Roadmap

Cloud Engineer

The complete path: from "what is a server?" to operating production cloud at scale.

20stages159topics~22hours

Curated from the best, MDN · Kubernetes · AWS · OWASP · Google SRE & more

Essential for cloud infrastructure design and operations.

The complete path, 69 of 159 topics have lessons here; the other 90 are marked learn anywhere. We won't pretend we cover everything.

Start learning, it’s free Ready to build? See capstone projects

Stage 1 / 20 · 5 topics · 2 lessons

Prerequisites, Computers & the Internet

Before any cloud, understand the machine and the network underneath it.

How computers workCPU, memory, storage, processes, threads. Wikipedia

Operating system internalsStart hereProcesses, memory, scheduling, syscalls, file systems. Lab

How the Internet worksClients, servers, the request/response journey. MDN

Web architectureBrowsers, servers, databases, request lifecycle.

Number systems & encodingoptionalBinary, hex, ASCII/UTF-8, data sizes. MDN

Stage 2 / 20 · 10 topics · 2 lessons

Linux & the Command Line

The cloud runs on Linux. Live in the terminal until it is second nature.

Shell & terminal (bash/zsh)Navigation, pipes, redirection, globbing.

Filesystem, users & permissionsFHS, chmod/chown, sudo, groups.

Processes & signalsps, top, kill, nice, foreground/background. Linux man pages

Services & systemdDaemons, units, enabling/starting services. systemd docs

Package managementapt / yum / dnf, repositories. Ubuntu docs

SSH & remote accessKeys, config, agent, tunneling. SSH Academy

CLI networking toolsip, ss, dig, curl, nc, tcpdump. Linux man pages

Shell scripting & cronrecVariables, loops, conditionals, scheduled jobs. GNU Bash manual Lab

Text processinggrep, sed, awk, cut, sort, jq. GNU grep manual

Logs & troubleshootingjournalctl, /var/log, tracing a failure. systemd docs

Stage 3 / 20 · 11 topics · 3 lessons

Networking Fundamentals

Cloud is networking. This is the make-or-break section for the interview.

OSI & TCP/IP modelsLayers, encapsulation, the packet journey. Lab

IP addressing, subnets & CIDRThe single most-tested cloud networking topic. Cloudflare Learning

Routing & switching basicsHow packets find their way; default gateways. Cloudflare Learning

DNSRecord types, resolution, TTLs, caching. Lab

DHCP & NATAddress assignment; private↔public translation. Wikipedia

HTTP/HTTPS, HTTP/2 & HTTP/3Methods, status codes, headers, keep-alive. MDN Lab

TLS, certificates & PKIThe handshake, chains of trust, mTLS. Cloudflare Learning

Ports & protocols (TCP/UDP)Well-known ports, connection vs datagram. MDN

Load balancing (L4 vs L7)Algorithms, health checks, stickiness. Lab

Firewalls, VPN, proxiesFiltering, tunnels, forward/reverse proxies. Cloudflare Learning

BGP & internet routingoptionalHow networks announce reachability. Wikipedia

Stage 4 / 20 · 6 topics · 2 lessons

Programming, Algorithms & Version Control

You must script fluently, use Git daily, and, for top employers, pass a coding round.

A language: Python or GorecAutomation, SDKs, tooling, small services. Python tutorial

Data structures & algorithmsArrays, maps, trees, graphs, complexity, the coding interview.

Git & version controlBranches, PRs, merge vs rebase, resolving conflicts. Lab

APIs: REST, gRPC & GraphQLDesigning and consuming service interfaces. MDN

JSON, YAML & configThe languages of cloud APIs and IaC. YAML spec

Testing fundamentalsoptionalUnit, integration, mocking, confidence to change. Martin Fowler

Stage 5 / 20 · 7 topics · 4 lessons

Cloud Fundamentals

The mental model every provider shares.

