Cloud System Administrator
When to Use
- Process access requests — IAM roles, group membership, break-glass (per policy)
- Execute credential rotation — access keys, service account keys, certificates
- Run patch and maintenance windows for VMs and managed instance groups
- Operate backups — snapshots, retention checks, test restores
- Triage alerts — CPU, disk, quota, health checks; escalate per runbook
- Handle incidents — connectivity, permission denied, throttling, regional outages
- Request quota/limit increases and track vendor cases
- Perform hygiene — orphaned volumes, old snapshots, untagged resources, idle compute
- Maintain runbooks and execute change tickets for routine infra changes
- Support audit — access reviews, log exports, evidence for reviewers
When NOT to Use
- Design landing zones, migration, or reference architecture →
cloud-architect, enterprise-cloud-architect
- Build new VPC, RDS, or serverless stacks from requirements →
cloud-engineer
- Terraform module libraries and platform IaC →
infrastructure-engineer
- Pipeline failures and GitOps sync →
devops
- K8s cluster upgrades and Helm →
cluster-deployment-engineer
- Define SEV levels, paging policy, postmortem program →
incident-management-engineer
- Security program, IdP design, SIEM →
information-security-engineer
- Entitlement design, access review campaigns, federation architecture →
iam-specialist
- Application bug fixes →
senior-software-engineer
- GL reconciliation of cloud invoices →
compute-accounting-manager
Related skills
| Need |
Skill |
| New cloud build and deep service config |
cloud-engineer |
| Cloud architecture |
cloud-architect |
| Enterprise cloud governance |
enterprise-cloud-architect |
| CI/CD and delivery SRE |
devops |
| Kubernetes operations |
cluster-deployment-engineer |
| Incident program design |
incident-management-engineer |
| Security architecture |
information-security-engineer |
| IAM governance, reviews, PAM policy (not ticket execution) |
iam-specialist |
| Compliance evidence |
compliance-engineer |
| BCM program, RTO/RPO, restore-test criteria, cyber recovery sequencing |
bcm-disaster-recovery-specialist |
| Customer-facing support tickets |
support-engineer |
| Status/comms for major outages |
communication-lead |
Core Workflows
1. Scope and operations model
Responsibilities, escalation, change control.
See references/cloud_sysadmin_scope.md.
2. IAM and access operations
Requests, reviews, rotation.
See references/iam_access_operations.md.
3. Compute and OS maintenance
Patching, instances, disks.
See references/compute_os_maintenance.md.
4. Monitoring and incident response
Alerts, triage, runbooks.
See references/monitoring_incident_response.md.
5. Backup and restore operations
Snapshots, drills, recovery steps.
See references/backup_restore_operations.md.
6. Operational hygiene
Quotas, certs, cleanup, DNS ops.
See references/operational_hygiene.md.
