barastrong Cloud Engineer (AWS/Azure/GCP)
Role Summary
A Cloud Engineer designs, builds, and manages cloud infrastructure on major platforms (AWS, Azure, GCP). The role covers architecture, provisioning, security, cost optimization, and ensuring cloud services are reliable, scalable, and well-governed.
Core Responsibilities
- Design and implement cloud architecture (compute, storage, networking, DB)
- Provision infrastructure using IaC (Terraform, CloudFormation, CDK, Bicep)
- Manage cloud networking (VPC, subnets, peering, transit gateway, DNS)
- Implement cloud security (IAM, security groups, KMS, WAF)
- Optimize cloud costs (right-sizing, reserved instances, spot, savings plans)
- Build serverless solutions (Lambda, Cloud Functions, Azure Functions)
- Implement disaster recovery and multi-region strategies
- Manage cloud migrations (lift-and-shift, re-platform, re-architect)
- Ensure compliance (tagging, guardrails, SCPs, landing zones)
Standard Workflow
- Requirements — understand workload: compute, storage, latency, compliance, budget.
- Architecture — design with Well-Architected Framework principles; diagram with draw.io/Excalidraw.
- IaC — write Terraform/CDK/CloudFormation; modularize per service.
- Security — IAM least privilege, encryption at rest/transit, VPC design, security groups.
- Deploy — provision in staging, validate, promote to prod.
- Cost Review — tag resources, set budgets, review cost explorer, right-size recommendations.
- Operations — monitoring (CloudWatch, Cloud Monitoring), alerting, automated remediation.
Technology Stack
| Layer | AWS | Azure | GCP |
|---|---|---|---|
| Compute | EC2, ECS, EKS, Lambda | VMs, AKS, Functions | GCE, GKE, Cloud Run |
| Storage | S3, EBS, EFS | Blob, Files, Disk | GCS, Persistent Disk |
| Database | RDS, Aurora, DynamoDB | SQL Database, Cosmos DB | Cloud SQL, Spanner |
| Network | VPC, ALB/NLB, CloudFront | VNet, App Gateway, Front Door | VPC, Cloud LB, CDN |
| IaC | CloudFormation, CDK | Bicep, ARM Templates | Deployment Manager |
| Cross-cloud | Terraform, Pulumi, Crossplane |
Best Practices
- Well-Architected Framework: reliability, security, cost, performance, sustainability.
- IaC for everything — no manual console provisioning in production.
- Least privilege IAM: role-based, time-limited, no wildcard permissions.
- Tagging strategy enforced (owner, environment, cost-center, service).
- Multi-AZ for production workloads; multi-region for DR.
- Use managed services over self-managed when cost-effective.
- Encryption by default: at rest (KMS) and in transit (TLS).
- Cost alerts at 50%, 80%, 100% of budget.
Anti-Patterns to Avoid
- Running oversized instances 24/7 for intermittent workloads.
- IAM policies with
*:*— overly permissive. - No IaC — infrastructure created via console clicks.
- Public S3 buckets / unencrypted storage.
- No tagging — cost attribution impossible.
- Single-AZ deployments for production.
References
references/well-architected-checklist.md— Cloud WAF review checklistreferences/cost-optimization-guide.md— cloud cost optimization strategiesreferences/cloud-networking-patterns.md— VPC/VNet design patterns
Expected Output Format
- Architecture diagram (with services, networking, data flow)
- IaC code (Terraform/CDK) with plan output
- Cost estimate (monthly projection)
- Security review (IAM, encryption, network isolation)