignment create --assignee-object-id "$ME" --assignee-principal-type User \
  --role "Storage Blob Data Contributor" --scope "$STORAGE_ID"

az storage container create --account-name "$STORAGE" --name receipts --auth-mode login
printf '{"hello":"azure"}' > /tmp/cloud-lab-hello.json
az storage blob upload --account-name "$STORAGE" --container-name receipts \
  --name hello.json --file /tmp/cloud-lab-hello.json --auth-mode login

Creating the role assignment requires Microsoft.Authorization/roleAssignments/write—typically Owner, User Access Administrator, or a narrower delegated role. Role propagation is not always instantaneous.

Google Cloud: private Cloud Storage bucket

A bucket belongs to a project and has a chosen location, while its name is globally unique. Prefer uniform bucket-level access so IAM is the single authorisation model, and enable public access prevention for private data.

Official walkthroughCreate a Cloud Storage bucket ↗

CopyPROJECT_ID="your-project-id"
REGION="australia-southeast1"
BUCKET="${PROJECT_ID}-cloud-lab"

gcloud config set project "$PROJECT_ID"
gcloud storage buckets create "gs://$BUCKET" --location="$REGION" \
  --uniform-bucket-level-access --public-access-prevention

printf '{"hello":"gcp"}' | gcloud storage cp - "gs://$BUCKET/hello.json"
gcloud storage objects describe "gs://$BUCKET/hello.json"

Databricks: governed files in a volume

A Unity Catalog volume gives non-tabular files a governed three-part namespace. A managed volume lets Unity Catalog manage the underlying object storage lifecycle. An external volume points at a cloud path through a storage credential and external location.

Official walkthroughGet started with Unity Catalog volumes ↗

CopyCREATE SCHEMA IF NOT EXISTS workspace.cloud_lab;
CREATE VOLUME IF NOT EXISTS workspace.cloud_lab.inbox;

-- A user needs USE CATALOG, USE SCHEMA, and READ/WRITE VOLUME as appropriate.
GRANT USE CATALOG ON CATALOG workspace TO `cloud-lab-readers`;
GRANT USE SCHEMA ON SCHEMA workspace.cloud_lab TO `cloud-lab-readers`;
GRANT READ VOLUME ON VOLUME workspace.cloud_lab.inbox TO `cloud-lab-readers`;

For external S3, ADLS, or GCS, the chain is: cloud IAM identity/role → Databricks storage credential → external location → external volume/table. Users receive Unity Catalog privileges, not raw cloud credentials.

Build the same idea four ways.

The common workload is Receipt Box: accept a small JSON receipt, run code, persist it, and inspect logs. AWS, Azure, and GCP expose an HTTP service. Databricks implements the platform-appropriate equivalent: ingest a file, transform it into governed Delta tables, query it, and schedule the pipeline.

CopyAWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Minimal receipt writer

Resources:
  ReceiptsBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true

  ReceiptFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/
      Handler: app.lambda_handler
      Runtime: python3.14
      Timeout: 10
      Environment:
        Variables:
          RECEIPTS_BUCKET: !Ref ReceiptsBucket
      Policies:
        - Statement:
            - Effect: Allow
              Action: s3:PutObject
              Resource: !Sub 'arn:${AWS::Partition}:s3:::${ReceiptsBucket}/receipts/*'
      FunctionUrlConfig:
        AuthType: NONE

Outputs:
  ReceiptUrl:
    Value: !GetAtt ReceiptFunctionUrl.FunctionUrl
  ReceiptBucket:
    Value: !Ref ReceiptsBucket

Copyimport json, logging, os, uuid
import boto3

log = logging.getLogger()
log.setLevel("INFO")
s3 = boto3.client("s3")
bucket = os.environ["RECEIPTS_BUCKET"]

def lambda_handler(event, context):
    try:
        body = json.loads(event.get("body") or "{}")
        if not {"item", "amount"} <= body.keys():
            return {"statusCode": 400, "body": '{"error":"item and amount required"}'}
        receipt_id = str(uuid.uuid4())
        receipt = {"id": receipt_id, "item": body["item"], "amount": body["amount"]}
        s3.put_object(
            Bucket=bucket,
            Key=f"receipts/{receipt_id}.json",
            Body=json.dumps(receipt).encode(),
            ContentType="application/json",
        )
        log.info("stored receipt %s", receipt_id)
        return {"statusCode": 201, "headers": {"content-type": "application/json"},
                "body": json.dumps(receipt)}
    except (ValueError, TypeError):
        return {"statusCode": 400, "body": '{"error":"invalid JSON"}'}

Copyaws sts get-caller-identity
sam build
sam deploy --guided  # choose stack: cloud-receipt-lab; choose your region

URL=$(aws cloudformation describe-stacks --stack-name cloud-receipt-lab \
  --query "Stacks[0].Outputs[?OutputKey=='ReceiptUrl'].OutputValue" --output text)
BUCKET=$(aws cloudformation describe-stacks --stack-name cloud-receipt-lab \
  --query "Stacks[0].Outputs[?OutputKey=='ReceiptBucket'].OutputValue" --output text)

curl -sS -X POST "$URL" -H 'content-type: application/json' \
  -d '{"item":"field-guide","amount":12.50}'
aws s3 ls "s3://$BUCKET/receipts/"
sam logs --stack-name cloud-receipt-lab --tail

