# Cloud Engineer

> Use when working with cloud platforms, cloud architecture, cloud migrations, serverless, or managed cloud services. Trigger phrases: "AWS", "Azure", "GCP", "cloud architecture", "cloud migration", "serverless", "Lambda", "S3", "EC2", "CloudFormation", "cloud cost", "VPC", "cloud networking", "managed services", "cloud security", "multi-cloud", "cloud native", "CDK", "cloud storage", "cloud compute".

- Skill: `barastrong/cloud-engineer` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add barastrong/cloud-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barastrong/cloud-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: barastrong (https://skillmd.com/u/barastrong)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barastrong/cloud-engineer

---


# Cloud Engineer (AWS/Azure/GCP)

## Role Summary

A Cloud Engineer designs, builds, and manages cloud infrastructure on major
platforms (AWS, Azure, GCP). The role covers architecture, provisioning,
security, cost optimization, and ensuring cloud services are reliable,
scalable, and well-governed.

## Core Responsibilities

- Design and implement cloud architecture (compute, storage, networking, DB)
- Provision infrastructure using IaC (Terraform, CloudFormation, CDK, Bicep)
- Manage cloud networking (VPC, subnets, peering, transit gateway, DNS)
- Implement cloud security (IAM, security groups, KMS, WAF)
- Optimize cloud costs (right-sizing, reserved instances, spot, savings plans)
- Build serverless solutions (Lambda, Cloud Functions, Azure Functions)
- Implement disaster recovery and multi-region strategies
- Manage cloud migrations (lift-and-shift, re-platform, re-architect)
- Ensure compliance (tagging, guardrails, SCPs, landing zones)

## Standard Workflow

1. **Requirements** — understand workload: compute, storage, latency,
   compliance, budget.
2. **Architecture** — design with Well-Architected Framework principles;
   diagram with draw.io/Excalidraw.
3. **IaC** — write Terraform/CDK/CloudFormation; modularize per service.
4. **Security** — IAM least privilege, encryption at rest/transit, VPC
   design, security groups.
5. **Deploy** — provision in staging, validate, promote to prod.
6. **Cost Review** — tag resources, set budgets, review cost explorer,
   right-size recommendations.
7. **Operations** — monitoring (CloudWatch, Cloud Monitoring), alerting,
   automated remediation.

## Technology Stack

| Layer | AWS | Azure | GCP |
|-------|-----|-------|-----|
| Compute | EC2, ECS, EKS, Lambda | VMs, AKS, Functions | GCE, GKE, Cloud Run |
| Storage | S3, EBS, EFS | Blob, Files, Disk | GCS, Persistent Disk |
| Database | RDS, Aurora, DynamoDB | SQL Database, Cosmos DB | Cloud SQL, Spanner |
| Network | VPC, ALB/NLB, CloudFront | VNet, App Gateway, Front Door | VPC, Cloud LB, CDN |
| IaC | CloudFormation, CDK | Bicep, ARM Templates | Deployment Manager |
| Cross-cloud | Terraform, Pulumi, Crossplane | | |

## Best Practices

- Well-Architected Framework: reliability, security, cost, performance, sustainability.
- IaC for everything — no manual console provisioning in production.
- Least privilege IAM: role-based, time-limited, no wildcard permissions.
- Tagging strategy enforced (owner, environment, cost-center, service).
- Multi-AZ for production workloads; multi-region for DR.
- Use managed services over self-managed when cost-effective.
- Encryption by default: at rest (KMS) and in transit (TLS).
- Cost alerts at 50%, 80%, 100% of budget.

## Anti-Patterns to Avoid

- Running oversized instances 24/7 for intermittent workloads.
- IAM policies with `*:*` — overly permissive.
- No IaC — infrastructure created via console clicks.
- Public S3 buckets / unencrypted storage.
- No tagging — cost attribution impossible.
- Single-AZ deployments for production.

## References

- `references/well-architected-checklist.md` — Cloud WAF review checklist
- `references/cost-optimization-guide.md` — cloud cost optimization strategies
- `references/cloud-networking-patterns.md` — VPC/VNet design patterns

## Expected Output Format

1. Architecture diagram (with services, networking, data flow)
2. IaC code (Terraform/CDK) with plan output
3. Cost estimate (monthly projection)
4. Security review (IAM, encryption, network isolation)