Computer Science · 9th Grade · The Architecture of the Internet · Weeks 10-18

Risks and Dependencies of Cloud Infrastructure

Students will analyze the risks of relying on a small number of companies for cloud infrastructure.

• Common Core State Standards
• CSTA: 3A-NI-04
• CSTA: 3A-CS-01

About This Topic

The global cloud market is concentrated among a small number of providers: Amazon Web Services, Microsoft Azure, and Google Cloud Platform together hold approximately 65-70% of the market. For 9th graders, understanding this concentration means understanding a single point of failure risk at global scale. When AWS's us-east-1 region experienced an outage in December 2021, it brought down Slack, Epic Games, Coinbase, and portions of airline reservation systems simultaneously. A technical failure in one data center rippled across millions of users and hundreds of unrelated companies.

This concentration creates a form of infrastructure dependency with no historical precedent. Organizations that built their operations on a single cloud provider have often discovered, during an outage, that their disaster recovery plan was also hosted with the same provider. True resilience requires geographic distribution and multi-cloud architecture -- running critical workloads across more than one provider so that a failure in one does not bring everything down.

The policy implications are significant: should critical national infrastructure be allowed to concentrate this way? Active learning works well here because the risks are concrete, and students can map their own digital dependencies -- often surprising themselves with how many services trace back to the same few providers.

Key Questions

1. Critique the risks of relying on a small number of companies for cloud infrastructure.
2. Predict the impact of a major cloud service outage on global operations.
3. Justify the need for redundancy and disaster recovery plans in cloud architecture.

Learning Objectives

• Analyze the market concentration of major cloud infrastructure providers and identify the associated risks.
• Evaluate the potential impact of a widespread cloud service outage on interconnected global businesses and services.
• Justify the necessity of multi-cloud strategies and disaster recovery plans for ensuring digital resilience.
• Critique the policy implications of critical national infrastructure relying on a limited number of private cloud providers.

Before You Start

Basic Internet Infrastructure

Why: Students need a foundational understanding of how data travels and where services are hosted to grasp the concept of cloud infrastructure.

Introduction to Client-Server Model

Why: Understanding how clients request services from servers is essential for comprehending how cloud providers serve numerous users and applications.

Key Vocabulary

Cloud Infrastructure	The hardware and software components that provide cloud computing services, including servers, storage, and networking, managed by providers like AWS, Azure, and GCP.
Market Concentration	A situation where a large portion of the market share is controlled by a small number of companies, leading to potential dependencies.
Single Point of Failure	A component or system whose failure would cause the entire system to stop functioning, a significant risk with concentrated cloud providers.
Disaster Recovery Plan	A documented process or set of procedures to recover and protect a business's IT infrastructure in the event of a disaster or extended outage.
Multi-Cloud Architecture	The use of cloud computing services from more than one cloud provider to host applications and data, enhancing resilience.

Watch Out for These Misconceptions

Common Misconception

Cloud providers guarantee near-perfect uptime, so outages are not a real concern.

What to Teach Instead

Major cloud providers' SLAs typically guarantee 99.9% to 99.99% uptime -- which still permits 8 to 52 hours of downtime per year. SLAs provide credits, not prevention. The case study analysis puts real outage data in front of students, replacing theoretical guarantees with documented reality.

Common Misconception

Having a backup stored in the cloud means you are protected from cloud outages.

What to Teach Instead

If your backup is in the same cloud region as your primary system, an outage affects both simultaneously. True resilience requires geographic or provider separation. The disaster recovery design challenge forces students to grapple with this directly when designing cross-region or multi-cloud architectures.

Active Learning Ideas

Dependency Mapping: Your Digital Day

Students list every digital service they used in the past 24 hours. Using a provider lookup guide, they trace each service to its underlying cloud provider. The class aggregates results on a shared board, revealing how concentrated their collective digital lives actually are.

30 min·Whole Class

Case Study Analysis: The AWS Outage

Groups analyze the December 2021 AWS us-east-1 outage: what failed, which services went down, and why. They map the organizational response and identify which companies had adequate redundancy versus those that were completely offline. Each group proposes what adequate redundancy would have required.

35 min·Small Groups

Design Challenge: Disaster Recovery Architecture

Groups receive a scenario: 'You are the CTO of a hospital. Your electronic health record system runs on a single AWS region.' They design a disaster recovery plan meeting a 4-hour recovery time objective, justify their architectural choices, and estimate the approximate cost increase.

40 min·Small Groups

Socratic Seminar: Should Governments Regulate Cloud Concentration?

Students read two short articles before class: one arguing for regulatory intervention on critical cloud dependencies, one arguing market forces will drive adequate redundancy. The student-led seminar explores what counts as critical infrastructure and who bears responsibility for outages.

35 min·Whole Class

Real-World Connections

• In December 2021, an outage in AWS's us-east-1 region affected services like Slack, Coinbase, and even parts of airline reservation systems, illustrating the widespread impact of a single provider's failure.
• Companies like Netflix and Spotify, which rely heavily on cloud services, invest significantly in multi-cloud strategies and robust disaster recovery to ensure continuous operation for millions of users worldwide.

Assessment Ideas

Discussion Prompt

Pose the question: 'Imagine your school's learning management system (like Canvas or Google Classroom) is hosted by one of the major cloud providers. What are two specific risks if that provider experiences a major, multi-day outage?' Facilitate a class discussion to explore student responses.

Quick Check

Provide students with a short list of popular online services (e.g., streaming video, social media, online gaming). Ask them to research and identify which of the top three cloud providers (AWS, Azure, GCP) likely hosts each service, then discuss the implications of this dependency.

Exit Ticket

Ask students to write one sentence explaining why relying on a single cloud provider can be risky, and one sentence describing a strategy to mitigate that risk. Collect these to gauge understanding of dependency and resilience.

Frequently Asked Questions

Why does it matter that only a few companies control most cloud infrastructure?

Concentration means a single failure point can affect millions of unrelated services simultaneously. Organizations that chose the same provider for efficiency ended up sharing failure modes they did not know they had. Regulatory frameworks for financial and power infrastructure exist for exactly this reason -- cloud infrastructure is facing analogous questions.

What is a Service Level Agreement (SLA)?

An SLA is a contractual commitment from a cloud provider about uptime, performance, and support response times. It specifies compensation if the provider misses targets. A 99.9% uptime SLA permits roughly 8.7 hours of downtime per year -- significant for critical systems, and a useful starting point for discussing what resilience actually requires.

What is multi-cloud architecture?

Multi-cloud means running workloads across more than one cloud provider so a failure at one provider does not take down the entire system. It adds operational complexity and cost but eliminates single-provider dependency. Organizations with genuinely critical uptime requirements -- financial markets, healthcare, emergency services -- commonly use this approach.

How does active learning help students understand cloud dependency risks?

Abstract risk is hard to take seriously. When students trace their own daily apps to underlying cloud providers and discover that many services they use depend on the same AWS region, the concentration risk becomes personal. That concrete personal mapping produces a different level of engagement than reading about enterprise risk in a textbook.