# Empty the bucket first; CloudFormation cannot delete a non-empty bucket.
aws s3 rm "s3://$BUCKET" --recursive
sam delete --stack-name cloud-receipt-lab

Copyimport json, logging, os, uuid
import azure.functions as func
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient, ContentSettings

app = func.FunctionApp()

@app.route(route="receipts", methods=["POST"], auth_level=func.AuthLevel.FUNCTION)
def create_receipt(req: func.HttpRequest) -> func.HttpResponse:
    try:
        body = req.get_json()
        if not {"item", "amount"} <= body.keys():
            return func.HttpResponse('{"error":"item and amount required"}', status_code=400)
        receipt_id = str(uuid.uuid4())
        receipt = {"id": receipt_id, "item": body["item"], "amount": body["amount"]}
        account = os.environ["RECEIPTS_ACCOUNT"]
        service = BlobServiceClient(
            f"https://{account}.blob.core.windows.net",
            credential=DefaultAzureCredential(),
        )
        service.get_blob_client("receipts", f"{receipt_id}.json").upload_blob(
            json.dumps(receipt), overwrite=False,
            content_settings=ContentSettings(content_type="application/json"),
        )
        logging.info("stored receipt %s", receipt_id)
        return func.HttpResponse(json.dumps(receipt), status_code=201,
                                 mimetype="application/json")
    except (ValueError, TypeError):
        return func.HttpResponse('{"error":"invalid JSON"}', status_code=400)

Copyazure-functions
azure-identity
azure-storage-blob

Copy{
  "version": "2.0",
  "extensionBundle": {
    "id": "Microsoft.Azure.Functions.ExtensionBundle",
    "version": "[4.0.0, 5.0.0)"
  }
}

CopyRG="cloud-receipt-lab"
REGION="australiaeast"  # confirm with: az functionapp list-flexconsumption-locations
SUFFIX="$RANDOM$RANDOM"
STORAGE="crlab${SUFFIX}"          # lowercase, max 24 chars
APP="cloud-receipt-${SUFFIX}"     # globally unique DNS name

az login
az account show --output table
az group create --name "$RG" --location "$REGION"
az storage account create --name "$STORAGE" --resource-group "$RG" \
  --location "$REGION" --sku Standard_LRS --allow-blob-public-access false

STORAGE_ID=$(az storage account show -g "$RG" -n "$STORAGE" --query id -o tsv)
ME=$(az ad signed-in-user show --query id -o tsv)
az role assignment create --assignee-object-id "$ME" --assignee-principal-type User \
  --role "Storage Blob Data Contributor" --scope "$STORAGE_ID"
az storage container create --account-name "$STORAGE" --name receipts --auth-mode login

az functionapp create --resource-group "$RG" --name "$APP" \
  --storage-account "$STORAGE" --flexconsumption-location "$REGION" \
  --runtime python --runtime-version 3.12 --functions-version 4

APP_PRINCIPAL=$(az functionapp identity assign -g "$RG" -n "$APP" \
  --query principalId -o tsv)
az role assignment create --assignee-object-id "$APP_PRINCIPAL" \
  --assignee-principal-type ServicePrincipal \
  --role "Storage Blob Data Contributor" --scope "$STORAGE_ID"
az functionapp config appsettings set -g "$RG" -n "$APP" \
  --settings RECEIPTS_ACCOUNT="$STORAGE"

func azure functionapp publish "$APP"
URL=$(func azure functionapp list-functions "$APP" --show-keys \
  | grep -Eo 'https://[^ ]+' | head -1)
curl -sS -X POST "$URL" -H 'content-type: application/json' \
  -d '{"item":"field-guide","amount":12.50}'
az storage blob list --account-name "$STORAGE" --container-name receipts \
  --auth-mode login --output table

az group delete --name "$RG"  # removes every resource in this lab group

Copyimport json, logging, os, uuid
from flask import Flask, jsonify, request
from google.cloud import storage

app = Flask(__name__)
client = storage.Client()

@app.post("/")
def create_receipt():
    body = request.get_json(silent=True) or {}
    if not {"item", "amount"} <= body.keys():
        return jsonify(error="item and amount required"), 400
    receipt_id = str(uuid.uuid4())
    receipt = {"id": receipt_id, "item": body["item"], "amount": body["amount"]}
    blob = client.bucket(os.environ["RECEIPTS_BUCKET"]).blob(
        f"receipts/{receipt_id}.json"
    )
    blob.upload_from_string(json.dumps(receipt), content_type="application/json")
    logging.info("stored receipt %s", receipt_id)
    return jsonify(receipt), 201

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=int(os.environ.get("PORT", "8080")))