IaaS / PaaS / SaaS / FaaSWhat you manage in each model. Lab

AWS vs Azure vs GCPHow to choose; concepts transfer across all.

Regions, AZs & edgeGeography, latency, designing for failure. Lab

Shared responsibility modelWhat the provider secures vs what you secure. AWS

Accounts, projects & hierarchyOrgs, OUs, projects, tagging, landing zones. Lab

Cloud CLI & SDKsDriving the cloud from the terminal and code. AWS docs

Quotas, limits & pricing modelsService limits and how billing works. AWS docs

Stage 6 / 20 · 7 topics · 4 lessons

Compute

Where your code runs, and how to scale it.

Virtual machinesInstance types, images/AMIs, lifecycle. Lab

Auto-scaling groupsScaling on the right metric; horizontal vs vertical. AWS docs

Containers & DockerImages, registries, layers, multi-stage builds.

Container & image securityScanning, minimal images, non-root, signing.

Serverless functionsEvent-driven compute, cold starts, limits.

Serverless containersCloud Run / Fargate / Knative. Google Cloud docs

Batch, HPC & GPU/TPUoptionalCompute for ML and large parallel jobs. AWS docs

Stage 7 / 20 · 13 topics · 9 lessons

Kubernetes (deep)

The orchestration layer that runs modern production. A skill in its own right.

ArchitectureControl plane, kubelet, etcd, scheduler, API server. Lab

WorkloadsPods, ReplicaSets, Deployments, StatefulSets, DaemonSets.

Services & networkingClusterIP, NodePort, LoadBalancer, DNS.

Ingress & controllersRouting external traffic into the cluster.

ConfigMaps & SecretsInjecting config and credentials.

Storage (PV/PVC/StorageClass)Persistent and dynamic volumes. Kubernetes docs

Requests, limits & QoSScheduling, eviction, OOM behavior. Kubernetes docs

Autoscaling (HPA/VPA/CA)Pod and cluster scaling.

RBAC & service accountsWho/what can do what in the cluster.

Network policiesPod-to-pod traffic control.

Helm & KustomizePackaging and templating manifests.

Operators & CRDsrecExtending Kubernetes with custom controllers. Kubernetes docs

Service mesh (Istio/Linkerd)recmTLS, traffic shaping, observability. Istio docs

Stage 8 / 20 · 11 topics · 1 lessons

Storage & Databases

Where state lives, pick the right tool and run it reliably.

Object storageBuckets, durability, storage classes, lifecycle. AWS docs

Block & file storageVolumes, snapshots, shared file systems. AWS docs

Relational databasesManaged SQL, schema design, indexing. PostgreSQL docs

Replication & failoverPrimary/replica, read replicas, HA. PostgreSQL docs

Sharding & partitioningrecScaling writes horizontally. MongoDB docs

Connection poolingSurviving connection storms. Wikipedia

NoSQL familiesKey-value, document, wide-column, graph. MongoDB

Caching (Redis/Memcached)Cache-aside, TTLs, invalidation. Redis docs

Migrations & schema changeZero-downtime, expand/contract.

Backups & restore testingPITR, snapshots, actually testing restores. AWS docs

CAP & consistency modelsrecStrong vs eventual; tradeoffs. Wikipedia

Stage 9 / 20 · 6 topics · 1 lessons

Messaging & Event-Driven Architecture

Modern systems are asynchronous. This decouples and scales them.

Queues vs topics vs streamsWhen to use each model.

Pub/Sub & SNS/SQSCloud-native messaging services. AWS docs

Kafka & event streamingPartitions, consumer groups, retention. Apache Kafka docs

Idempotency & delivery semanticsAt-least-once, exactly-once, dedup. Wikipedia

DLQs, retries & backpressureHandling failures without losing data. AWS docs

Event-driven patternsrecChoreography, sagas, CDC, webhooks. Martin Fowler

Stage 10 / 20 · 7 topics · 3 lessons

APIs & Service Communication

How services talk, and how you expose them safely.

