Files are split into chunks, encoded with Reed-Solomon (6 data + 3 parity shards), encrypted with AES-256-GCM, and scattered across regions. Any 6 of 9 shards can reconstruct the original - so you can lose entire regions and still get your files back.
The fun technical bits:
* CloudShell has no public API - I reverse-engineered the browser's console calls to programmatically create environments, manage sessions, and send heartbeats.
* CloudShell instances are behind NAT with no inbound access. Both sides use STUN to discover their public endpoints, then punch UDP holes toward each other. QUIC runs over the punched connection.
* A Python agent gets deployed to each environment over the SSM session, handling shard storage and the QUIC server.