# Cloud Foundation Setup

> Lays the secure, well-structured cloud foundation that every service and team will build on. Use when asked to cloud foundation setup. Suggest when relevant.

- Skill: `mittuled/cloud-foundation-setup` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add mittuled/cloud-foundation-setup`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mittuled/cloud-foundation-setup/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: mittuled (https://skillmd.com/u/mittuled)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mittuled/cloud-foundation-setup

---


# cloud-foundation-setup

## Agent: Social Media Manager

L2 DevOps and infrastructure engineer responsible for CI/CD pipelines, deployment automation, cloud infrastructure, monitoring, alerting, incident response, and rollout management.

Department ethos: [ideal-engineering.md](../../../../departments/engineering/ideal-engineering.md)

## Skill Description

The DevOps / Infrastructure Engineer sets up the foundational cloud infrastructure including accounts, networking, and IAM.

## When to Use

- The organization is starting on a new cloud provider and needs the initial account structure.
- A new product or business unit requires isolated cloud infrastructure.
- The current cloud setup has grown organically and needs to be restructured for security and cost isolation.

## Workflow

1. Gather requirements: number of environments, isolation boundaries, compliance constraints, and expected workload types.
2. Design the account/project structure with separate accounts for production, staging, development, and shared services.
3. Configure the networking foundation: VPCs, subnets, CIDR ranges, peering, and DNS.
4. Implement IAM: define roles, policies, and permission boundaries following least-privilege principles.
5. Set up centralized logging and audit trails (CloudTrail, audit logs) for all accounts.
6. Configure billing alerts and cost allocation tags for each account and team.
7. Enable security baselines: encryption at rest, encryption in transit, and security group defaults.
8. Implement infrastructure-as-code (Terraform, CloudFormation) for all foundation resources.
9. Validate the setup by deploying a minimal workload across environments.
10. Document the cloud foundation architecture, naming conventions, and onboarding guide.
    - **Deliverable**: A production-ready cloud foundation with accounts, networking, IAM, security baselines, and IaC definitions.

## Anti-Patterns

- **Using a single account for all environments.** *Why*: Shared accounts make it impossible to enforce blast-radius isolation and complicate cost attribution.
- **Configuring IAM manually instead of through code.** *Why*: Manual IAM changes are unauditable, unreproducible, and drift from the intended state.
- **Skipping encryption defaults.** *Why*: Retrofitting encryption is expensive and risky; starting without it guarantees compliance gaps.
- **Not implementing cost controls from day one.** *Why*: Cloud costs grow exponentially; without early guardrails, the first bill shock will be severe.
- **Treating the foundation as a one-time setup.** *Why*: Cloud foundations require ongoing maintenance as the organization grows, new services launch, and security requirements evolve.

## Output

**Success**: A fully configured cloud foundation with isolated accounts, secure networking, least-privilege IAM, encryption, audit logging, and infrastructure-as-code for all resources.

**Failure**: A gap assessment listing which foundation components are missing or misconfigured, with a remediation plan and risk rating for each gap.

## Related Skills

*None defined yet.*
- [`infrastructure-scaling-executor`](../infrastructure-scaling-executor/SKILL.md) — sibling skill under the same agent — combine with infrastructure-scaling-executor for end-to-end coverage
- [`alerting-configurator`](../alerting-configurator/SKILL.md) — sibling skill under the same agent — combine with alerting-configurator for end-to-end coverage
- [`production-readiness-reviewer`](../production-readiness-reviewer/SKILL.md) — sibling skill under the same agent — combine with production-readiness-reviewer for end-to-end coverage