Cloud Architect
When to Use
- Define cloud strategy — single vs multi-cloud, regions, sovereignty, exit criteria
- Design landing zones — OUs, accounts, guardrails, shared services
- Map workloads to service models — serverless, containers, VMs, SaaS
- Produce reference architectures — web app, data platform, event-driven, hybrid
- Run Well-Architected reviews (security, reliability, performance, cost, ops, sustainability)
- Plan migration — assess, 7Rs, waves, dependency order, rollback
- Architect network and security — segmentation, private connectivity, zero-trust hooks
- Model cost — TCO, reservation strategy, chargeback tags at design time
- Author cloud ADRs and review decks for engineering and security sign-off
When NOT to Use
- Provision RDS, fix IAM errors, tune autoscaling →
cloud-engineer
- Author Terraform modules and pipeline YAML →
infrastructure-engineer, devops
- Helm releases and cluster upgrades →
cluster-deployment-engineer
- Developer portal and golden-path roadmap →
platform-engineer
- Cross-domain integration and strangler ADRs (not cloud-specific) →
senior-system-architecture
- Data mesh, lakehouse, warehouse modeling →
data-architect
- Release cutover runbooks →
deployment-strategist
- Security control program and GRC evidence →
cybersecurity, compliance-engineer
- Implement cloud guardrails, CSPM, IAM/network security controls →
cloud-security-engineer
- LLM/RAG/agent architecture →
applied-ai-architect-commercial-enterprise, ai-engineer
- Program RAID and milestones →
technical-program-manager
- Physical DC design →
data-center-design-execution-lead
- Multi-BU landing zones, CCoE, EA, regulated enterprise program →
enterprise-cloud-architect
- Multi-year cloud strategy, migration portfolio, EA governance →
vp-of-cloud
- Multi-year TCO/NPV and option economics for ADRs →
cloud-economist
- Customer RFP, deal integration architecture, PoC scope →
solutions-architect
Related skills
| Need |
Skill |
| VP cloud program and migration portfolio |
vp-of-cloud |
| Enterprise-scale cloud governance |
enterprise-cloud-architect |
| Implement cloud resources |
cloud-engineer |
| IaC modules and delivery patterns |
infrastructure-engineer |
| CI/CD and GitOps |
devops |
| Kubernetes platform operations |
cluster-deployment-engineer |
| Internal developer platform |
platform-engineer |
| Enterprise system architecture |
senior-system-architecture |
| Data platform architecture |
data-architect |
| Cloud security guardrails and posture |
cloud-security-engineer |
| Corporate security program and tooling |
information-security-engineer |
| Cloud TCO and option economics |
cloud-economist |
| FinOps accounting |
compute-accounting-manager |
| Hybrid / DC connectivity |
data-center-design-execution-lead |
| AI workload on cloud |
applied-ai-architect-commercial-enterprise |
| Customer deal solution and RFP technical design |
solutions-architect |
Core Workflows
1. Architecture principles and NFRs
Pillars, constraints, quality attributes.
See references/cloud_architecture_principles.md.
2. Landing zone and organization
Accounts, guardrails, shared services.
See references/landing_zone_org_design.md.
3. Workload placement and services
Compute model and vendor selection.
See references/workload_placement_service_selection.md.
4. Network and security architecture
Segmentation, connectivity, controls.
See references/network_security_architecture.md.
5. Migration and hybrid
Roadmaps, hybrid patterns, exit.
See references/migration_and_hybrid.md.
6. Deliverables and review
Diagrams, ADRs, review checklist.
See references/architecture_deliverables.md.
