{ "schema": 1, "slug": "cloudops", "title": "CloudOps", "full_name": "Cloud Operations (CloudOps) Engineering", "category": "Platforms & Cloud", "tagline": "Run secure, reliable and cost-aware workloads on AWS, Azure and Google Cloud with automation-first operations.", "summary": "Learn to operate production cloud environments across AWS, Azure and Google Cloud: landing zones, identity, networking, infrastructure as code, monitoring, patching, backup and disaster recovery, governance and cost. The path finishes with hybrid and multi-cloud operations and the AI agents that are reshaping incident response in 2026.", "description": "Cloud Operations (CloudOps) is the discipline of keeping cloud workloads secure, available, compliant and cost-efficient every day. CloudOps engineers design account and network foundations, automate provisioning and configuration, watch telemetry, patch fleets, protect data, respond to incidents and continuously enforce governance guardrails.\n\nThe role has been renamed and modernised. In September 2025 AWS replaced its SysOps Administrator certification with AWS Certified CloudOps Engineer – Associate, adding containers, multi-account and multi-Region operations and more infrastructure as code. At the same time OpenTelemetry has become a native ingestion format on the major clouds, and AI operations agents such as AWS DevOps Agent, Azure SRE Agent and Gemini Cloud Assist investigations now triage incidents alongside humans.\n\nCloudOps sits between neighbouring disciplines: it applies DevOps automation to infrastructure, shares SLOs and incident practice with SRE, feeds cost data to FinOps, runs the foundations platform engineering teams build on and implements the controls DevSecOps defines. This path is multi-cloud by design, using AWS as the primary lab environment with Azure and Google Cloud equivalents at every stage.", "icon": "cloud_sync", "accent": "#0EA5E9", "level": "Beginner → Advanced", "duration_weeks": 31, "weekly_hours": 10, "audience": [ "System administrators and data-centre engineers moving their skills to the cloud", "Junior cloud, support and NOC engineers who want to grow into a CloudOps role", "DevOps engineers who need deeper operations, governance and resilience skills", "Developers who are on call for cloud workloads and want to run them properly" ], "prerequisites": [ "Basic Linux or Windows Server administration", "Networking fundamentals: IP addressing, subnets, DNS, HTTP and TLS", "Comfort with a command line and willingness to write scripts", "A free-tier or sandbox account on at least one public cloud" ], "outcomes": [ "Design a multi-account or multi-subscription landing zone with centralised identity, logging and guardrails", "Implement least-privilege access with SSO, role-based access and short-lived credentials across AWS, Azure and Google Cloud", "Provision and change infrastructure only through reviewed Terraform or OpenTofu pipelines with policy checks", "Build monitoring, logging and alerting with native cloud tools and OpenTelemetry, tied to SLOs and runbooks", "Automate patching, configuration and remediation for VM and container fleets, including hybrid servers", "Design and test backup and disaster recovery that meets agreed RTO and RPO targets", "Track and reduce cloud spend with tagging, budgets, anomaly detection and rightsizing", "Use AI operations agents safely, with scoped permissions, approval modes and human review" ], "trends": [ "AWS replaced the SysOps Administrator exam with AWS Certified CloudOps Engineer – Associate (SOA-C03) in September 2025, adding containers, multi-account and multi-Region scenarios and more infrastructure as code.", "Agentic operations went mainstream: AWS DevOps Agent reached general availability in March 2026, while Azure SRE Agent, the Azure Copilot observability agent and Gemini Cloud Assist investigations automate first-line root-cause analysis.", "OpenTelemetry is becoming the native telemetry format: CloudWatch accepts OTLP and is adding PromQL-queryable OpenTelemetry metrics, Google Cloud offers a Telemetry (OTLP) API and Azure Monitor ships an OpenTelemetry distro.", "Governance is shifting to preventive, organisation-wide controls such as AWS resource control policies and declarative policies, the Control Tower landing zone 4.0 controls-only option, Azure Policy and Google Cloud organisation policies.", "Legacy operations tooling is being retired: Azure Update Manager replaced Automation Update Management, Azure Automation State Configuration retires in September 2027 in favour of Machine Configuration, and AWS Systems Manager Incident Manager closed to new customers in November 2025.", "Cost has become an operational KPI, and the FinOps FOCUS specification gives a common billing schema that AWS Data Exports and Azure Cost Management exports already support." ], "roles": [ { "title": "Cloud Operations Engineer", "description": "Runs day-to-day operations of cloud environments: monitoring, patching, backups, access requests, incident response and automating repetitive tasks away." }, { "title": "Cloud Administrator", "description": "Manages accounts, subscriptions, identities, networking and core services on one or more clouds, keeping them secure, compliant and documented." }, { "title": "Landing Zone / Cloud Infrastructure Engineer", "description": "Designs and codifies the account structure, network topology, identity and guardrails that every workload lands on, usually with Terraform and the cloud's landing-zone tooling." }, { "title": "Cloud Resilience Engineer", "description": "Focuses on availability, backup and disaster recovery, chaos experiments and SLO-based alerting for business-critical workloads." } ], "stages": [ { "title": "Cloud & Systems Foundations", "level": "Beginner", "duration_weeks": 4, "description": "Build the operating-system, networking and cloud basics everything else rests on, and learn to drive all three major clouds from the command line.", "milestone": "You can explain the shared responsibility model, map core services across AWS, Azure and Google Cloud and automate simple tasks with CLIs and scripts.", "topics": [ { "title": "Linux & Networking for Cloud Operators", "description": "Most