Cloud Architect

Cloud Architect

Specialized expertise in cloud architecture across AWS, Azure, and GCP, providing guidance on Well-Architected Framework principles, high availability patterns, security best practices, cost optimization, and cloud-native design.

When to Use This Skill

Use this skill for:

• Designing cloud infrastructure architecture
• Implementing Well-Architected Framework reviews
• Multi-region and multi-cloud deployments
• High availability and disaster recovery planning
• Cloud cost optimization and FinOps
• Serverless architecture design
• Cloud security and compliance
• Migration from on-premises to cloud

Trigger phrases: "cloud architecture", "AWS", "Azure", "GCP", "serverless", "cloud migration", "well-architected", "high availability", "disaster recovery", "cloud security"

What This Skill Does

Provides production-ready cloud patterns including:

• Architecture Design: Scalable, resilient, secure cloud solutions
• Well-Architected: Six pillars implementation guidance
• High Availability: Multi-AZ, multi-region, failover patterns
• Security: Identity, encryption, network security
• Cost Optimization: Right-sizing, reserved capacity, FinOps
• Serverless: Event-driven, managed services patterns

Instructions

Step 1: Apply Well-Architected Framework Principles

Six Pillars Overview:

Step 2: Design for High Availability

Multi-AZ Architecture (Standard):

                    ┌─────────────────────────────────────────┐
                    │              Route 53 / DNS              │
                    └─────────────────┬───────────────────────┘
                                      │
                    ┌─────────────────▼───────────────────────┐
                    │           Application Load Balancer      │
                    │              (Cross-AZ)                  │
                    └─────────────────┬───────────────────────┘
                                      │
          ┌───────────────────────────┼───────────────────────────┐
          │                           │                           │
┌─────────▼─────────┐     ┌──────────▼──────────┐    ┌──────────▼──────────┐
│   Availability    │     │   Availability      │    │   Availability      │
│     Zone A        │     │     Zone B          │    │     Zone C          │
│                   │     │                     │    │                     │
│  ┌─────────────┐  │     │  ┌─────────────┐    │    │  ┌─────────────┐    │
│  │  App Tier   │  │     │  │  App Tier   │    │    │  │  App Tier   │    │
│  │  (ASG)      │  │     │  │  (ASG)      │    │    │  │  (ASG)      │    │
│  └──────┬──────┘  │     │  └──────┬──────┘    │    │  └──────┬──────┘    │
│         │         │     │         │           │    │         │           │
│  ┌──────▼──────┐  │     │  ┌──────▼──────┐    │    │  ┌──────▼──────┐    │
│  │  RDS Replica│  │     │  │  RDS Primary│    │    │  │  RDS Replica│    │
│  └─────────────┘  │     │  └─────────────┘    │    │  └─────────────┘    │
└───────────────────┘     └─────────────────────┘    └─────────────────────┘

Multi-Region Architecture (Mission Critical):

                              Global DNS (Route 53)
                                      │
                    ┌─────────────────┴─────────────────┐
                    │                                   │
            ┌───────▼───────┐                   ┌───────▼───────┐
            │  US-EAST-1    │                   │  EU-WEST-1    │
            │  (Primary)    │◄─────────────────►│  (Secondary)  │
            │               │   Cross-Region    │               │
            │  ┌─────────┐  │    Replication    │  ┌─────────┐  │
            │  │   ALB   │  │                   │  │   ALB   │  │
            │  └────┬────┘  │                   │  └────┬────┘  │
            │       │       │                   │       │       │
            │  ┌────▼────┐  │                   │  ┌────▼────┐  │
            │  │   EKS   │  │                   │  │   EKS   │  │
            │  └────┬────┘  │                   │  └────┬────┘  │
            │       │       │                   │       │       │
            │  ┌────▼────┐  │                   │  ┌────▼────┐  │
            │  │ Aurora  │──┼───────────────────┼──│ Aurora  │  │
            │  │ Global  │  │                   │  │ Replica │  │
            │  └─────────┘  │                   │  └─────────┘  │
            └───────────────┘                   └───────────────┘

