Career path
Cloud Engineer
Design, provision and run a secure, controlled cloud infrastructure, entirely described as code, on which teams can build without depending on a manual step.
Aim for this jobWhat this job does
- 6 responsibilities
- 15 missions
- 45 skills
- 224 hours of work an estimate, starting from zero
The job
What a Cloud Engineer does
Six responsibilities. Each one is carried out through concrete missions, which require skills.
Run and ensure continuity
Missions that make it up
-
Ensure a service's continuity and capacity
Deliverablea recovery plan proven by a drill, recovery objectives (RTO, RPO) met and anticipated capacity
-
Spread a cloud service over several zones and restore it outside the account
Deliverablea service spread over two zones, an out-of-account copy restored and timed, in line with the recovery plan
-
Monitor a service and act on alerts
Deliverablemetrics collected, a dashboard and actionable routed alerts
-
Run a cloud environment: quotas, imposed events and incidents
Deliverablea cloud environment run: quotas anticipated, provider-imposed events planned, an incident detected by an alert then resolved
Lay the foundations of a cloud environment
Missions that make it up
-
Design a cloud environment's network
Deliverablea segmented, addressed and filtered private network, with no needless exposure
-
Lay the foundations of a cloud environment
Deliverablean account driven from the command line, a filtered multi-zone private network, sized instances and storage
-
Choose and cost a cloud environment before building it
Deliverablean environment chosen and costed before it is built: service model, compute, storage and data justified, monthly cost estimated from a dated price list
- Choose a workload's service and deployment model and split responsibilities
- Estimate a cloud architecture's monthly cost from dated price lists
- Choose a workload's storage family and class from access, measured performance, durability and cost
- Choose a data service, managed or self-managed, and connect it privately, replication and failover included
- Choose a workload's compute model and size it from measurements
-
Expose a cloud application that stays private
Deliverablea private application exposed through a health-checked load balancer, DNS and TLS, scalable by adding instances
Secure the cloud infrastructure
Missions that make it up
-
Harden a cloud infrastructure
Deliverablea segmented and filtered network, instances built on a hardened image, a hardened system
- Manage a server's accounts and delegation: users, groups, LDAP directory, sudo and ACLs
- Filter a server's traffic with a host firewall, NAT included
- Run a server under SELinux or AppArmor: modes, contexts and troubleshooting
- Build a multi-zone private cloud network and filter its traffic
- Build a hardened machine image with Packer and clean up its build leftovers
-
Secure access to a cloud environment
Deliverablehumans with minimal, temporary and audited permissions, workloads with no long-lived credential on disk
Industrialise images and configuration
Missions that make it up
-
Industrialise images and configuration of a cloud fleet
Deliverablea machine image built as code, a fleet configured through a dynamic inventory
Provision infrastructure as code
Missions that make it up
-
Describe infrastructure as shareable, replayable code
Deliverablean infrastructure split into versioned modules, its state shared and locked, replayed identically
- Predict what an IaC tool will create, change or destroy: declarative model, idempotence, state and plan
- Keep an IaC repository healthy: layered structure, plan review, testing pyramid and secrets out of the code
- Structure infrastructure as code at scale: stacks, versioned modules, environments and debt
- Share a remote, locked and recoverable Terraform state
- Consume and version Terraform modules reproducibly
- Design, structure and test a reusable Terraform module
-
Evolve infrastructure as code without recreating it
Deliverableinfrastructure changed with no unplanned destruction: guards, state repaired or refactored, no plain-text secret in the state
- Evolve an existing infrastructure in code: import, drift, replacement and destruction
- Share a remote, locked and recoverable Terraform state
- Handle sensitive data in Terraform without exposing it in outputs or state
- Inspect and repair a Terraform state, move or remove resources without recreating them
- Control the ordering, replacement and guardrails of Terraform resources
-
Provision a cloud environment with Terraform
Deliverablea cloud environment described in Terraform, its state on the provider's storage, shared by the team, rebuilt identically from code then destroyed with nothing left
- Share a remote, locked and recoverable Terraform state
- Generate Terraform resources in a controlled way with expressions, functions, count and for_each
- Provision a cloud infrastructure in Terraform, with state on the provider's object storage
- Rebuild a cloud environment from code, instances bootstrapped unattended, then destroy it with nothing left
- Test infrastructure code without a cloud account: apply, empty plan and destroy, locally and in CI
Provide managed clusters to teams
Missions that make it up
-
Provide a managed Kubernetes cluster
Deliverablea managed cluster created, its node pools sized and accessible to teams
The means
With which tools?
Choose your tools: the choice changes the lessons to read, never the responsibilities.
Cloud provider
Going further
Specialisations
Optional, measured apart from the job.
Go deeper on Scaleway: identities, secrets, costs and managed services
- Partition by project and keep Scaleway costs under control
- Expose a Scaleway service: Public Gateway, bastion and Load Balancer
- Operate a managed Scaleway PostgreSQL database on a private network, back it up and restore it
- Give a Scaleway identity the least privilege and prove it
- Entrust secrets and encryption keys to Scaleway, rotate and revoke them
- Observe your Scaleway resources with Cockpit and find a past incident
- Deliver an application on Kapsule: private registry, Ingress or Load Balancer, persistent volumes
Go deeper on Outscale: high availability and architecture
- Choose your Outscale region, API and qualification level
- Structure Outscale identities, permissions and accounts with EIM
- Assess an Outscale architecture pillar by pillar with the Well-Architected grid
- Make a service highly available across Outscale subregions: LBU and DNS, or HAProxy and a floating EIP
- Integrate a self-managed Talos Kubernetes cluster with Outscale: OMI, CCM, CSI and fGPU
Provision and maintain an AWS infrastructure with Terraform
What the site does not cover yet
Advanced cloud networking (interconnection, VPN, public DNS): reference guides and the Architect track of the Cloud course, with no skill in the catalogue.
Encryption and key management: teaching in preparation, lesson planned in the "Workload access, secrets and keys" module of the Cloud course, with no skill in the catalogue yet.
Security and compliance audit of a deployed environment: teaching in preparation, lesson planned in the "Operate" module of the Cloud course, with no skill in the catalogue yet.
Cloud migration (7Rs): outside the core, it is a planning task, taught by the "Migrate" module of the Architect track of the Cloud course.
Governance of a multi-team environment (separate accounts, guardrails, tagging) and bill optimisation (FinOps): recommended, outside the core. The cloud engineer applies them day to day; designing them and making the trade-offs are design tasks, taught by the Architect track of the Cloud course.