REST API designResources, status codes, versioning, pagination.

gRPC & protocol buffersHigh-performance internal RPC. gRPC docs

GraphQLoptionalClient-driven queries; when it fits. GraphQL docs

API gatewaysRouting, auth, rate limiting at the edge.

Service discoveryFinding services in a dynamic fleet.

API auth (OAuth2/OIDC/JWT)Tokens, scopes, validating identity. oauth.net

Rate limiting & throttlingProtecting services from overload. Cloudflare Learning

Stage 11 / 20 · 10 topics · 4 lessons

Cloud Networking & Delivery

Recreate networking, inside the cloud, at scale.

VPC, subnets & route tablesYour isolated network; public vs private. Lab

Security groups & NACLsStateful vs stateless filtering. AWS docs

NAT gateways & egressOutbound access from private subnets. AWS docs

Peering & transitConnecting VPCs and accounts. Lab

Private connectivityrecPrivateLink / Private Service Connect. AWS docs

Hybrid connectivityrecVPN, Direct Connect / Interconnect. Google Cloud docs

Cloud DNS & load balancersRoute 53 / Cloud DNS, ALB/NLB/GLB. Lab

CDN & edge deliveryGlobal low-latency caching. Lab

Data transfer & egress costrecThe bill nobody sees coming. Google Cloud docs

WAF & DDoS protectionDefending the edge. AWS docs

Stage 12 / 20 · 12 topics · 8 lessons

Identity, Security & Compliance

The thing that gets people fired when done wrong. Treat it as core.

IAM & least privilegeUsers, roles, policies, evaluation logic. Lab

Federation & SSOOIDC/SAML, identity providers, workload identity.

Secrets management & rotationVault / Secrets Manager, never hardcode. HashiCorp Vault docs

Encryption & KMSAt rest, in transit, key management & rotation.

Certificate management & PKIIssuance, renewal, mTLS. Let's Encrypt

Network security & zero trustSegmentation, micro-perimeters.

Vulnerability & patch managementScanning, CVEs, remediation SLAs. CISA KEV

Supply-chain securitySBOM, image signing, provenance, SLSA.

Policy as code & governanceOPA / Org Policy, guardrails, SCPs.

Compliance & audit loggingSOC2, ISO, GDPR, HIPAA; audit trails.

Threat detectionrecGuardDuty / Security Command Center. AWS docs

Security incident responseContainment, forensics, disclosure.

Stage 13 / 20 · 6 topics · 3 lessons

Infrastructure as Code & Configuration

Click-ops does not scale. Everything becomes reviewed, versioned code.

IaC conceptsDeclarative vs imperative, state, idempotency. Lab

TerraformModules, state, workspaces, remote backends. Lab

Native IaC & PulumiCloudFormation / ARM / Deployment Manager; Pulumi. Pulumi docs

Config managementAnsible / Chef / Puppet, provisioning vs configuring.

IaC testing & scanningterratest, tflint, checkov, policy checks. Terraform docs

Drift detectionrecKeeping reality in sync with code. Terraform docs

Stage 14 / 20 · 7 topics · 5 lessons

CI/CD & Release Engineering

Ship small, ship often, ship safely.

CI pipelinesGitHub Actions / GitLab CI / Jenkins; build & test.

Artifacts & registriesVersioning and storing build outputs. Google Cloud docs

Deployment strategiesRolling, blue-green, canary. Lab

Progressive delivery & flagsGradual rollout, feature flags, auto-rollback. Martin Fowler

GitOps (ArgoCD/Flux)Git as the source of truth for infra.

Pipeline & supply-chain securitySigning, SLSA, least-privilege runners.

DORA metricsrecDeploy frequency, lead time, CFR, MTTR.

Stage 15 / 20 · 8 topics · 4 lessons

Observability & Monitoring

You cannot operate what you cannot see.