Step 3: Implement Security Best Practices

AWS Security Reference Architecture:

# Network Security - VPC with private subnets
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

# Private subnets for workloads
resource "aws_subnet" "private" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "private-${count.index + 1}"
    Tier = "private"
  }
}

# VPC Flow Logs for network monitoring
resource "aws_flow_log" "main" {
  vpc_id                   = aws_vpc.main.id
  traffic_type             = "ALL"
  log_destination_type     = "cloud-watch-logs"
  log_destination          = aws_cloudwatch_log_group.flow_logs.arn
  iam_role_arn             = aws_iam_role.flow_logs.arn
  max_aggregation_interval = 60
}

# Security Group with least privilege
resource "aws_security_group" "app" {
  name_prefix = "app-"
  vpc_id      = aws_vpc.main.id

  # No ingress from 0.0.0.0/0
  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    description = "HTTPS to AWS services"
  }
}

# KMS key for encryption
resource "aws_kms_key" "main" {
  description             = "Main encryption key"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "Enable IAM policies"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      }
    ]
  })
}

Identity and Access Management:

# IAM Role with least privilege
resource "aws_iam_role" "app" {
  name = "app-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
      Condition = {
        StringEquals = {
          "aws:SourceAccount" = data.aws_caller_identity.current.account_id
        }
      }
    }]
  })
}

# Specific permissions, not wildcards
resource "aws_iam_role_policy" "app" {
  name = "app-policy"
  role = aws_iam_role.app.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Resource = "${aws_s3_bucket.app_data.arn}/*"
      },
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = aws_secretsmanager_secret.app.arn
      }
    ]
  })
}

Step 4: Implement Cost Optimization

Cost Optimization Strategies:

Auto-Scaling Configuration:

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  vpc_zone_identifier = aws_subnet.private[*].id
  target_group_arns   = [aws_lb_target_group.app.arn]
  health_check_type   = "ELB"

  min_size         = 2
  max_size         = 20
  desired_capacity = 3

  mixed_instances_policy {
    launch_template {
      launch_template_specification {
        launch_template_id = aws_launch_template.app.id
        version            = "$Latest"
      }

      # Use mix of instance types for cost/availability
      override {
        instance_type     = "m6i.large"
        weighted_capacity = "1"
      }
      override {
        instance_type     = "m6a.large"
        weighted_capacity = "1"
      }
      override {
        instance_type     = "m5.large"
        weighted_capacity = "1"
      }
    }

    instances_distribution {
     
     
      spot_allocation_strategy                 = "capacity-optimized"
    }
  }

  instance_refresh {
    strategy = "Rolling"
    preferences {
      min_healthy_percentage = 75
    }
  }
}

# Target tracking scaling
resource "aws_autoscaling_policy" "cpu" {
  name                   = "cpu-target-tracking"
  autoscaling_group_name = aws_autoscaling_group.app.name
  policy_type            = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    target_value = 70.0
  }
}

S3 Lifecycle Policy for Cost Optimization:

resource "aws_s3_bucket_lifecycle_configuration" "data" {
  bucket = aws_s3_bucket.data.id

  rule {
    id     = "archive-old-data"
    status = "Enabled"

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 90
      storage_class = "GLACIER"
    }

    transition {
      days          = 365
      storage_class = "DEEP_ARCHIVE"
    }

    expiration {
      days = 2555  # 7 years
    }

    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class   = "GLACIER"
    }

    noncurrent_version_expiration {
      noncurrent_days = 90
    }
  }
}

Step 5: Design Serverless Architecture

Event-Driven Architecture:

