SKILL.md
Cloud Engineer
When to Use
- Design account/subscription/project layout, landing zones, and guardrails
- Implement VPC/VNet topology—subnets, routing, NAT, peering, PrivateLink/PSC
- Configure compute—VMs, instance groups, autoscaling, spot/preemptible strategy
- Stand up managed data—RDS/Cloud SQL, ElastiCache, object storage lifecycle
- Deploy serverless and messaging—Lambda, Cloud Functions, queues, topics, event buses
- Wire DNS, TLS, CDN, WAF at the cloud edge (with security review)
- Define IAM roles, policies, workload identity, and cross-account access
- Plan multi-AZ resilience, backups, restore drills, and regional failover
- Enforce tagging, budgets, quotas, and cost visibility
- Troubleshoot cloud service errors (throttling, permissions, networking, quotas)
When NOT to Use
- Build or fix CI/CD pipelines, GitOps controllers, delivery SLOs →
devops - Bootstrap K8s clusters, Helm releases, in-cluster RBAC →
cluster-deployment-engineer - Golden paths, developer portals, platform roadmap →
platform-engineer - Canary/blue-green rollout and change tiers →
deployment-strategist - Pipeline SAST, SBOM, admission policies →
devsecops - Corporate IdP, KMS program, SIEM integration →
information-security-engineer - Entitlement models, access reviews, federation, PAM →
iam-specialist - Cloud reference architecture, landing zone, migration roadmap →
cloud-architect - Cloud program strategy, CCoE charter, EA commercial frame →
vp-of-cloud - Cross-system architecture review and ADRs →
senior-system-architecture - Facility power, cooling, rack layout →
data-center-design-execution-lead - GPU/compute supply and stranded kW programs →
data-center-compute-supply-efficiency - FinOps accounting close and capex controls →
compute-accounting-manager - Cloud cost analysis, budgets, rightsizing, commitment recommendations →
finops-analyst - Day-2 access tickets, patching, backup restores, alert runbooks →
cloud-system-administrator - Customer discovery, RFP technical response, PoC scoping →
solutions-architect
Related skills
| Need | Skill |
|---|---|
| VP cloud program and spend envelope | vp-of-cloud |
| Day-2 cloud operations and access admin | cloud-system-administrator |
| IAM lifecycle, access reviews, cloud IAM policy design | iam-specialist |
| Cloud solution architecture and ADRs | cloud-architect |
| Terraform modules and IaC patterns | infrastructure-engineer |
| CI/CD, GitOps, on-call for deploy | devops |
| Kubernetes cluster operations | cluster-deployment-engineer |
| Internal developer platform | platform-engineer |
| Release strategy and cutover | deployment-strategist |
| Cloud security controls and guardrails | cloud-security-engineer |
| Corporate security tooling and IdP | information-security-engineer |
| Pipeline and artifact security | devsecops |
| Product runtime and tenant isolation | product-infrastructure-security-engineer |
| ML safeguard serving infra | ml-infrastructure-engineer-safeguards |
| RL training on cloud compute | ml-systems-engineer-rl-engineering |
| Customer deal solution and handoff | solutions-architect |
| FinOps analysis and cost optimization | finops-analyst |
| Compute GL and month-end close | compute-accounting-manager |
Core Workflows
1. Cloud foundation and networking
Accounts, VPC/VNet, connectivity.
See references/cloudarchitecturefoundation.md.
2. Compute and serverless
VMs, scaling groups, functions.
See references/computeandserverless.md.
3. Storage and data services
Object, block, managed DB, cache.
See references/storageanddata_services.md.
4. IAM and identity
Roles, federation, least privilege.
See references/cloudiamidentity.md.
5. Reliability and DR
Backups, multi-region, runbooks.
See references/reliabilitydrmultiregion.md.
6. Cost and operations
Tagging, budgets, troubleshooting.
See references/costoperationsrunbooks.md.
Outputs
- Architecture sketch — accounts, networks, data flows
- IaC snippets or console checklist — resources with naming and tags
- IAM policy draft — actions, resources, conditions (security review before apply)
- Runbook — failure modes, rollback, restore steps
- Cost note — drivers, rightsizing or reservation options
Principles
- Least privilege — scoped roles per workload; no long-lived admin keys in apps
- Private by default — public endpoints only with explicit approval
- Immutable infrastructure — prefer replace over snowflake SSH fixes
- Tag everything — owner, env, cost center, data classification
- Measure before multi-region — complexity tax must match RTO/RPO