cloud workloads run on Linux and most outages involve networking. Learn system administration, log reading and troubleshooting, plus the TCP/IP, DNS and TLS fundamentals you will use every day.", "est_hours": 14, "optional": false, "concepts": [ "processes, services & systemd", "filesystems & permissions", "logs & journald", "TCP/IP, subnets & CIDR", "DNS & TLS", "troubleshooting with ss, dig, curl & tcpdump" ], "tools": [ "Linux", "Bash" ], "resources": [ { "title": "The Linux Command Line (free book)", "url": "https://linuxcommand.org/tlcl.php", "type": "book", "free": true }, { "title": "Linux roadmap (roadmap.sh)", "url": "https://roadmap.sh/linux", "type": "guide", "free": true }, { "title": "Linux Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/linux/", "type": "course", "free": false } ] }, { "title": "Cloud Fundamentals Across AWS, Azure & Google Cloud", "description": "Understand regions, availability zones, the shared responsibility model and how core compute, storage, database and networking services map across the three hyperscalers, so you can operate confidently in any of them.", "est_hours": 14, "optional": false, "concepts": [ "regions & availability zones", "shared responsibility model", "IaaS, PaaS & serverless", "service mapping across clouds", "pricing models", "service quotas & limits" ], "tools": [ "AWS", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "AWS Shared Responsibility Model", "url": "https://aws.amazon.com/compliance/shared-responsibility-model/", "type": "article", "free": true }, { "title": "Compare AWS and Azure services to Google Cloud", "url": "https://docs.cloud.google.com/docs/get-started/aws-azure-gcp-service-comparison", "type": "docs", "free": true }, { "title": "Microsoft Azure Fundamentals: Describe cloud concepts", "url": "https://learn.microsoft.com/en-us/training/paths/microsoft-azure-fundamentals-describe-cloud-concepts/", "type": "course", "free": true } ] }, { "title": "CLIs, Scripting & Git for Operations", "description": "Operate through code, not consoles. Use the AWS CLI, Azure CLI and gcloud, script with Python and PowerShell, and keep every script and runbook under version control in Git.", "est_hours": 12, "optional": false, "concepts": [ "AWS CLI, Azure CLI & gcloud", "profiles & credentials", "JSON output & query filters", "Python SDKs such as boto3", "PowerShell for Azure", "Git workflows for operations code" ], "tools": [ "Python", "PowerShell", "Git" ], "resources": [ { "title": "AWS Command Line Interface user guide", "url": "https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html", "type": "docs", "free": true }, { "title": "Azure CLI documentation", "url": "https://learn.microsoft.com/en-us/cli/azure/", "type": "docs", "free": true }, { "title": "Google Cloud CLI documentation", "url": "https://docs.cloud.google.com/sdk/docs", "type": "docs", "free": true } ] } ] }, { "title": "Landing Zones, Identity & Governance", "level": "Intermediate", "duration_weeks": 5, "description": "Design the foundations every workload lands on: account and subscription structure, centralised identity, preventive guardrails and security posture monitoring.", "milestone": "You can stand up a governed multi-account landing zone with SSO, centralised logging and both preventive and detective controls.", "topics": [ { "title": "Landing Zones & Resource Hierarchy", "description": "Organise accounts, subscriptions and projects for isolation, billing and policy inheritance using AWS Organizations and Control Tower, Azure management groups and Azure landing zones, and the Google Cloud resource hierarchy.", "est_hours": 16, "optional": false, "concepts": [ "multi-account strategy & OUs", "Control Tower landing zone & Account Factory", "Azure management groups & landing zones", "Google Cloud organisation, folders & projects", "log-archive & audit accounts", "account vending" ], "tools": [ "AWS Control Tower", "AWS Organizations", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "Organizing Your AWS Environment Using Multiple Accounts (whitepaper)", "url": "https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.html", "type": "whitepaper", "free": true }, { "title": "What is an Azure landing zone? (Cloud Adoption Framework)", "url": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/", "type": "docs", "free": true }, { "title": "Landing zone design in Google Cloud", "url": "https://docs.cloud.google.com/architecture/landing-zones", "type": "docs", "free": true } ] }, { "title": "Identity & Least-Privilege Access", "description": "Identity is the new perimeter. Centralise workforce identity with SSO, design role-based access, use just-in-time elevation and replace long-lived keys with federated, short-lived credentials for people, pipelines and workloads.", "est_hours": 14, "optional": false, "concepts": [ "IAM policies & roles", "SSO with IAM Identity Center & Microsoft Entra ID", "Azure RBAC & Privileged Identity Management", "Google Cloud IAM & service accounts", "workload identity federation", "break-glass access" ], "tools": [ "AWS IAM Identity Center", "Microsoft Entra ID" ], "resources": [ { "title": "Security best practices in IAM (AWS)", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html", "type": "docs", "free": true }, { "title": "Microsoft Entra Privileged Identity Management", "url": "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure", "type": "docs", "free": true }, { "title": "Workload Identity Federation (Google Cloud)", "url": "https://docs.cloud.google.com/iam/docs/workload-identity-federation", "type": "docs", "free": true } ] }, { "title": "Guardrails & Policy as Code", "description": "Prevent misconfiguration rather than chase it. Apply service control and resource control policies, Azure Policy and Google Cloud organisation policies, enforce tagging standards and detect drift with configuration rules.", "est_hours": 12, "optional": false, "concepts": [ "service control & resource control policies", "declarative policies", "Azure Policy initiatives & remediation", "organisation policy constraints", "AWS Config rules & conformance packs", "tagging standards" ], "tools": [ "AWS Organizations", "Azure Policy", "AWS