Core cloud-native DevOps services by category

• CI/CD — AWS CodePipeline + CodeBuild, GCP Cloud Build, Azure DevOps Pipelines. Managed runners, no server maintenance, autoscaling build capacity.
• Container orchestration — EKS (AWS), GKE (GCP), AKS (Azure). Managed Kubernetes control planes. Serverless options: AWS Fargate, GCP Cloud Run, Azure Container Apps.
• Container registry — AWS ECR, GCP Artifact Registry, Azure ACR. Co-located with compute — no egress costs for image pulls.
• Secrets management — AWS Secrets Manager, GCP Secret Manager, Azure Key Vault. Rotate secrets automatically, audit access, inject into containers at runtime.
• Observability — AWS CloudWatch, GCP Cloud Monitoring, Azure Monitor. Managed log aggregation, metrics, dashboards, and alerting without running ELK clusters.
• Infrastructure as Code — All three clouds support Terraform and cloud-native options (CloudFormation, Deployment Manager, ARM/Bicep). Environments are code — create and destroy them on demand.

IAM best practices for CI/CD

• Use OIDC federation, not long-lived keys — GitHub Actions, GitLab CI, and CircleCI support OIDC. Your pipeline exchanges a short-lived JWT for temporary AWS credentials. No stored secrets, no key rotation needed. This is the modern standard.
• Least privilege per pipeline — A deploy pipeline for a Lambda function needs: lambda:UpdateFunctionCode, ecr:GetAuthorizationToken, ecr:BatchGetImage. Nothing else. Scope permissions to the specific resources being deployed.
• Separate roles per environment — The staging deploy role and production deploy role are different IAM roles. Production role requires additional conditions (e.g., only callable from protected branches). Staging is less restricted.
• Audit pipeline credentials quarterly — Review what permissions each pipeline role has. Revoke anything unused. This is especially important after team changes or pipeline refactoring.

Common DevOps cost leaks and fixes

• Forgotten ephemeral environments — A PR was merged but the environment destroy step failed silently. Three months later, you have 50 abandoned environments. Fix: add explicit cleanup in CI and set cloud-level auto-shutdown schedules (AWS Instance Scheduler, GCP Resource Manager).
• CI build caches stored indefinitely — S3 buckets, EFS mounts, and Artifact caches for CI never expire. Fix: set lifecycle policies. CI caches older than 7 days are rarely useful.
• Over-provisioned staging — Staging uses the same instance sizes as production, but runs 5% of the traffic. Fix: use smaller instance types for non-prod. Reserve production, use spot/preemptible for CI and dev.
• Log retention too long — CloudWatch Logs default retention is never. Logs from dev environments at $0.50/GB/month add up. Fix: set 7-day retention for dev, 30 days for staging, 90 days for production (or archive to S3).
• NAT Gateway egress from dev environments — Dev environments making NAT Gateway calls to external APIs generate egress costs. Fix: use VPC endpoints for AWS services, mock external dependencies in dev.