Cloud Engineer

Cloud Engineer

When to Use

• Design account/subscription/project layout, landing zones, and guardrails
• Implement VPC/VNet topology—subnets, routing, NAT, peering, PrivateLink/PSC
• Configure compute—VMs, instance groups, autoscaling, spot/preemptible strategy
• Stand up managed data—RDS/Cloud SQL, ElastiCache, object storage lifecycle
• Deploy serverless and messaging—Lambda, Cloud Functions, queues, topics, event buses
• Wire DNS, TLS, CDN, WAF at the cloud edge (with security review)
• Define IAM roles, policies, workload identity, and cross-account access
• Plan multi-AZ resilience, backups, restore drills, and regional failover
• Enforce tagging, budgets, quotas, and cost visibility
• Troubleshoot cloud service errors (throttling, permissions, networking, quotas)

When NOT to Use

• Build or fix CI/CD pipelines, GitOps controllers, delivery SLOs → devops
• Bootstrap K8s clusters, Helm releases, in-cluster RBAC → cluster-deployment-engineer
• Golden paths, developer portals, platform roadmap → platform-engineer
• Canary/blue-green rollout and change tiers → deployment-strategist
• Pipeline SAST, SBOM, admission policies → devsecops
• Corporate IdP, KMS program, SIEM integration → information-security-engineer
• Entitlement models, access reviews, federation, PAM → iam-specialist
• Cloud reference architecture, landing zone, migration roadmap → cloud-architect
• Cloud program strategy, CCoE charter, EA commercial frame → vp-of-cloud
• Cross-system architecture review and ADRs → senior-system-architecture
• Facility power, cooling, rack layout → data-center-design-execution-lead
• GPU/compute supply and stranded kW programs → data-center-compute-supply-efficiency
• FinOps accounting close and capex controls → compute-accounting-manager
• Cloud cost analysis, budgets, rightsizing, commitment recommendations → finops-analyst
• Day-2 access tickets, patching, backup restores, alert runbooks → cloud-system-administrator
• Customer discovery, RFP technical response, PoC scoping → solutions-architect

Related skills

Core Workflows

1. Cloud foundation and networking

Accounts, VPC/VNet, connectivity.

See `references/cloud_architecture_foundation.md`.

2. Compute and serverless

VMs, scaling groups, functions.

See `references/compute_and_serverless.md`.

3. Storage and data services

Object, block, managed DB, cache.

See `references/storage_and_data_services.md`.

4. IAM and identity

Roles, federation, least privilege.

See `references/cloud_iam_identity.md`.

5. Reliability and DR

Backups, multi-region, runbooks.

See `references/reliability_dr_multiregion.md`.

6. Cost and operations

Tagging, budgets, troubleshooting.

See `references/cost_operations_runbooks.md`.

Outputs

• Architecture sketch — accounts, networks, data flows
• IaC snippets or console checklist — resources with naming and tags
• IAM policy draft — actions, resources, conditions (security review before apply)
• Runbook — failure modes, rollback, restore steps
• Cost note — drivers, rightsizing or reservation options

Principles

• Least privilege — scoped roles per workload; no long-lived admin keys in apps
• Private by default — public endpoints only with explicit approval
• Immutable infrastructure — prefer replace over snowflake SSH fixes
• Tag everything — owner, env, cost center, data classification
• Measure before multi-region — complexity tax must match RTO/RPO

Cloud architecture foundation

Table of contents

1. Account structure 2. Network topology 3. Connectivity patterns 4. Naming and environments

Account structure

Apply SCPs or org policies: deny public S3, restrict regions, require encryption.

Document break-glass admin access and approval.

Network topology

Standard hub-spoke or multi-VPC:

• Private subnets for workloads; public only for ingress/NAT
• Three AZ minimum for production stateful tiers when available
• Route tables explicit; no 0.0.0.0/0 from private without NAT or egress firewall
• DNS — private zones for internal names; avoid hard-coded IPs

Provider notes:

Connectivity patterns

• VPC/VNet peering — same region, non-transitive; watch CIDR overlap
• VPN / Direct Connect / ExpressRoute / Interconnect — hybrid
• PrivateLink / PSC / Private Endpoint — SaaS and managed services without public egress
• Egress filtering — centralized NAT with inspection where required

Naming and environments

Convention: {org}-{env}-{region}-{service}-{resource}

Environments: dev, staging, prod — separate accounts or subscriptions where possible.

Promotion: infrastructure changes via PR + plan review; align with devops for app deploy cadence.

For large Terraform module libraries → infrastructure-engineer.