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  API Gateway│────►│   Lambda    │────►│  DynamoDB   │
└─────────────┘     └──────┬──────┘     └─────────────┘
                           │
                    ┌──────▼──────┐
                    │    SQS      │
                    │   Queue     │
                    └──────┬──────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
       ┌──────▼──────┐ ┌───▼────┐ ┌────▼─────┐
       │   Lambda    │ │ Lambda │ │  Lambda  │
       │  Worker 1   │ │Worker 2│ │ Worker 3 │
       └──────┬──────┘ └───┬────┘ └────┬─────┘
              │            │           │
              └────────────┼───────────┘
                           │
                    ┌──────▼──────┐
                    │     S3      │
                    │   Results   │
                    └─────────────┘

Serverless API Pattern (AWS):

# API Gateway
resource "aws_apigatewayv2_api" "main" {
  name          = "app-api"
  protocol_type = "HTTP"

  cors_configuration {
    allow_origins = ["https://example.com"]
    allow_methods = ["GET", "POST", "PUT", "DELETE"]
    allow_headers = ["Content-Type", "Authorization"]
    max_age       = 300
  }
}

# Lambda function
resource "aws_lambda_function" "api" {
  function_name = "api-handler"
  role          = aws_iam_role.lambda.arn
  handler       = "index.handler"
  runtime       = "nodejs20.x"
  timeout       = 30
  memory_size   = 512

  filename         = data.archive_file.lambda.output_path
  source_code_hash = data.archive_file.lambda.output_base64sha256

  environment {
    variables = {
      TABLE_NAME = aws_dynamodb_table.main.name
    }
  }

  tracing_config {
    mode = "Active"
  }
}

# DynamoDB table
resource "aws_dynamodb_table" "main" {
  name           = "app-data"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "pk"
  range_key      = "sk"

  attribute {
    name = "pk"
    type = "S"
  }

  attribute {
    name = "sk"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true
  }

  server_side_encryption {
    enabled     = true
    kms_key_arn = aws_kms_key.main.arn
  }
}

Best Practices

• Design for failure - Assume everything can fail, build resilience
• Use managed services - Reduce operational burden
• Implement defense in depth - Multiple security layers
• Automate everything - Infrastructure as Code, CI/CD
• Monitor comprehensively - Metrics, logs, traces, alerts
• Optimize costs continuously - Regular reviews, FinOps practices
• Plan for scale - Design for 10x growth
• Document decisions - Architecture Decision Records (ADRs)
• Test disaster recovery - Regular DR drills
• Stay current - Cloud services evolve rapidly

Common Patterns

Pattern 1: Three-Tier Web Application

Internet → CloudFront → ALB → ECS/EKS → Aurora/RDS
                         ↓
                    ElastiCache

Pattern 2: Data Lake Architecture

Sources → Kinesis → S3 Raw → Glue ETL → S3 Processed → Athena/Redshift
                                              ↓
                                         QuickSight

Pattern 3: Microservices with Service Mesh

API Gateway → ALB → EKS with Istio
                    ├── Service A
                    ├── Service B
                    └── Service C
                         ↓
                    RDS/DynamoDB

Cloud Comparison Quick Reference

Quality Checklist

• Multi-AZ deployment for high availability
• Encryption at rest and in transit
• Least privilege IAM policies
• VPC with private subnets for workloads
• Auto-scaling configured
• Backup and recovery tested
• Monitoring and alerting in place
• Cost allocation tags applied
• Security groups follow least privilege
• Architecture documented

Related Skills

• terraform-specialist - Infrastructure provisioning
• kubernetes-expert - Container orchestration on cloud
• cicd-architect - Deployment pipelines
• security-review - Cloud security assessment

Version: 1.0.0 Last Updated: January 2026 Based on: awesome-claude-code-subagents patterns, AWS/Azure/GCP Well-Architected

Iterative Refinement Strategy

This skill is optimized for an iterative approach:

1. Execute: Perform the core steps defined above.
2. Review: Critically analyze the output (coverage, quality, completeness).
3. Refine: If targets aren't met, repeat the specific implementation steps with improved context.
4. Loop: Continue until the definition of done is satisfied.