Senior Cloud Architect

Senior Cloud Architect

Expert cloud architecture and infrastructure design across AWS, GCP, and Azure — production-grade VPC/compute/database topologies, cost optimization, disaster recovery, and security posture auditing.

Keywords

cloud, aws, gcp, azure, terraform, infrastructure, vpc, eks, ecs, lambda, cost-optimization, disaster-recovery, multi-region, iam, security, migration

Core Capabilities

• Production architecture design — Terraform VPC, multi-AZ ECS/EKS behind ALB, RDS Multi-AZ, ElastiCache, layered WAF/NACL/SG security.
• Multi-cloud comparison — map equivalent compute, serverless, storage, database, ML, and CDN services across AWS, GCP, and Azure.
• Cost optimization — right-sizing, Reserved Instances/Savings Plans/Spot selection, cost-allocation tagging, budget alerting.
• Disaster recovery — Backup/Pilot Light/Warm Standby/Multi-Site strategy selection against RTO/RPO, cross-region replication, Route 53 failover.
• Security posture — CIS benchmark audits, network segmentation, least-privilege IAM with conditions, encryption at rest and in transit.
• Well-Architected reviews — checklist across all six pillars (operational excellence, security, reliability, performance, cost, sustainability).

When to Use

• Designing a new production cloud architecture or migration.
• Reducing cloud spend or planning reserved capacity.
• Planning or testing disaster recovery and failover.
• Auditing security posture against CIS benchmarks.
• Comparing AWS / GCP / Azure for a workload.

Clarify First

Before designing the architecture, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• [ ] Target cloud(s) — AWS / GCP / Azure or multi-cloud (every topology, service mapping, and Terraform differs)
• [ ] Workload profile & scale — traffic, statefulness, and compute type (drives the VPC / compute / database topology and sizing)
• [ ] RTO/RPO targets — recovery objectives (selects Backup / Pilot Light / Warm Standby / Multi-Site DR)
• [ ] Budget / cost constraint — the spend ceiling (drives right-sizing and Reserved vs Savings Plan vs Spot)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• [references/cloud-architecture-playbooks.md](references/cloud-architecture-playbooks.md) — quick-start commands, the cloud platform comparison matrix, the four end-to-end workflows (AWS architecture, cost optimization, DR planning, security audit) with Terraform/IAM/cost code, and the AWS Well-Architected checklist. Read when designing, optimizing, or auditing an architecture.
• [references/cloud-operations.md](references/cloud-operations.md) — troubleshooting table (latency, state locks, failover, IAM, cost spikes, peering, replication) and the architecture success criteria. Read when diagnosing an issue or defining the quality bar.

Scope & Limitations

This skill covers:

• Multi-cloud architecture design and comparison across AWS, GCP, and Azure
• Infrastructure-as-Code with Terraform including VPC, compute, database, and networking
• Disaster recovery planning, cross-region replication, and failover strategies
• Cloud cost optimization, right-sizing, and reserved capacity planning

This skill does NOT cover:

• Application-level code architecture or microservice design patterns (see senior-architect)
• Kubernetes cluster internals, pod scheduling, or service mesh configuration (see senior-devops)
• Security compliance frameworks beyond CIS benchmarks such as SOC 2, HIPAA, or GDPR (see ra-qm-team/ compliance skills)
• CI/CD pipeline design, build automation, or deployment workflows (see senior-devops)

Integration Points

Cloud Architecture Playbooks

Read this when designing a cloud architecture, optimizing cost, planning disaster recovery, or auditing security posture — the quick-start commands, platform comparison, the four end-to-end workflows, and the Well-Architected checklist.

Quick Start

# Analyze infrastructure costs
python scripts/cost_analyzer.py --account production --period monthly

# Run DR validation
python scripts/dr_test.py --region us-west-2 --type failover

# Audit security posture
python scripts/security_audit.py --framework cis --output report.html

# Generate resource inventory
python scripts/inventory.py --accounts all --format csv

Tools

Cloud Platform Comparison

Workflow 1: Design a Production AWS Architecture

1. Define requirements -- Identify compute, storage, database, and networking needs. Determine RTO/RPO targets. 2. Provision VPC with Terraform:

   module "vpc" {
     source  = "terraform-aws-modules/vpc/aws"
     version = "~> 5.0"
     name    = "${var.project}-${var.environment}"
     cidr    = var.vpc_cidr
     azs             = ["${var.region}a", "${var.region}b", "${var.region}c"]
     private_subnets = var.private_subnets
     public_subnets  = var.public_subnets
     enable_nat_gateway   = true
     single_nat_gateway   = var.environment != "production"
     enable_dns_hostnames = true
     tags = local.common_tags
   }

3. Deploy compute -- ECS/EKS in private subnets behind an ALB in public subnets. Use at least 2 AZs for redundancy. 4. Configure database -- RDS Multi-AZ for production, single-AZ for staging. Set backup retention to 30 days (production) or 7 days (non-production). 5. Add caching layer -- ElastiCache (Redis) between application and database. 6. Layer security -- WAF on CloudFront, NACLs on subnets, security groups on instances. Apply least-privilege IAM. 7. Validate -- Run python scripts/security_audit.py --framework cis and resolve all high-severity findings.

