Cloud Engineer
When to Use
- Design account/subscription/project layout, landing zones, and guardrails
- Implement VPC/VNet topology—subnets, routing, NAT, peering, PrivateLink/PSC
- Configure compute—VMs, instance groups, autoscaling, spot/preemptible strategy
- Stand up managed data—RDS/Cloud SQL, ElastiCache, object storage lifecycle
- Deploy serverless and messaging—Lambda, Cloud Functions, queues, topics, event buses
- Wire DNS, TLS, CDN, WAF at the cloud edge (with security review)
- Define IAM roles, policies, workload identity, and cross-account access
- Plan multi-AZ resilience, backups, restore drills, and regional failover
- Enforce tagging, budgets, quotas, and cost visibility
- Troubleshoot cloud service errors (throttling, permissions, networking, quotas)
When NOT to Use
- Build or fix CI/CD pipelines, GitOps controllers, delivery SLOs →
devops
- Bootstrap K8s clusters, Helm releases, in-cluster RBAC →
cluster-deployment-engineer
- Golden paths, developer portals, platform roadmap →
platform-engineer
- Canary/blue-green rollout and change tiers →
deployment-strategist
- Pipeline SAST, SBOM, admission policies →
devsecops
- Corporate IdP, KMS program, SIEM integration →
information-security-engineer
- Entitlement models, access reviews, federation, PAM →
iam-specialist
- Cloud reference architecture, landing zone, migration roadmap →
cloud-architect
- Cloud program strategy, CCoE charter, EA commercial frame →
vp-of-cloud
- Cross-system architecture review and ADRs →
senior-system-architecture
- Facility power, cooling, rack layout →
data-center-design-execution-lead
- GPU/compute supply and stranded kW programs →
data-center-compute-supply-efficiency
- FinOps accounting close and capex controls →
compute-accounting-manager
- Cloud cost analysis, budgets, rightsizing, commitment recommendations →
finops-analyst
- Day-2 access tickets, patching, backup restores, alert runbooks →
cloud-system-administrator
- Customer discovery, RFP technical response, PoC scoping →
solutions-architect
Related skills
| Need |
Skill |
| VP cloud program and spend envelope |
vp-of-cloud |
| Day-2 cloud operations and access admin |
cloud-system-administrator |
| IAM lifecycle, access reviews, cloud IAM policy design |
iam-specialist |
| Cloud solution architecture and ADRs |
cloud-architect |
| Terraform modules and IaC patterns |
infrastructure-engineer |
| CI/CD, GitOps, on-call for deploy |
devops |
| Kubernetes cluster operations |
cluster-deployment-engineer |
| Internal developer platform |
platform-engineer |
| Release strategy and cutover |
deployment-strategist |
| Cloud security controls and guardrails |
cloud-security-engineer |
| Corporate security tooling and IdP |
information-security-engineer |
| Pipeline and artifact security |
devsecops |
| Product runtime and tenant isolation |
product-infrastructure-security-engineer |
| ML safeguard serving infra |
ml-infrastructure-engineer-safeguards |
| RL training on cloud compute |
ml-systems-engineer-rl-engineering |
| Customer deal solution and handoff |
solutions-architect |
| FinOps analysis and cost optimization |
finops-analyst |
| Compute GL and month-end close |
compute-accounting-manager |
Core Workflows
1. Cloud foundation and networking
Accounts, VPC/VNet, connectivity.
See references/cloud_architecture_foundation.md.
2. Compute and serverless
VMs, scaling groups, functions.
See references/compute_and_serverless.md.
3. Storage and data services
Object, block, managed DB, cache.
See references/storage_and_data_services.md.
4. IAM and identity
Roles, federation, least privilege.
See references/cloud_iam_identity.md.
5. Reliability and DR
Backups, multi-region, runbooks.
See references/reliability_dr_multiregion.md.
6. Cost and operations
Tagging, budgets, troubleshooting.
See references/cost_operations_runbooks.md.