Config" ], "resources": [ { "title": "Resource control policies (AWS Organizations)", "url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html", "type": "docs", "free": true }, { "title": "Azure Policy overview", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/overview", "type": "docs", "free": true }, { "title": "Organization Policy Service overview (Google Cloud)", "url": "https://docs.cloud.google.com/organization-policy/overview", "type": "docs", "free": true } ] }, { "title": "Security Posture & Audit Logging", "description": "Turn on and operate the native security services: audit trails, threat detection and cloud security posture management, and route findings to the right owners with clear service levels.", "est_hours": 8, "optional": false, "concepts": [ "CloudTrail, Activity Log & Cloud Audit Logs", "threat detection", "posture findings & benchmarks", "encryption & key management", "finding triage & ownership" ], "tools": [ "AWS Security Hub", "Microsoft Defender for Cloud", "Security Command Center" ], "resources": [ { "title": "What is AWS Security Hub?", "url": "https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html", "type": "docs", "free": true }, { "title": "Microsoft Defender for Cloud overview", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction", "type": "docs", "free": true }, { "title": "Cloud Audit Logs overview (Google Cloud)", "url": "https://docs.cloud.google.com/logging/docs/audit", "type": "docs", "free": true } ] } ] }, { "title": "Networking & Compute Operations", "level": "Intermediate", "duration_weeks": 4, "description": "Operate the network and compute layers: virtual networks, hybrid connectivity, load balancing, autoscaling and containers on managed services.", "milestone": "You can build and troubleshoot a hub-and-spoke network with private connectivity and run autoscaled VM and container workloads behind load balancers.", "topics": [ { "title": "Cloud Networking & Hybrid Connectivity", "description": "Design VPCs and VNets, routing, NAT, private endpoints and DNS, connect them in hub-and-spoke or transit architectures and link on-premises sites with VPN and dedicated circuits.", "est_hours": 16, "optional": false, "concepts": [ "VPC/VNet design & CIDR planning", "security groups, NSGs & firewall rules", "Transit Gateway, Virtual WAN & Network Connectivity Center", "private endpoints & PrivateLink", "hybrid DNS", "VPN, Direct Connect, ExpressRoute & Interconnect" ], "tools": [ "AWS", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "What is Amazon VPC?", "url": "https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html", "type": "docs", "free": true }, { "title": "About Azure Virtual WAN", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about", "type": "docs", "free": true }, { "title": "Network Connectivity Center overview (Google Cloud)", "url": "https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview", "type": "docs", "free": true } ] }, { "title": "Compute, Storage & Managed Services Operations", "description": "Run VMs and managed services in production: images, autoscaling groups, load balancers, storage tiers and lifecycle policies, and managed database maintenance windows, backups and failover.", "est_hours": 14, "optional": false, "concepts": [ "instance sizing & families", "autoscaling & health checks", "load balancers", "block, file & object storage tiers", "lifecycle policies", "managed database maintenance & failover" ], "tools": [ "AWS", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "What is Amazon EC2 Auto Scaling?", "url": "https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html", "type": "docs", "free": true }, { "title": "Azure Virtual Machine Scale Sets overview", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview", "type": "docs", "free": true }, { "title": "Instance groups (Google Compute Engine)", "url": "https://docs.cloud.google.com/compute/docs/instance-groups", "type": "docs", "free": true } ] }, { "title": "Containers on Managed Services", "description": "Containers are now part of everyday cloud operations and of the AWS CloudOps exam. Learn to operate workloads on ECS, EKS, AKS and GKE: node pools, managed upgrades, scaling, logging and access through cloud IAM.", "est_hours": 12, "optional": false, "concepts": [ "container images & registries", "ECS vs EKS vs AKS vs GKE", "node pools & managed upgrades", "cluster autoscaling", "container logs & metrics", "cluster access with cloud IAM" ], "tools": [ "Docker", "Kubernetes" ], "resources": [ { "title": "What is Amazon EKS?", "url": "https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html", "type": "docs", "free": true }, { "title": "What is Azure Kubernetes Service (AKS)?", "url": "https://learn.microsoft.com/en-us/azure/aks/what-is-aks", "type": "docs", "free": true }, { "title": "Kubernetes Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/kubernetes/", "type": "course", "free": false } ] } ] }, { "title": "Infrastructure as Code & Configuration Management", "level": "Intermediate", "duration_weeks": 5, "description": "Make every change reproducible: define infrastructure in code, manage configuration and images declaratively and deliver both through reviewed pipelines.", "milestone": "You can change any part of your environment through a pull request that plans, checks policy and applies infrastructure and configuration automatically.", "topics": [ { "title": "Terraform & OpenTofu for Multi-Cloud", "description": "Terraform and its open source fork OpenTofu are the de facto multi-cloud IaC tools. Learn providers, modules, remote state, imports and drift detection, and how to lay out code for many accounts and environments.", "est_hours": 18, "optional": false, "concepts": [ "providers & resources", "modules & versioning", "remote state & locking", "import & moved blocks", "drift detection", "account and environment layout" ], "tools": [ "Terraform", "OpenTofu" ], "resources": [ { "title": "Get started with Terraform on AWS (tutorial)", "url": "https://developer.hashicorp.com/terraform/tutorials/aws-get-started", "type": "tutorial", "free": true }, { "title": "OpenTofu documentation", "url": "https://opentofu.org/docs/", "type": "docs", "free": true }, { "title": "Terraform Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/terraform/", "type": "course", "free": false } ] }, { "title": "Cloud-Native IaC: CloudFormation, CDK & Bicep", "description": "Each cloud has native IaC that you will meet in landing-zone tooling, vendor templates and exams. Learn to read and operate CloudFormation and CDK stacks, Bicep files and Google Cloud Infrastructure Manager.", "est_hours": 8, "optional": false, "concepts": [ "CloudFormation stacks & StackSets", "AWS CDK constructs", "Bicep modules & deployment stacks", "Infrastructure Manager", "change sets & what-if previews" ], "tools": [ "AWS CloudFormation", "Bicep" ], "resources": [ { "title": "What is AWS CloudFormation?", "url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html", "type": "docs", "free": true }, { "title": "What is Bicep?", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview", "type": "docs", "free": true }, { "title": "Infrastructure Manager overview (Google Cloud)", "url": "https://docs.cloud.google.com/infrastructure-manager/docs/overview", "type": "docs", "free": true } ] }, { "title": "Configuration Management & Golden Images", "description": "Keep servers consistent with declarative configuration and immutable images. Use Ansible for configuration, Packer for golden images and cloud-native state management such as Systems Manager State Manager and Azure Machine Configuration.", "est_hours": 12, "optional": false, "concepts": [ "idempotent playbooks & roles", "dynamic cloud inventories", "golden image pipelines", "immutable vs mutable servers", "State Manager associations", "Azure Machine Configuration" ], "tools": [ "Ansible", "Packer", "AWS Systems Manager" ], "resources": [ { "title": "Getting started with Ansible", "url": "https://docs.ansible.com/projects/ansible/latest/getting_started/index.html", "type": "docs", "free": true }, { "title": "Packer documentation", "url": "https://developer.hashicorp.com/packer/docs", "type": "docs", "free": true }, { "title": "Ansible Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/ansible/", "type": "course", "free": false } ] }, { "title": "CI/CD Pipelines for Infrastructure", "description": "Deliver infrastructure like software: plans on every pull request, automated policy and security checks, approvals and applies, authenticated to the cloud with OIDC instead of stored keys.", "est_hours": 10, "optional": false, "concepts": [ "plan on pull request, apply on merge", "OIDC federation from CI to cloud", "IaC policy & security scanning", "environment promotion & approvals", "state locking in pipelines" ], "tools": [ "GitHub Actions", "GitLab CI/CD", "Terraform" ], "resources": [ { "title": "OpenID Connect in GitHub Actions", "url": "https://docs.github.com/en/actions/concepts/security/openid-connect", "type": "docs", "free": true }, { "title": "GitLab CI/CD documentation", "url": "https://docs.gitlab.com/ci/", "type": "docs", "free": true }, { "title": "HashiCorp Certified Terraform Associate Training — DevOpsSchool", "url": "https://www.devopsschool.com/certification/hashicorp-certified-terraform-associate.html", "type": "course", "free": false } ] } ] }, { "title": "Observability, Monitoring & Incident Response", "level": "Intermediate", "duration_weeks": 4, "description": "See what your workloads are doing and respond when they misbehave, using native cloud monitoring, OpenTelemetry and disciplined on-call practice.", "milestone": "You can instrument a workload, alert on SLO burn instead of raw thresholds and run an incident from page to blameless postmortem.", "topics": [ { "title": "Native Cloud Monitoring & Logging", "description": "Master each cloud's monitoring stack: CloudWatch metrics, logs, alarms and dashboards, Azure Monitor with Log Analytics and KQL, and Google Cloud Observability. Learn cross-account views, log retention and ingestion cost control.", "est_hours": 14, "optional": false, "concepts": [ "metrics, logs & traces", "alarms & composite alarms", "Log Analytics & KQL", "log-based metrics", "cross-account & cross-subscription monitoring", "retention & ingestion cost control" ], "tools": [ "Amazon CloudWatch", "Azure Monitor", "Google Cloud Observability" ], "resources": [ { "title": "What is Amazon CloudWatch?", "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html", "type": "docs", "free": true }, { "title": "Azure Monitor overview", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/overview", "type": "docs", "free": true }, { "title": "Google Cloud Observability documentation", "url": "https://docs.cloud.google.com/stackdriver/docs", "type": "docs", "free": true } ] }, { "title": "OpenTelemetry & Vendor-Neutral Observability", "description": "Standardise telemetry with OpenTelemetry so you can switch or combine back ends. Run the OpenTelemetry Collector, send OTLP to the clouds' native endpoints and use Prometheus and Grafana for multi-cloud views.", "est_hours": 12, "optional": false, "concepts": [ "SDKs & auto-instrumentation", "Collector pipelines", "OTLP endpoints in CloudWatch & Google Cloud", "semantic conventions", "Prometheus metrics & PromQL", "Grafana dashboards" ], "tools": [ "OpenTelemetry", "Prometheus", "Grafana" ], "resources": [ { "title": "OpenTelemetry Collector", "url": "https://opentelemetry.io/docs/collector/", "type": "docs", "free": true }, { "title": "CloudWatch OTLP endpoints", "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html", "type": "docs", "free": true }, { "title": "OpenTelemetry Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/opentelemetry/", "type": "course", "free": false } ] }, { "title": "Alerting, On-Call & Incident Response", "description": "Good operations means fewer, better alerts. Alert on SLOs and user-facing symptoms, write actionable runbooks, run incidents with clear roles and learn from blameless postmortems.", "est_hours": 10, "optional": false, "concepts": [ "SLIs, SLOs & error budgets", "burn-rate alerts", "runbooks & playbooks", "incident roles & communication", "blameless postmortems", "on-call health" ], "tools": [ "PagerDuty" ], "resources": [ { "title": "Alerting on SLOs (Google SRE Workbook)", "url": "https://sre.google/workbook/alerting-on-slos/", "type": "book", "free": true }, { "title": "PagerDuty Incident Response guide", "url": "https://response.pagerduty.com/", "type": "guide", "free": true }, { "title": "Postmortem Culture (Google SRE Book)", "url": "https://sre.google/sre-book/postmortem-culture/", "type": "book", "free": true } ] } ] }, { "title": "Automation, Patching, Backup & Resilience", "level": "Advanced", "duration_weeks": 5, "description": "Automate fleet operations and prove your workloads survive failure, from patch compliance and event-driven remediation to tested disaster recovery.", "milestone": "You can keep a fleet patched and compliant automatically and demonstrate a disaster recovery that meets agreed RTO and RPO.", "topics": [ { "title": "Fleet Management & Patching", "description": "Manage hundreds of servers without SSH keys or bastions: inventory, remote commands, session access and patch baselines with AWS Systems Manager, Azure Update Manager and Google Cloud VM Manager.", "est_hours": 14, "optional": false, "concepts": [ "managed node inventory", "Session Manager instead of bastions", "patch baselines & maintenance windows", "patch compliance reporting", "Run Command at scale", "OS policies & update orchestration" ], "tools": [ "AWS Systems Manager", "Azure Update Manager", "Google Cloud" ], "resources": [ { "title": "AWS Systems Manager Patch Manager", "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html", "type": "docs", "free": true }, { "title": "About Azure Update Manager", "url": "https://learn.microsoft.com/en-us/azure/update-manager/overview", "type": "docs", "free": true }, { "title": "VM Manager (Google Compute Engine)", "url": "https://docs.cloud.google.com/compute/docs/vm-manager", "type": "docs", "free": true } ] }, { "title": "Event-Driven Automation & Runbooks", "description": "Automate the response to routine events with Systems Manager Automation runbooks, EventBridge rules and Lambda, and Azure Automation runbooks, always with approvals, rate limits and safe rollback.", "est_hours": 12, "optional": false, "concepts": [ "Systems Manager Automation runbooks", "EventBridge rules & targets", "serverless functions for operations", "Azure Automation runbooks", "auto-remediation of policy findings", "approvals & rate limits" ], "tools": [ "AWS Systems Manager", "Azure Automation", "Python" ], "resources": [ { "title": "AWS Systems Manager Automation", "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html", "type": "docs", "free": true }, { "title": "What is Amazon EventBridge?", "url": "https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-what-is.html", "type": "docs", "free": true }, { "title": "Azure Automation overview", "url": "https://learn.microsoft.com/en-us/azure/automation/overview", "type": "docs", "free": true } ] }, { "title": "Backup, Disaster Recovery & Reliability", "description": "Design for failure with the reliability pillars of the Well-Architected frameworks. Choose DR strategies from backup and restore to multi-site active-active, centralise backups in immutable vaults and test recovery against RTO and RPO.", "est_hours": 14, "optional": false, "concepts": [ "RTO & RPO", "backup & restore, pilot light, warm standby, active-active", "cross-Region & cross-account backups", "immutable & logically air-gapped vaults", "multi-AZ & zone-redundant design", "resilience assessments" ], "tools": [ "AWS Backup", "Azure Backup", "Azure Site Recovery" ], "resources": [ { "title": "Disaster Recovery of Workloads on AWS (whitepaper)", "url": "https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-workloads-on-aws.html", "type": "whitepaper", "free": true }, { "title": "AWS Well-Architected Reliability Pillar", "url": "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/welcome.html", "type": "guide", "free": true }, { "title": "Azure Well-Architected Framework: Reliability", "url": "https://learn.microsoft.com/en-us/azure/well-architected/reliability/", "type": "guide", "free": true } ] }, { "title": "Chaos Engineering & Game Days", "description": "Validate resilience assumptions with controlled fault injection and scheduled game days using AWS Fault Injection Service and Azure Chaos Studio, then feed findings back into the backlog.", "est_hours": 8, "optional": true, "concepts": [ "steady-state hypothesis", "blast radius & stop conditions", "zone and dependency failure experiments", "game day facilitation", "tracking resilience fixes" ], "tools": [ "AWS Fault Injection Service", "Azure Chaos Studio" ], "resources": [ { "title": "Principles of Chaos Engineering", "url": "https://principlesofchaos.org/", "type": "article", "free": true }, { "title": "What is AWS Fault Injection Service?", "url": "https://docs.aws.amazon.com/fis/latest/userguide/what-is.html", "type": "docs", "free": true }, { "title": "Chaos Engineering Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/chaos-engineering/", "type": "course", "free": false } ] } ] }, { "title": "Cost, Multi-Cloud & AI-Assisted Operations", "level": "Advanced", "duration_weeks": 4, "description": "Operate at organisational scale: make cost visible and actionable, run hybrid and multi-cloud estates consistently and put AI operations agents to work under proper guardrails.", "milestone": "You can run a multi-cloud estate with consistent governance and cost reporting, and use AI agents to speed up investigations without giving up control.", "topics": [ { "title": "Cost Awareness & FinOps for Operators", "description": "Operators control most of the levers that drive cloud cost. Enforce allocation tags, set budgets and anomaly alerts, rightsize and schedule resources, manage commitments and use FOCUS-formatted billing data for cross-cloud reporting.", "est_hours": 10, "optional": false, "concepts": [ "cost allocation tags", "budgets & anomaly detection", "rightsizing & scheduling", "savings plans, reservations & committed use discounts", "storage & data transfer costs", "FOCUS billing data" ], "tools": [ "AWS", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "What is AWS Billing and Cost Management?", "url": "https://docs.aws.amazon.com/cost-management/latest/userguide/what-is-costmanagement.html", "type": "docs", "free": true }, { "title": "FinOps