Metrics & monitoringPrometheus / CloudWatch; the three pillars.

DashboardsGrafana; visualizing system health. Grafana docs

Centralized loggingAggregation, retention, structured logs. OpenTelemetry docs

Distributed tracingOpenTelemetry, Jaeger, following a request.

APM & profilingrecFinding latency and resource hot spots. OpenTelemetry docs

Alerting & on-callSymptom-based, actionable, low-noise.

SLI / SLO / error budgetsDefining and defending reliability.

Synthetic & RUMoptionalProactive checks and real-user monitoring. Grafana docs

Stage 16 / 20 · 9 topics · 6 lessons

Reliability, SRE & Operations

The actual day-job, keeping production alive and learning from failure.

SRE principles & toilError budgets, automating away toil. Google SRE Book

High availability & redundancyEliminating single points of failure. Wikipedia

Disaster recoveryRPO/RTO, backups, failover drills. Lab

Multi-region designActive-active vs active-passive, replication. Lab

Capacity planningForecasting load and headroom.

Load & performance testingk6 / Locust; finding limits before users do.

Chaos engineeringInjecting failure to prove resilience.

Incident management & on-callDetect, triage, mitigate, comms.

Runbooks & blameless postmortemsOperational docs and learning from outages. Google SRE Book

Stage 17 / 20 · 8 topics · 4 lessons

Architecture & System Design

The senior layer, designing for scale, failure, and cost.

Well-Architected FrameworkThe pillars interviewers expect you to use. AWS

Monolith vs microservicesBoundaries, tradeoffs, when to split.

Scalability patternsHorizontal scaling, caching, CDN, sharding.

Resilience patternsCircuit breaker, bulkhead, retry/backoff, timeout. Azure Architecture Center

Distributed systems basicsrecConsensus, clocks, idempotency, partial failure.

Multi-cloud & hybrid strategyoptionalPortability vs lock-in tradeoffs. Google Cloud docs

System design (interview)Designing systems end-to-end under constraints.

Design docs & RFCsTechnical writing and review culture. ADR (GitHub)

Stage 18 / 20 · 5 topics · 1 lessons

Data & Analytics

Cloud engineers increasingly own the data plane.

Data warehousesBigQuery / Redshift / Snowflake. Google Cloud docs

Data lakes & lakehouseoptionalCheap storage for raw and processed data. AWS docs

ETL/ELT & pipelinesAirflow, Dataflow/Beam; orchestrating data.

Streaming dataReal-time processing at scale. Apache Kafka docs

ML/AI infra awarenessoptionalModel serving, MLOps, GPU scheduling. Hugging Face docs

Stage 19 / 20 · 5 topics · 1 lessons

Cost Management (FinOps)

At scale, architecture decisions are financial decisions.

Pricing modelsOn-demand, reserved, savings plans, spot. Lab

Cost monitoring & allocationTags, budgets, alerts, showback/chargeback. AWS docs

Rightsizing & idle cleanupThe fastest savings lever. AWS docs

Unit economicsrecCost per request/tenant/workload. FinOps Foundation

Storage tieringLifecycle policies and archival tiers. AWS docs

Stage 20 / 20 · 6 topics · 2 lessons

Professional Skills & Interview Prep

The roadmap to job-ready is more than tech.

Documentation & communicationWriting clearly; collaborating across teams. Google Technical Writing

Code & design reviewGiving and receiving feedback well. Google Eng Practices

Coding interview prep (DSA)The algorithm round at top employers.

System design interview prepStructured whiteboard design under pressure.

Behavioral & leadership signalsSTAR stories, ownership, "Googleyness". GitHub

Relevant certificationsoptionalAWS SAA / GCP ACE, useful signal, not a substitute. AWS Certification

You're job-ready.

Clear every stage, earn the certificate, and walk into interviews prepared. The complete path, nothing hidden, no gaps.

Destination reached