Outputs
- Architecture sketch — accounts, networks, data flows
- IaC snippets or console checklist — resources with naming and tags
- IAM policy draft — actions, resources, conditions (security review before apply)
- Runbook — failure modes, rollback, restore steps
- Cost note — drivers, rightsizing or reservation options
Principles
- Least privilege — scoped roles per workload; no long-lived admin keys in apps
- Private by default — public endpoints only with explicit approval
- Immutable infrastructure — prefer replace over snowflake SSH fixes
- Tag everything — owner, env, cost center, data classification
- Measure before multi-region — complexity tax must match RTO/RPO
1---2name: cloud-engineer3description: Guides cloud engineering on AWS, GCP, and Azure—landing zones and account structure, VPC/VNet networking, compute and autoscaling, object/block storage, managed databases and caches, serverless and messaging, DNS/CDN, cloud IAM and workload identity, multi-AZ/region reliability, backups and DR, tagging, cost controls, and service-level troubleshooting. Use when designing or operating cloud resources, wiring private connectivity, rightsizing spend, or debugging control-plane and managed-service failures—not for CI/CD and GitOps (devops), Kubernetes cluster bootstrap and Helm (cluster-deployment-engineer), internal developer platforms (platform-engineer), release cutover strategy (deployment-strategist), security program and IdP/KMS ownership (information-security-engineer), enterprise integration ADRs (senior-system-architecture), or physical data center facilities (data-center-design-execution-lead). Reusable Terraform module libraries: infrastructure-engineer.4---56# Cloud Engineer78## When to Use910- Design **account/subscription/project** layout, landing zones, and guardrails11- Implement **VPC/VNet** topology—subnets, routing, NAT, peering, PrivateLink/PSC12- Configure **compute**—VMs, instance groups, autoscaling, spot/preemptible strategy13- Stand up **managed data**—RDS/Cloud SQL, ElastiCache, object storage lifecycle14- Deploy **serverless and messaging**—Lambda, Cloud Functions, queues, topics, event buses15- Wire **DNS, TLS, CDN, WAF** at the cloud edge (with security review)16- Define **IAM roles, policies**, workload identity, and cross-account access17- Plan **multi-AZ** resilience, backups, restore drills, and regional failover18- Enforce **tagging, budgets, quotas**, and cost visibility19- Troubleshoot **cloud service** errors (throttling, permissions, networking, quotas)2021## When NOT to Use2223- Build or fix CI/CD pipelines, GitOps controllers, delivery SLOs → `devops`24- Bootstrap K8s clusters, Helm releases, in-cluster RBAC → `cluster-deployment-engineer`25- Golden paths, developer portals, platform roadmap → `platform-engineer`26- Canary/blue-green rollout and change tiers → `deployment-strategist`27- Pipeline SAST, SBOM, admission policies → `devsecops`28- Corporate IdP, KMS program, SIEM integration → `information-security-engineer`29- Entitlement models, access reviews, federation, PAM → `iam-specialist`30- Cloud reference architecture, landing zone, migration roadmap → `cloud-architect`31- Cloud program strategy, CCoE charter, EA commercial frame → `vp-of-cloud`32- Cross-system architecture review and ADRs → `senior-system-architecture`33- Facility power, cooling, rack layout → `data-center-design-execution-lead`34- GPU/compute supply and stranded kW programs → `data-center-compute-supply-efficiency`35- FinOps accounting close and capex controls → `compute-accounting-manager`36- Cloud cost analysis, budgets, rightsizing, commitment recommendations → `finops-analyst`37- Day-2 access tickets, patching, backup restores, alert runbooks → `cloud-system-administrator`38- Customer discovery, RFP technical response, PoC scoping → `solutions-architect`3940## Related skills4142| Need | Skill |43|---|---|44| VP cloud program and spend envelope | `vp-of-cloud` |45| Day-2 cloud operations and access admin | `cloud-system-administrator` |46| IAM lifecycle, access reviews, cloud IAM policy design | `iam-specialist` |47| Cloud solution architecture and ADRs | `cloud-architect` |48| Terraform modules and IaC patterns | `infrastructure-engineer` |49| CI/CD, GitOps, on-call for deploy | `devops` |50| Kubernetes cluster operations | `cluster-deployment-engineer` |51| Internal developer platform | `platform-engineer` |52| Release strategy and cutover | `deployment-strategist` |53| Cloud security controls and guardrails | `cloud-security-engineer` |54| Corporate security tooling and IdP | `information-security-engineer` |55| Pipeline and artifact security | `devsecops` |56| Product runtime and tenant isolation | `product-infrastructure-security-engineer` |57| ML safeguard serving infra | `ml-infrastructure-engineer-safeguards` |58| RL training on cloud compute | `ml-systems-engineer-rl-engineering` |59| Customer deal solution and handoff | `solutions-architect` |60| FinOps analysis and cost optimization | `finops-analyst` |61| Compute GL and month-end close | `compute-accounting-manager` |6263## Core Workflows6465### 1. Cloud foundation and networking6667Accounts, VPC/VNet, connectivity.6869**See `references/cloud_architecture_foundation.md`.**7071### 2. Compute and serverless7273VMs, scaling groups, functions.7475**See `references/compute_and_serverless.md`.**7677### 3. Storage and data services7879Object, block, managed DB, cache.8081**See `references/storage_and_data_services.md`.**8283### 4. IAM and identity8485Roles, federation, least privilege.8687**See `references/cloud_iam_identity.md`.**8889### 5. Reliability and DR9091Backups, multi-region, runbooks.9293**See `references/reliability_dr_multiregion.md`.**9495### 6. Cost and operations9697Tagging, budgets, troubleshooting.9899**See `references/cost_operations_runbooks.md`.**100101## Outputs102103- **Architecture sketch** — accounts, networks, data flows104- **IaC snippets or console checklist** — resources with naming and tags105- **IAM policy draft** — actions, resources, conditions (security review before apply)106- **Runbook** — failure modes, rollback, restore steps107- **Cost note** — drivers, rightsizing or reservation options108109## Principles110111- **Least privilege** — scoped roles per workload; no long-lived admin keys in apps112- **Private by default** — public endpoints only with explicit approval113- **Immutable infrastructure** — prefer replace over snowflake SSH fixes114- **Tag everything** — owner, env, cost center, data classification115- **Measure before multi-region** — complexity tax must match RTO/RPO
daemon-blockint-tech