Open Cost and Usage Specification (FOCUS)", "url": "https://focus.finops.org/", "type": "docs", "free": true }, { "title": "FinOps Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/finops/", "type": "course", "free": false } ] }, { "title": "Hybrid & Multi-Cloud Operations", "description": "Few enterprises run a single cloud. Extend management to on-premises and other clouds with Azure Arc and Systems Manager hybrid nodes, standardise on Terraform, OpenTelemetry and Kubernetes, and federate identity and logging across providers.", "est_hours": 12, "optional": false, "concepts": [ "Arc-enabled servers & Kubernetes", "Systems Manager hybrid & multicloud nodes", "cross-cloud identity federation", "central logging & SIEM", "consistent tagging & policy", "when multi-cloud is and is not worth it" ], "tools": [ "Azure Arc", "AWS Systems Manager", "Terraform", "Kubernetes" ], "resources": [ { "title": "Azure Arc overview", "url": "https://learn.microsoft.com/en-us/azure/azure-arc/overview", "type": "docs", "free": true }, { "title": "Systems Manager for hybrid and multicloud environments", "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-hybrid-multicloud.html", "type": "docs", "free": true }, { "title": "CloudOps Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/cloudops/", "type": "course", "free": false } ] }, { "title": "AI-Assisted Operations & Agents", "description": "AI agents now investigate incidents, correlate deployments with telemetry and propose mitigations. Learn how AWS DevOps Agent, Azure SRE Agent and Gemini Cloud Assist work, connect assistants to clouds through MCP servers, and govern them with least-privilege roles, approval modes and audit.", "est_hours": 10, "optional": false, "concepts": [ "AI-driven root-cause investigations", "read-only vs approved write actions", "MCP servers for cloud APIs", "agent identity & least privilege", "approval workflows & audit trails", "evaluating agent accuracy" ], "tools": [ "AWS DevOps Agent", "Azure SRE Agent", "Gemini Cloud Assist" ], "resources": [ { "title": "AWS DevOps Agent user guide", "url": "https://docs.aws.amazon.com/devopsagent/latest/userguide/", "type": "docs", "free": true }, { "title": "Overview of Azure SRE Agent", "url": "https://learn.microsoft.com/en-us/azure/sre-agent/overview", "type": "docs", "free": true }, { "title": "Gemini Cloud Assist investigations", "url": "https://docs.cloud.google.com/cloud-assist/investigations", "type": "docs", "free": true } ] }, { "title": "Operational Excellence & Well-Architected Reviews", "description": "Close the loop with continuous improvement: run Well-Architected reviews, track operational metrics and toil, prioritise remediation and keep runbooks and automation current.", "est_hours": 8, "optional": false, "concepts": [ "operational excellence pillar", "Well-Architected reviews", "operational readiness reviews", "toil measurement & reduction", "change management", "continuous improvement backlog" ], "tools": [], "resources": [ { "title": "AWS Well-Architected Operational Excellence Pillar", "url": "https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/welcome.html", "type": "guide", "free": true }, { "title": "Azure Well-Architected Framework: Operational Excellence", "url": "https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/", "type": "guide", "free": true }, { "title": "Google Cloud Well-Architected Framework: Operational excellence", "url": "https://docs.cloud.google.com/architecture/framework/operational-excellence", "type": "guide", "free": true } ] } ] } ], "projects": [ { "title": "Cross-Cloud Inventory Toolkit", "description": "Write a Git-versioned set of Python and shell scripts that inventories compute, storage and public IPs in AWS, Azure and Google Cloud sandbox accounts, flags untagged or idle resources and produces a single CSV report.", "difficulty": "Beginner", "skills": [ "AWS CLI", "Azure CLI", "gcloud", "Python", "tagging" ] }, { "title": "Governed Multi-Account Landing Zone", "description": "Use Terraform with AWS Organizations or Control Tower to create security, log-archive and workload accounts with IAM Identity Center SSO, an organisation trail, SCPs and an RCP, then implement equivalent guardrails with Azure Policy or Google Cloud organisation policies.", "difficulty": "Intermediate", "skills": [ "AWS Control Tower", "IAM Identity Center", "Terraform", "Azure Policy", "governance" ] }, { "title": "Patch & Compliance Autopilot", "description": "Bring a mixed Linux and Windows fleet, including one on-premises or Arc-enabled server, under Systems Manager or Azure Update Manager with patch baselines, maintenance windows, a compliance dashboard and an automated remediation runbook for non-compliant nodes.", "difficulty": "Intermediate", "skills": [ "AWS Systems Manager", "Azure Update Manager", "Azure Arc", "automation runbooks" ] }, { "title": "Multi-Cloud Observability with OpenTelemetry", "description": "Deploy a sample microservice on two clouds, instrument it with OpenTelemetry, route telemetry through a Collector to CloudWatch, Google Cloud Observability and Grafana, and alert on SLO burn rates with linked runbooks.", "difficulty": "Advanced", "skills": [ "OpenTelemetry", "Amazon CloudWatch", "Google Cloud Observability", "Grafana", "SLOs" ] }, { "title": "Tested Cross-Region Disaster Recovery", "description": "Implement a pilot-light or warm-standby design with AWS Backup cross-Region and cross-account copies or Azure Site Recovery, inject a regional failure with AWS FIS or Azure Chaos Studio, and report measured RTO and RPO against targets.", "difficulty": "Advanced", "skills": [ "AWS Backup", "Azure Site Recovery", "AWS Fault Injection Service", "DR runbooks" ] }, { "title": "AI-Assisted Incident Triage with Guardrails", "description": "Connect AWS DevOps Agent, Azure SRE Agent or an MCP-based assistant to a lab workload with read-only roles, replay three staged incidents, compare its root-cause findings with your own and write an approval and audit policy for any write actions.", "difficulty": "Advanced", "skills": [ "AWS DevOps Agent", "Azure SRE Agent", "least privilege", "incident response" ] } ], "certifications": [ { "name": "CloudOps Foundation