Reference Architecture

Route 53 (DNS) -> CloudFront + WAF -> ALB
  -> ECS/EKS Cluster (AZ-a) + ECS/EKS Cluster (AZ-b)
    -> ElastiCache (Redis)
      -> RDS Multi-AZ (Primary + Standby)

Workflow 2: Optimize Cloud Costs

1. Audit current spend -- python scripts/cost_analyzer.py --account production --period monthly 2. Right-size instances -- Identify instances with avg CPU <10% and max CPU <30% as downsize candidates:

   # Pseudocode for right-sizing logic
   if avg_cpu < 10 and max_cpu < 30:
       recommendation = 'downsize'
   elif avg_cpu > 80:
       recommendation = 'upsize'
   else:
       recommendation = 'optimal'

3. Convert steady-state workloads to Reserved Instances or Savings Plans:

4. Enforce cost allocation tags -- Require Environment, Project, Owner, CostCenter on all resources. Alert on untagged resources after 24 hours. 5. Validate -- Re-run cost analyzer and confirm savings target achieved.

Workflow 3: Plan Disaster Recovery

1. Select DR strategy based on RTO/RPO requirements:

2. Configure cross-region replication -- Database replication to secondary region. S3 cross-region replication for object storage. 3. Set up Route 53 failover routing -- Health checks on primary. Automatic DNS failover to secondary. 4. Define backup policy:

• Database: continuous replication, 35-day retention, cross-region, encrypted
• Application data: daily, 90-day retention, lifecycle to IA at 30d, Glacier at 90d
• Configuration: on-change via git + S3, unlimited retention

5. Test -- python scripts/dr_test.py --region us-west-2 --type failover and confirm RTO/RPO targets met.

Workflow 4: Audit Security Posture

1. Run audit -- python scripts/security_audit.py --framework cis --output report.html 2. Review network segmentation -- Public subnets contain only NAT GW, ALB, bastion. Private subnets contain application tier. Data subnets contain RDS, Redis, Elasticsearch. 3. Enforce least-privilege IAM -- Every policy scoped to specific resources and conditions:

   {
     "Effect": "Allow",
     "Action": ["s3:GetObject", "s3:PutObject"],
     "Resource": "arn:aws:s3:::my-bucket/uploads/*",
     "Condition": {
       "StringEquals": { "aws:PrincipalTag/Team": "engineering" },
       "IpAddress": { "aws:SourceIp": ["10.0.0.0/8"] }
     }
   }

4. Verify encryption -- Data encrypted at rest (KMS) and in transit (TLS 1.2+). 5. Validate -- Re-run audit and confirm all critical and high findings resolved.

AWS Well-Architected Pillars (Decision Checklist)

• Operational Excellence: IaC everywhere? Monitoring and alerting? Runbooks for incidents?
• Security: Least-privilege IAM? Encryption at rest and in transit? VPC segmentation?
• Reliability: Multi-AZ? Auto-scaling? DR tested?
• Performance: Right-sized instances? Caching layer? CDN for static assets?
• Cost Optimization: Reserved capacity for steady-state? Spot for batch? Unused resources cleaned?
• Sustainability: Efficient regions? Right-sized compute? Data lifecycle policies?

Cloud Operations — Troubleshooting & Success Criteria

Read this when a cloud deployment is misbehaving (latency, state locks, failover, IAM, cost spikes, peering, replication) or when defining the success bar for an architecture.

Troubleshooting

Success Criteria

• 99.99% availability SLA met across all production workloads with documented uptime reports
• Cost optimization savings above 25% compared to on-demand baseline through Reserved Instances, Savings Plans, and right-sizing
• RTO < 15 minutes and RPO < 1 minute validated through quarterly DR failover tests
• Zero critical CIS benchmark findings in production accounts after security audit remediation
• Infrastructure drift < 2% measured by Terraform plan diffs on scheduled compliance scans
• Cross-region failover completes within 60 seconds with automated Route 53 health check validation
• 100% resource tagging compliance enforced via automated policy checks with no untagged resources older than 24 hours