Cloud Operations
Purpose
You design and change cloud environments with clear account boundaries, network paths, IAM, observability, backup, reliability, and cost implications.
Operational context
- Read
references/workflow.md.
- Identify provider, region, account/project model, workload type, compliance constraints, budget, expected traffic, and availability targets.
- Verify current provider, CLI, API, Terraform provider, service, quota, IAM, and networking documentation before implementation.
Safe change sequence
- Classify the task: landing zone, service design, migration, optimization, hardening, or troubleshooting.
- Model account/project structure, VPC/VNet, subnetting, ingress/egress, IAM boundaries, managed services, backup, logging, and monitoring.
- Compare managed versus self-hosted options when it changes operational risk.
- Implement resources through IaC or documented console/CLI steps with region and quota awareness.
- Validate network paths, permissions, service availability, backup/restore paths, and cost-sensitive assumptions.
Safety rules
- Use Context7 MCP for current cloud, Kubernetes, IaC, CI/CD, container, observability, security, network, API, CLI, provider, and configuration documentation whenever the task depends on external technology behavior.
Change record
Provide provider context, documentation validation status, target architecture, resource implementation, validation plan, security/cost/reliability notes, and assumptions.
Verification
- Do not assume AWS/GCP/Azure parity for other providers.
- Keep human identities, workload identities, and CI identities separate.
- Use least privilege, encryption, central audit logs, labels/tags, and backup policies.
- Call out egress, NAT, load balancer, snapshot, and cross-zone costs when relevant.
Handoff
For resources managed by code, add infrastructure-as-code. For private networking or VPN, add network-vpn-security. For secret flow and IAM hardening, add security-secrets. For production signals, add observability-operations.
References
references/workflow.md for cloud design and validation guidance.
1---2name: cloud-operations3description: Use for cloud architecture and operations across AWS, GCP, Azure, Cloudflare, DigitalOcean, Yandex Cloud, VK Cloud, Selectel, SberCloud, MTS Web Services, IAM, networking, HA/DR, managed services, migration, and cost/risk control.4---56# Cloud Operations78## Purpose910You design and change cloud environments with clear account boundaries, network paths, IAM, observability, backup, reliability, and cost implications.1112## Operational context13141. Read `references/workflow.md`.152. Identify provider, region, account/project model, workload type, compliance constraints, budget, expected traffic, and availability targets.163. Verify current provider, CLI, API, Terraform provider, service, quota, IAM, and networking documentation before implementation.1718## Safe change sequence19201. Classify the task: landing zone, service design, migration, optimization, hardening, or troubleshooting.212. Model account/project structure, VPC/VNet, subnetting, ingress/egress, IAM boundaries, managed services, backup, logging, and monitoring.223. Compare managed versus self-hosted options when it changes operational risk.234. Implement resources through IaC or documented console/CLI steps with region and quota awareness.245. Validate network paths, permissions, service availability, backup/restore paths, and cost-sensitive assumptions.2526## Safety rules2728- Use Context7 MCP for current cloud, Kubernetes, IaC, CI/CD, container, observability, security, network, API, CLI, provider, and configuration documentation whenever the task depends on external technology behavior.2930## Change record3132Provide provider context, documentation validation status, target architecture, resource implementation, validation plan, security/cost/reliability notes, and assumptions.3334## Verification3536- Do not assume AWS/GCP/Azure parity for other providers.37- Keep human identities, workload identities, and CI identities separate.38- Use least privilege, encryption, central audit logs, labels/tags, and backup policies.39- Call out egress, NAT, load balancer, snapshot, and cross-zone costs when relevant.4041## Handoff4243For resources managed by code, add `infrastructure-as-code`. For private networking or VPN, add `network-vpn-security`. For secret flow and IAM hardening, add `security-secrets`. For production signals, add `observability-operations`.4445## References4647- `references/workflow.md` for cloud design and validation guidance.
ashermahonin