Certified (CloudOps-FC)", "provider": "DevOpsSchool", "url": "https://www.devopsschool.com/certification/cloudops-foundation-certification.html", "level": "Foundation", "note": "Multi-cloud foundation covering AWS, Azure and Google Cloud operations, Terraform, monitoring, cost and DR, aligned with the early stages of this path." }, { "name": "AWS Certified CloudOps Engineer – Associate", "provider": "Amazon Web Services", "url": "https://aws.amazon.com/certification/certified-cloudops-engineer-associate/", "level": "Associate", "note": "The renamed SysOps Administrator exam (SOA-C03 since September 2025) covering monitoring, reliability, automation, security, networking and cost on AWS; the flagship certification for this path." }, { "name": "Microsoft Certified: Azure Administrator Associate (AZ-104)", "provider": "Microsoft", "url": "https://learn.microsoft.com/en-us/credentials/certifications/azure-administrator/", "level": "Associate", "note": "Validates identity, governance, storage, compute, networking and monitoring administration on Azure, the Azure counterpart to the AWS CloudOps exam." }, { "name": "Google Cloud Associate Cloud Engineer", "provider": "Google Cloud", "url": "https://cloud.google.com/learn/certification/cloud-engineer", "level": "Associate", "note": "Tests setting up, deploying, operating and securing Google Cloud environments, rounding out multi-cloud operations skills." }, { "name": "HashiCorp Certified: Terraform Associate (004)", "provider": "HashiCorp", "url": "https://developer.hashicorp.com/certifications/terraform-associate", "level": "Associate", "note": "Proves the multi-cloud infrastructure-as-code skills used throughout this path; the current 004 exam tests Terraform 1.12." }, { "name": "AWS Certified DevOps Engineer – Professional", "provider": "Amazon Web Services", "url": "https://aws.amazon.com/certification/certified-devops-engineer-professional/", "level": "Professional", "note": "The natural next step after the CloudOps Engineer associate, covering automation, resilience, monitoring and incident response at professional depth." } ], "tools_catalog": [ { "name": "Amazon CloudWatch", "category": "Observability", "website": "https://aws.amazon.com/cloudwatch/", "ds_course_url": "" }, { "name": "Ansible", "category": "Infrastructure as Code & Automation", "website": "https://docs.ansible.com/", "ds_course_url": "https://www.devopsschool.com/courses/ansible/" }, { "name": "AWS", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/", "ds_course_url": "https://www.devopsschool.com/courses/aws/" }, { "name": "AWS Backup", "category": "Reliability & Resilience", "website": "https://aws.amazon.com/backup/", "ds_course_url": "" }, { "name": "AWS CloudFormation", "category": "Infrastructure as Code & Automation", "website": "https://aws.amazon.com/cloudformation/", "ds_course_url": "" }, { "name": "AWS Config", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/config/", "ds_course_url": "" }, { "name": "AWS Control Tower", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/controltower/", "ds_course_url": "" }, { "name": "AWS DevOps Agent", "category": "AIOps & Incident Management", "website": "https://aws.amazon.com/devops-agent/", "ds_course_url": "" }, { "name": "AWS Fault Injection Service", "category": "Reliability & Resilience", "website": "https://aws.amazon.com/fis/", "ds_course_url": "https://www.devopsschool.com/courses/chaos-engineering/" }, { "name": "AWS IAM Identity Center", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/iam/identity-center/", "ds_course_url": "" }, { "name": "AWS Organizations", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/organizations/", "ds_course_url": "" }, { "name": "AWS Security Hub", "category": "Security & Supply Chain", "website": "https://aws.amazon.com/security-hub/", "ds_course_url": "" }, { "name": "AWS Systems Manager", "category": "Infrastructure as Code & Automation", "website": "https://aws.amazon.com/systems-manager/", "ds_course_url": "" }, { "name": "Azure Arc", "category": "Cloud Platforms & Governance", "website": "https://azure.microsoft.com/en-us/products/azure-arc/", "ds_course_url": "" }, { "name": "Azure Automation", "category": "Infrastructure as Code & Automation", "website": "https://azure.microsoft.com/en-us/products/automation/", "ds_course_url": "" }, { "name": "Azure Backup", "category": "Reliability & Resilience", "website": "https://azure.microsoft.com/en-us/products/backup/", "ds_course_url": "" }, { "name": "Azure Chaos Studio", "category": "Reliability & Resilience", "website": "https://azure.microsoft.com/en-us/products/chaos-studio/", "ds_course_url": "https://www.devopsschool.com/courses/chaos-engineering/" }, { "name": "Azure Monitor", "category": "Observability", "website": "https://azure.microsoft.com/en-us/products/monitor/", "ds_course_url": "" }, { "name": "Azure Policy", "category": "Cloud Platforms & Governance", "website": "https://azure.microsoft.com/en-us/products/azure-policy/", "ds_course_url": "" }, { "name": "Azure Site Recovery", "category": "Reliability & Resilience", "website": "https://azure.microsoft.com/en-us/products/site-recovery/", "ds_course_url": "" }, { "name": "Azure SRE Agent", "category": "AIOps & Incident Management", "website": "https://learn.microsoft.com/en-us/azure/sre-agent/overview", "ds_course_url": "" }, { "name": "Azure Update Manager", "category": "Infrastructure as Code & Automation", "website": "https://learn.microsoft.com/en-us/azure/update-manager/overview", "ds_course_url": "" }, { "name": "Bash", "category": "Foundations & Languages", "website": "https://www.gnu.org/software/bash/", "ds_course_url": "https://www.devopsschool.com/courses/bashscripting/" }, { "name": "Bicep", "category": "Infrastructure as Code & Automation", "website": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview", "ds_course_url": "" }, { "name": "Docker", "category": "Containers & Kubernetes", "website": "https://www.docker.com/", "ds_course_url": "https://www.devopsschool.com/courses/docker/" }, { "name": "Gemini Cloud Assist", "category": "AIOps & Incident Management", "website": "https://cloud.google.com/products/gemini/cloud-assist", "ds_course_url": "" }, { "name": "Git", "category": "Foundations & Languages", "website": "https://git-scm.com/", "ds_course_url": "https://www.devopsschool.com/courses/git/" }, { "name": "GitHub Actions", "category": "CI/CD & Release", "website": "https://github.com/features/actions", "ds_course_url": "https://www.devopsschool.com/courses/github/" }, { "name": "GitLab CI/CD", "category": "CI/CD & Release", "website": "https://docs.gitlab.com/ci/", "ds_course_url": "https://www.devopsschool.com/courses/gitlab/" }, { "name": "Google Cloud", "category": "Cloud Platforms & Governance", "website": "https://cloud.google.com/", "ds_course_url": "https://www.devopsschool.com/courses/googlecloud/" }, { "name": "Google Cloud Observability", "category": "Observability", "website": "https://cloud.google.com/products/observability", "ds_course_url": "" }, { "name": "Grafana", "category": "Observability", "website": "https://grafana.com/", "ds_course_url": "https://www.devopsschool.com/courses/grafana/" }, { "name": "Kubernetes", "category": "Containers & Kubernetes", "website": "https://kubernetes.io/", "ds_course_url": "https://www.devopsschool.com/courses/kubernetes/" }, { "name": "Linux", "category": "Foundations & Languages", "website": "https://www.kernel.org/", "ds_course_url": "https://www.devopsschool.com/courses/linux/" }, { "name": "Microsoft Azure", "category": "Cloud Platforms & Governance", "website": "https://azure.microsoft.com/", "ds_course_url": "https://www.devopsschool.com/courses/azure/" }, { "name": "Microsoft Defender for Cloud", "category": "Security & Supply Chain", "website": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction", "ds_course_url": "" }, { "name": "Microsoft Entra ID", "category": "Cloud Platforms & Governance", "website": "https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id", "ds_course_url": "" }, { "name": "OpenTelemetry", "category": "Observability", "website": "https://opentelemetry.io/", "ds_course_url": "https://www.devopsschool.com/courses/opentelemetry/" }, { "name": "OpenTofu", "category": "Infrastructure as Code & Automation", "website": "https://opentofu.org/", "ds_course_url": "https://www.devopsschool.com/courses/opentofu/" }, { "name": "Packer", "category": "Infrastructure as Code & Automation", "website": "https://developer.hashicorp.com/packer", "ds_course_url": "https://www.devopsschool.com/courses/packer/" }, { "name": "PagerDuty", "category": "AIOps & Incident Management", "website": "https://www.pagerduty.com/", "ds_course_url": "" }, { "name": "PowerShell", "category": "Foundations & Languages", "website": "https://learn.microsoft.com/en-us/powershell/", "ds_course_url": "https://www.devopsschool.com/courses/powershell/" }, { "name": "Prometheus", "category": "Observability", "website": "https://prometheus.io/", "ds_course_url": "https://www.devopsschool.com/courses/prometheus/" }, { "name": "Python", "category": "Foundations & Languages", "website": "https://www.python.org/", "ds_course_url": "https://www.devopsschool.com/courses/python/" }, { "name": "Security Command Center", "category": "Security & Supply Chain", "website": "https://cloud.google.com/security/products/security-command-center", "ds_course_url": "" }, { "name": "Terraform", "category": "Infrastructure as Code & Automation", "website": "https://developer.hashicorp.com/terraform", "ds_course_url": "https://www.devopsschool.com/courses/terraform/" } ], "faqs": [ { "q": "What is CloudOps and how is it different from DevOps and SRE?", "a": "CloudOps is the day-to-day operation of cloud environments: foundations, access, monitoring, patching, backup, governance and cost. DevOps is the broader culture of fast, automated delivery, and SRE applies software engineering and SLOs to reliability. In practice the roles overlap heavily, and CloudOps engineers use DevOps automation and SRE practices to run the cloud estate." }, { "q": "Did AWS retire the SysOps Administrator certification?", "a": "It was renamed rather than dropped. The SOA-C02 exam retired on 29 September 2025 and was replaced the next day by SOA-C03, now called AWS Certified CloudOps Engineer – Associate, which adds containers, multi-account and multi-Region scenarios and more infrastructure as code." }, { "q": "Should I learn AWS, Azure or Google Cloud first?", "a": "Start with the cloud your current or target employer uses; if you have no preference, AWS has the largest job market, and Azure is dominant in Microsoft-centric enterprises. Learn one deeply first, then map the same concepts to the other two, which is much faster once you understand landing zones, IAM, networking and monitoring on one platform." }, { "q": "Do CloudOps engineers need to code?", "a": "Yes, but mainly for automation rather than application development. Expect to write Terraform or OpenTofu, Python or PowerShell scripts, CI/CD pipeline definitions and runbooks, and to review code changes through pull requests." }, { "q": "How long does it take to become a CloudOps engineer?", "a": "At about 10 hours a week this path takes roughly seven to eight months. Experienced system administrators often move faster through the foundations, and many learners take the AWS CloudOps Engineer, AZ-104 or Associate Cloud Engineer exam after the observability stage." }, { "q": "Will AI agents replace CloudOps engineers?", "a": "AI agents such as AWS DevOps Agent and Azure SRE Agent are automating first-line investigation and routine tasks, but they need engineers to define permissions, runbooks, guardrails and approval workflows and to own the outcome. The role is shifting from manual toil towards designing, governing and supervising automation." } ], "related": [ "devops", "sre", "finops", "platform-engineering" ], "key_tools": [ "AWS", "Microsoft Azure", "Google Cloud", "Terraform", "AWS Systems Manager", "Kubernetes" ], "course_url": "https://www.devopsschool.com/courses/cloudops/", "seo_title": "CloudOps Learning Path 2026: AWS, Azure & GCP Roadmap", "seo_description": "CloudOps roadmap for 2026: landing zones, IAM, Terraform, monitoring, OpenTelemetry, patching, DR, governance, cost and AI ops across AWS, Azure and GCP.", "url": "https://www.devopsschool.com/path/cloudops/", "updated_at": "2026-10-26 08:58:45" }