Cloud IAM and identity

Table of contents

1. Role design 2. Federation 3. Workload identity 4. Secrets

Role design

• One role per workload (service, job, function)—not shared admin roles
• Least privilege — start deny-all, add actions with resource ARNs
• Use conditions: aws:SourceAccount, aws:PrincipalArn, IP allowlist where appropriate
• No long-lived access keys for compute; prefer instance/profile or workload identity
• Audit IAM Access Analyzer / policy simulator before prod

Cross-account:

• AssumeRole with external ID for third parties
• Resource policies on buckets/keys where needed

Federation

• Human access via SSO (IAM Identity Center, Google Workspace, Entra ID)
• Break-glass accounts MFA + logging to SIEM — information-security-engineer
• CI/CD OIDC to cloud — implement with devsecops / devops

Workload identity

Map identity to minimum API permissions per service.

Secrets

• Secrets Manager / Secret Manager / Key Vault
• Rotation automated where supported
• Never commit secrets; scan repos — devsecops

KMS keys: separate keys per env; key policy least privilege.

Compute and serverless

Table of contents

1. VM and instance groups 2. Autoscaling 3. Serverless 4. Containers without full platform

VM and instance groups

Harden: IMDSv2 (AWS), metadata restrictions, patch cadence, no SSH from internet.

Autoscaling

• Scale on CPU, memory, custom metric, or queue depth
• Cooldown and min/max bounds to prevent thrash
• Health checks tied to load balancer or managed group
• Load test before prod promotion — performance-engineer for app-level tests

Serverless

Design:

• Idempotent handlers; dead-letter queues
• Secrets from manager, not env in plain text
• VPC attach only when needed (adds cold start / complexity)

Containers without full platform

• ECS/EKS/GKE/AKS service definitions when not doing cluster lifecycle → cluster ops in cluster-deployment-engineer
• Cloud engineer owns service account IAM, subnets, ALB/GLB fronting, and autoscaling policies at cloud API layer

Cost and operations

Table of contents

1. Tagging and chargeback 2. Rightsizing and commitments 3. Quotas and limits 4. Troubleshooting

Tagging and chargeback

Required tags (enforce via policy):

• environment, owner, cost-center, service, data-classification

Use Cost Explorer, Billing budgets, alerts at 80/100% threshold.

Finance close and capex accounting → compute-accounting-manager.

Rightsizing and commitments

• Review idle resources monthly: unattached volumes, old snapshots, oversized instances
• Reserved instances / CUD / savings plans after 30-day stable baseline
• Spot/preemptible for fault-tolerant batch only
• Serverless: tune memory and timeout to actual use

Quotas and limits

• Request quota increases before launch spikes
• Watch API rate limits — exponential backoff in apps
• Service-specific limits (Lambda concurrency, EIP count) in design checklist

Troubleshooting

Capture CloudTrail / Audit Logs / Activity Log correlation ID for incidents.

Hand off application bugs to senior-software-engineer; cluster issues to cluster-deployment-engineer.

Reliability and DR

Table of contents

1. Availability tiers 2. Backups and restore 3. Multi-region 4. Operational drills

Availability tiers

Align with product RTO/RPO from senior-system-architecture or TPM.

Backups and restore

• Automated backups on managed DB and critical volumes
• Cross-region copy for regional disaster only when justified
• Restore drill quarterly: time to restore, data integrity check
• Document runbook — who approves failover, comms template

Multi-region

Active-passive:

• DNS failover (Route 53, Cloud DNS, Traffic Manager)
• Replica DB promote procedure tested
• Data residency — legal before second region

Active-active:

• Conflict resolution, split-brain risk, higher cost
• Global load balancing + replicated stateless tier

Operational drills

• Game day: kill AZ, verify autoscaling and alerts
• Tabletop: regional outage, credential compromise
• Post-drill: update runbooks and IaC gaps

Incident comms → incident-management-engineer if program-level.

Storage and data services

Table of contents

1. Object storage 2. Block and file 3. Managed databases 4. Caches and messaging

Object storage

S3 / GCS / Blob:

• Block public access by default; bucket policies deny Principal: *
• Versioning for prod buckets with lifecycle to IA/Glacier
• Encryption SSE-KMS or CMEK; document key rotation
• Lifecycle rules — expire incomplete multipart uploads
• Cross-region replication only when RPO requires; cost impact

Block and file

EBS / Persistent Disk / Managed Disks:

• Match IOPS/throughput to workload; monitor burst credits
• Snapshots automated; test restore quarterly
• Shared file: EFS, Filestore, Azure Files — security group / firewall scope

Managed databases

RDS / Cloud SQL / Azure Database:

• Multi-AZ for prod; read replicas for read scale
• Parameter groups reviewed; no open 0.0.0.0/0 security groups
• Private subnet + security group source = app tier only
• Backups retention meets RPO; PITR enabled where supported
• Major version upgrades — maintenance window + rollback plan

Data modeling and warehouse design → data-warehouse-engineer.

Caches and messaging

ElastiCache / Memorystore / Azure Cache; SQS/SNS/Pub/Sub/Event Hub:

• Auth via IAM or SAS; TLS in transit
• Queue visibility timeout and DLQ configured
• Topic fan-out subscriptions documented