Cloud architecture
Importance: Essential (5 of 5)
Selects cloud service patterns that satisfy availability, scalability, and cost constraints.
← All career guides9 of 9 skills61 of 61 courses
Infrastructure and operations
Cloud Engineer
Designs, provisions, secures, and operates cloud infrastructure and managed services.
Skill coverage
100%
Course coverage
100%
Skill coverage shows how much of the role's capability map already has a published course. Course coverage shows how much of the mapped course pipeline for this role has shipped.
- Role skills
- 9
- Published coverage
- 9
- Relevant courses
- 61
Capability map
Skills
Importance describes how central each capability is to the role. Course coverage shows where you can build the skill in the current OpenSkills catalog.
Cloud architecture: 8 more courses
Cloud networking: 4 more courses
Cloud security: 4 more courses
Cloud storage: 3 more courses
Cloud compute: 9 more courses
Container orchestration: 1 more course
Cloud operations: 4 more courses
Infrastructure as code: 3 more courses
Observability: 1 more course
Cloud Engineer capability map
01
Cloud foundations
5 capabilities
Cloud networking
Importance: Essential (5 of 5)
Designs connectivity, traffic flow, and isolation for cloud workloads.
Cloud security
Importance: Essential (5 of 5)
Applies identity, least privilege, workload protection, and policy controls.
Cloud storage
Importance: Very important (4 of 5)
Selects and operates durable storage for workload requirements.
Cloud compute
Importance: Essential (5 of 5)
Selects and operates virtual-machine, container, and serverless compute services.
02
Cloud operations
4 capabilities
Container orchestration
Importance: Very important (4 of 5)
Deploys and operates cloud-native workloads on orchestrated platforms.
Course coverage
Cloud operations
Importance: Essential (5 of 5)
Maintains service health, capacity, upgrades, and recovery procedures.
Infrastructure as code
Importance: Essential (5 of 5)
Provisions cloud resources through reviewed and reproducible definitions.
Observability
Importance: Very important (4 of 5)
Uses cloud and workload telemetry to diagnose behavior and failures.
Learning path
Relevant courses
Core foundations
The concepts this role is built on.
Supporting knowledge
Adjacent knowledge that improves day-to-day judgment.
- Cloud Cost Allocation
- Cloud Cost Management
- Cloud Cost Optimization
- Cloud Databases
- Cloud Forecasting and Budgeting
- Cloud Migration
- Cloud Native Architecture
- Cloud Native Fundamentals
- Cloud Native Networking
- Cloud Native Observability
- Cloud Native Security
- Cloud Native Storage
- Container FundamentalsFree
- Docker FundamentalsFree
- Edge Computing
- FinOps FundamentalsFree
- Google Cloud Compute
- Google Cloud Identity
- Google Cloud Networking
- Google Cloud Storage
- HashiCorp Consul
- Hybrid Cloud Architecture
- Immutable Infrastructure
- Kubernetes FundamentalsFree
- Kubernetes Observability
- Kubernetes Operations
- Kubernetes Workloads
- Microsoft Azure Compute
- Microsoft Azure Identity
- Microsoft Azure Networking
- Microsoft Azure Storage
- Multi-Cloud Architecture
- Observability FundamentalsFree
- OpenTofu Fundamentals
- Packer Fundamentals
- Pulumi Fundamentals
- Serverless Computing
- Terraform Fundamentals
- Unit Economics for Cloud Services
Specializations
Deeper paths for particular environments or directions.
HOWTOs
Concrete operational procedures from the courses on this page.
- How to migrate a relational database to Amazon RDS or Aurora with DMS at near-zero downtime
Moving a live relational database onto RDS or Aurora with an AWS DMS full-load-and-CDC task: the schema and index work around the load, the CDC latency gate that decides when a cutover is safe, and the reverse replication path that keeps rollback open.
AWS Databases
- How to restore an Amazon RDS or Aurora database to a point in time after data corruption
Recovering from a bad write by restoring RDS or Aurora point-in-time recovery into a new instance beside the untouched source, validating the restore time, and choosing between a full cutover and a selective repair.
AWS Databases
- How to contain a leaked cloud access key or compromised cloud identity
Disabling the credential, revoking the temporary sessions it already started, and scoping the principals, identity providers, and resources an attacker may have created for persistence, across AWS, Microsoft Entra, and Google Cloud.
Cloud Security
- How to scope and contain a compromised cloud compute instance
Isolating one compromised virtual machine without destroying evidence: the order of memory capture, disk snapshots, network isolation, and revoking the instance's own cloud credentials, then rebuilding from a known-good image rather than cleaning in place.
Cloud Security
- How to rotate the Consul gossip encryption key
Replacing the shared Serf gossip key on a running datacenter without partitioning any agent, and what changes when the datacenters are WAN-federated.
HashiCorp Consul
- How to restore a Consul cluster from a Raft snapshot after quorum loss
Recovering a Consul server cluster that has lost quorum, and where the peers.json Raft rebuild ends and a consul snapshot restore begins.
HashiCorp Consul
- How to bootstrap ACLs on a running Consul cluster without an outage
Turning on the Consul ACL system on a datacenter that has none without a service-discovery outage, and why the permissive-first, deny-last order matters.
HashiCorp Consul
- How to upgrade a production Kubernetes cluster one minor version
Moving a self-managed kubeadm cluster forward one Kubernetes minor version, including the version-skew rules and pre-flight checks that decide whether the upgrade can proceed at all.
Kubernetes Operations
- How to drain and replace a worker node safely
Taking a worker node out of service for disruptive work or retirement without breaching any workload's availability guarantee, and returning it or removing it cleanly afterward.
Kubernetes Operations
- How to renew expiring kubeadm control-plane certificates
Renewing the one-year kubeadm control-plane certificates before they expire, and the offline recovery path for a cluster whose certificates have already lapsed and whose API server is down.
Kubernetes Operations
- How to rebuild a Kubernetes control plane from an etcd snapshot
The last-resort recovery when etcd data is lost or corrupt beyond quorum: replacing entire cluster state from a snapshot, with the data-loss and reconciliation consequences that come with it.
Kubernetes Operations
- How to migrate deprecated Kubernetes API usage before an upgrade
Clearing an upgrade blocker by locating every client, manifest, and controller still calling a Kubernetes API version the next minor removes, and proving the usage is gone before the upgrade.
Kubernetes Operations
Put the map to work
Find Cloud Engineer roles.
Search multiple job sources at once with queries tailored to this career, then use the skill map above to evaluate what each role actually asks for.