CopyFlask
gunicorn
google-cloud-storage

Copyweb: gunicorn --bind :$PORT main:app

CopyPROJECT_ID="your-project-id"
REGION="australia-southeast1"
BUCKET="${PROJECT_ID}-receipt-lab"
SERVICE_ACCOUNT="receipt-writer@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud auth login
gcloud config set project "$PROJECT_ID"
gcloud services enable run.googleapis.com cloudbuild.googleapis.com \
  artifactregistry.googleapis.com

gcloud storage buckets create "gs://$BUCKET" --location="$REGION" \
  --uniform-bucket-level-access --public-access-prevention
gcloud iam service-accounts create receipt-writer \
  --display-name="Receipt Box runtime"
gcloud storage buckets add-iam-policy-binding "gs://$BUCKET" \
  --member="serviceAccount:${SERVICE_ACCOUNT}" \
  --role="roles/storage.objectCreator"

gcloud run deploy receipt-box --source . --region "$REGION" \
  --service-account "$SERVICE_ACCOUNT" \
  --set-env-vars "RECEIPTS_BUCKET=$BUCKET" --allow-unauthenticated

URL=$(gcloud run services describe receipt-box --region "$REGION" \
  --format='value(status.url)')
curl -sS -X POST "$URL" -H 'content-type: application/json' \
  -d '{"item":"field-guide","amount":12.50}'
gcloud storage ls "gs://$BUCKET/receipts/"
gcloud run services logs read receipt-box --region "$REGION" --limit 20

gcloud run services delete receipt-box --region "$REGION"
gcloud storage rm --recursive "gs://$BUCKET"
gcloud iam service-accounts delete "$SERVICE_ACCOUNT"
# Also inspect/delete the cloud-run-source-deploy Artifact Registry repository.

Copy%sql
CREATE SCHEMA IF NOT EXISTS workspace.cloud_lab;
CREATE VOLUME IF NOT EXISTS workspace.cloud_lab.inbox;

Copy%python
import json

receipts = [
    {"id":"r-001", "item":"field-guide", "amount":12.50,
     "created_at":"2026-08-03T09:00:00Z"},
    {"id":"r-002", "item":"notebook", "amount":7.25,
     "created_at":"2026-08-03T10:30:00Z"},
]
path = "/Volumes/workspace/cloud_lab/inbox/receipts.jsonl"
dbutils.fs.put(path, "\n".join(json.dumps(r) for r in receipts), True)
print(path)

Copy%sql
CREATE OR REPLACE TABLE workspace.cloud_lab.receipts_bronze
USING DELTA AS
SELECT
  CAST(id AS STRING) AS id,
  CAST(item AS STRING) AS item,
  CAST(amount AS DECIMAL(10,2)) AS amount,
  CAST(created_at AS TIMESTAMP) AS created_at
FROM json.`/Volumes/workspace/cloud_lab/inbox/receipts.jsonl`;

CREATE OR REPLACE TABLE workspace.cloud_lab.receipts_daily
USING DELTA AS
SELECT date(created_at) AS receipt_date,
       count(*) AS receipt_count,
       sum(amount) AS revenue
FROM workspace.cloud_lab.receipts_bronze
GROUP BY date(created_at);

SELECT * FROM workspace.cloud_lab.receipts_daily;

CopyGRANT USE CATALOG ON CATALOG workspace TO `cloud-lab-readers`;
GRANT USE SCHEMA ON SCHEMA workspace.cloud_lab TO `cloud-lab-readers`;
GRANT SELECT ON TABLE workspace.cloud_lab.receipts_daily TO `cloud-lab-readers`;

-- Teardown: this removes managed tables, the volume, and its managed files.
DROP SCHEMA workspace.cloud_lab CASCADE;

A working endpoint is the beginning, not the finish.

The labs prove resource creation, runtime identity, data access, invocation, observability, and teardown. A production service adds explicit engineering around every failure mode the toy ignores.

The architecture progression

The market is bigger than four brand names.

The latest available Stack Overflow survey still treats cloud development as a broad tool category, while CNCF’s 2025 survey reports Kubernetes in production at 82% among container-using respondents. The practical implication: learn one base cloud deeply, but keep portable concepts—containers, Kubernetes, Terraform, SQL, identity federation, and observability—in your core toolkit.

“In demand” depends on role and geography: platform engineers see Kubernetes/Terraform; enterprise developers see Azure; data engineers see Databricks/Snowflake/Fabric; product teams may see Cloudflare or developer PaaS. Validate against actual job descriptions in your target market.

Six weeks from vocabulary to evidence.

The goal is not console fluency. It is the ability to explain, deploy, debug, secure, observe, cost, and delete one small workload—and then translate it.

Questions you should be able to answer without a console

• What is the administrative, billing, region, network, and data scope of this resource?
• Which identity deploys it, which identity runs it, and which identity reads its output?
• Which exact action is allowed on which exact resource path—and what higher-level guardrail can still deny it?
• Is the endpoint public, private, or service-internal? How does DNS resolve from the workload?
• Where do logs, metrics, traces, audit events, build artifacts, and cost allocation data go?
• What persists after compute stops? What happens if a zone or region fails?
• What command or pull request recreates it? What command safely deletes it?

The words behind the products.

Research trail.

Reviewed against current official documentation on 3 August 2026. Cloud documentation changes continuously; follow the linked setup page before deploying, especially for runtimes, free offers, region availability, and preview features.