Outputs
- Context diagram — users, systems, external dependencies
- Target architecture — logical and physical (cloud services labeled)
- ADR set — decisions, options, consequences
- Migration wave plan — scope, risks, prerequisites
- WAF findings — prioritized remediation backlog
- Cost model — order-of-magnitude TCO drivers
Principles
- Design for operability — if it cannot be observed and owned, it is not ready
- Prefer managed until a clear constraint requires self-managed
- Explicit non-goals — scope control prevents architecture creep
- Reversibility — call out one-way doors; phase commits
- Security and compliance early — not a late gate
1---2name: cloud-architect3description: Guides cloud solution architecture—Well-Architected alignment, landing zone and org design, workload placement and service selection, network and security segmentation, hybrid and multi-region patterns, migration roadmaps (7Rs), cost architecture, and cloud ADRs with diagrams for stakeholder review. Use when choosing cloud platforms and reference architectures, designing account guardrails, comparing managed vs self-managed services, planning cloud migration or exit, or running cloud architecture review—not for hands-on resource configuration (cloud-engineer), Terraform module implementation (infrastructure-engineer), CI/CD delivery (devops), K8s cluster ops (cluster-deployment-engineer), IDP product strategy (platform-engineer), enterprise-wide non-cloud system ADRs (senior-system-architecture), or applied AI solution design (applied-ai-architect-commercial-enterprise).4---56# Cloud Architect78## When to Use910- Define **cloud strategy** — single vs multi-cloud, regions, sovereignty, exit criteria11- Design **landing zones** — OUs, accounts, guardrails, shared services12- Map workloads to **service models** — serverless, containers, VMs, SaaS13- Produce **reference architectures** — web app, data platform, event-driven, hybrid14- Run **Well-Architected** reviews (security, reliability, performance, cost, ops, sustainability)15- Plan **migration** — assess, 7Rs, waves, dependency order, rollback16- Architect **network and security** — segmentation, private connectivity, zero-trust hooks17- Model **cost** — TCO, reservation strategy, chargeback tags at design time18- Author **cloud ADRs** and review decks for engineering and security sign-off1920## When NOT to Use2122- Provision RDS, fix IAM errors, tune autoscaling → `cloud-engineer`23- Author Terraform modules and pipeline YAML → `infrastructure-engineer`, `devops`24- Helm releases and cluster upgrades → `cluster-deployment-engineer`25- Developer portal and golden-path roadmap → `platform-engineer`26- Cross-domain integration and strangler ADRs (not cloud-specific) → `senior-system-architecture`27- Data mesh, lakehouse, warehouse modeling → `data-architect`28- Release cutover runbooks → `deployment-strategist`29- Security control program and GRC evidence → `cybersecurity`, `compliance-engineer`30- Implement cloud guardrails, CSPM, IAM/network security controls → `cloud-security-engineer`31- LLM/RAG/agent architecture → `applied-ai-architect-commercial-enterprise`, `ai-engineer`32- Program RAID and milestones → `technical-program-manager`33- Physical DC design → `data-center-design-execution-lead`34- Multi-BU landing zones, CCoE, EA, regulated enterprise program → `enterprise-cloud-architect`35- Multi-year cloud strategy, migration portfolio, EA governance → `vp-of-cloud`36- Multi-year TCO/NPV and option economics for ADRs → `cloud-economist`37- Customer RFP, deal integration architecture, PoC scope → `solutions-architect`3839## Related skills4041| Need | Skill |42|---|---|43| VP cloud program and migration portfolio | `vp-of-cloud` |44| Enterprise-scale cloud governance | `enterprise-cloud-architect` |45| Implement cloud resources | `cloud-engineer` |46| IaC modules and delivery patterns | `infrastructure-engineer` |47| CI/CD and GitOps | `devops` |48| Kubernetes platform operations | `cluster-deployment-engineer` |49| Internal developer platform | `platform-engineer` |50| Enterprise system architecture | `senior-system-architecture` |51| Data platform architecture | `data-architect` |52| Cloud security guardrails and posture | `cloud-security-engineer` |53| Corporate security program and tooling | `information-security-engineer` |54| Cloud TCO and option economics | `cloud-economist` |55| FinOps accounting | `compute-accounting-manager` |56| Hybrid / DC connectivity | `data-center-design-execution-lead` |57| AI workload on cloud | `applied-ai-architect-commercial-enterprise` |58| Customer deal solution and RFP technical design | `solutions-architect` |5960## Core Workflows6162### 1. Architecture principles and NFRs6364Pillars, constraints, quality attributes.6566**See `references/cloud_architecture_principles.md`.**6768### 2. Landing zone and organization6970Accounts, guardrails, shared services.7172**See `references/landing_zone_org_design.md`.**7374### 3. Workload placement and services7576Compute model and vendor selection.7778**See `references/workload_placement_service_selection.md`.**7980### 4. Network and security architecture8182Segmentation, connectivity, controls.8384**See `references/network_security_architecture.md`.**8586### 5. Migration and hybrid8788Roadmaps, hybrid patterns, exit.8990**See `references/migration_and_hybrid.md`.**9192### 6. Deliverables and review9394Diagrams, ADRs, review checklist.9596**See `references/architecture_deliverables.md`.**9798## Outputs99100- **Context diagram** — users, systems, external dependencies101- **Target architecture** — logical and physical (cloud services labeled)102- **ADR set** — decisions, options, consequences103- **Migration wave plan** — scope, risks, prerequisites104- **WAF findings** — prioritized remediation backlog105- **Cost model** — order-of-magnitude TCO drivers106107## Principles108109- **Design for operability** — if it cannot be observed and owned, it is not ready110- **Prefer managed** until a clear constraint requires self-managed111- **Explicit non-goals** — scope control prevents architecture creep112- **Reversibility** — call out one-way doors; phase commits113- **Security and compliance early** — not a late gate
daemon-blockint-tech