Outputs
- Completed change — ticket ID, steps, rollback noted
- Access grant record — who, what role, expiry if temporary
- Incident timeline — detection, actions, resolution, follow-ups
- Restore report — RPO achieved, data validated
- Hygiene report — resources removed, savings estimate
- Runbook update — gaps found during incident
Principles
- Least privilege — grant minimum role; time-bound elevation
- Change control — no prod change without ticket and rollback
- Automate repeat work — scripts over manual clicks where safe
- Document actions — audit trail in ticket and logs
- Escalate architecture — recurring failures may need
cloud-engineer or cloud-architect
1---2name: cloud-system-administrator3description: Guides cloud system administration—day-2 operations on AWS, GCP, and Azure: access requests and IAM role assignment, key and certificate rotation, OS patching and maintenance windows, backup and restore execution, monitoring and alert triage, quota and limit increases, runbooks, change records, and on-call troubleshooting of cloud control-plane and managed-service issues. Use when operating an existing cloud estate, fulfilling access tickets, running restores, responding to cloud infra alerts, or executing hygiene cleanup—not for greenfield VPC/service build-out (cloud-engineer), cloud architecture ADRs (cloud-architect), enterprise CCoE programs (enterprise-cloud-architect), CI/CD pipelines (devops), Kubernetes cluster admin (cluster-deployment-engineer), or designing SEV/on-call programs (incident-management-engineer).4---56# Cloud System Administrator78## When to Use910- Process **access requests** — IAM roles, group membership, break-glass (per policy)11- Execute **credential rotation** — access keys, service account keys, certificates12- Run **patch and maintenance** windows for VMs and managed instance groups13- Operate **backups** — snapshots, retention checks, test restores14- **Triage alerts** — CPU, disk, quota, health checks; escalate per runbook15- Handle **incidents** — connectivity, permission denied, throttling, regional outages16- Request **quota/limit** increases and track vendor cases17- Perform **hygiene** — orphaned volumes, old snapshots, untagged resources, idle compute18- Maintain **runbooks** and execute **change tickets** for routine infra changes19- Support **audit** — access reviews, log exports, evidence for reviewers2021## When NOT to Use2223- Design landing zones, migration, or reference architecture → `cloud-architect`, `enterprise-cloud-architect`24- Build new VPC, RDS, or serverless stacks from requirements → `cloud-engineer`25- Terraform module libraries and platform IaC → `infrastructure-engineer`26- Pipeline failures and GitOps sync → `devops`27- K8s cluster upgrades and Helm → `cluster-deployment-engineer`28- Define SEV levels, paging policy, postmortem program → `incident-management-engineer`29- Security program, IdP design, SIEM → `information-security-engineer`30- Entitlement design, access review campaigns, federation architecture → `iam-specialist`31- Application bug fixes → `senior-software-engineer`32- GL reconciliation of cloud invoices → `compute-accounting-manager`3334## Related skills3536| Need | Skill |37|---|---|38| New cloud build and deep service config | `cloud-engineer` |39| Cloud architecture | `cloud-architect` |40| Enterprise cloud governance | `enterprise-cloud-architect` |41| CI/CD and delivery SRE | `devops` |42| Kubernetes operations | `cluster-deployment-engineer` |43| Incident program design | `incident-management-engineer` |44| Security architecture | `information-security-engineer` |45| IAM governance, reviews, PAM policy (not ticket execution) | `iam-specialist` |46| Compliance evidence | `compliance-engineer` |47| BCM program, RTO/RPO, restore-test criteria, cyber recovery sequencing | `bcm-disaster-recovery-specialist` |48| Customer-facing support tickets | `support-engineer` |49| Status/comms for major outages | `communication-lead` |5051## Core Workflows5253### 1. Scope and operations model5455Responsibilities, escalation, change control.5657**See `references/cloud_sysadmin_scope.md`.**5859### 2. IAM and access operations6061Requests, reviews, rotation.6263**See `references/iam_access_operations.md`.**6465### 3. Compute and OS maintenance6667Patching, instances, disks.6869**See `references/compute_os_maintenance.md`.**7071### 4. Monitoring and incident response7273Alerts, triage, runbooks.7475**See `references/monitoring_incident_response.md`.**7677### 5. Backup and restore operations7879Snapshots, drills, recovery steps.8081**See `references/backup_restore_operations.md`.**8283### 6. Operational hygiene8485Quotas, certs, cleanup, DNS ops.8687**See `references/operational_hygiene.md`.**8889## Outputs9091- **Completed change** — ticket ID, steps, rollback noted92- **Access grant record** — who, what role, expiry if temporary93- **Incident timeline** — detection, actions, resolution, follow-ups94- **Restore report** — RPO achieved, data validated95- **Hygiene report** — resources removed, savings estimate96- **Runbook update** — gaps found during incident9798## Principles99100- **Least privilege** — grant minimum role; time-bound elevation101- **Change control** — no prod change without ticket and rollback102- **Automate repeat work** — scripts over manual clicks where safe103- **Document actions** — audit trail in ticket and logs104- **Escalate architecture** — recurring failures may need `cloud-engineer` or `cloud-architect`
daemon-blockint-tech