Run secure, reliable and cost-aware workloads on AWS, Azure and Google Cloud with automation-first operations.
Learn to operate production cloud environments across AWS, Azure and Google Cloud: landing zones, identity, networking, infrastructure as code, monitoring, patching, backup and disaster recovery, governance and cost. The path finishes with hybrid and multi-cloud operations and the AI agents that are reshaping incident response in 2026.
Cloud Operations (CloudOps) is the discipline of keeping cloud workloads secure, available, compliant and cost-efficient every day. CloudOps engineers design account and network foundations, automate provisioning and configuration, watch telemetry, patch fleets, protect data, respond to incidents and continuously enforce governance guardrails.
The role has been renamed and modernised. In September 2025 AWS replaced its SysOps Administrator certification with AWS Certified CloudOps Engineer – Associate, adding containers, multi-account and multi-Region operations and more infrastructure as code. At the same time OpenTelemetry has become a native ingestion format on the major clouds, and AI operations agents such as AWS DevOps Agent, Azure SRE Agent and Gemini Cloud Assist investigations now triage incidents alongside humans.
CloudOps sits between neighbouring disciplines: it applies DevOps automation to infrastructure, shares SLOs and incident practice with SRE, feeds cost data to FinOps, runs the foundations platform engineering teams build on and implements the controls DevSecOps defines. This path is multi-cloud by design, using AWS as the primary lab environment with Azure and Google Cloud equivalents at every stage.
7 stages · 25 topics · ~304 hours of focused learning. Work through the stages in order; optional topics are electives you can come back to.
Build the operating-system, networking and cloud basics everything else rests on, and learn to drive all three major clouds from the command line.
Most cloud workloads run on Linux and most outages involve networking. Learn system administration, log reading and troubleshooting, plus the TCP/IP, DNS and TLS fundamentals you will use every day.
Understand regions, availability zones, the shared responsibility model and how core compute, storage, database and networking services map across the three hyperscalers, so you can operate confidently in any of them.
Operate through code, not consoles. Use the AWS CLI, Azure CLI and gcloud, script with Python and PowerShell, and keep every script and runbook under version control in Git.
Milestone: You can explain the shared responsibility model, map core services across AWS, Azure and Google Cloud and automate simple tasks with CLIs and scripts.
Design the foundations every workload lands on: account and subscription structure, centralised identity, preventive guardrails and security posture monitoring.
Organise accounts, subscriptions and projects for isolation, billing and policy inheritance using AWS Organizations and Control Tower, Azure management groups and Azure landing zones, and the Google Cloud resource hierarchy.
Identity is the new perimeter. Centralise workforce identity with SSO, design role-based access, use just-in-time elevation and replace long-lived keys with federated, short-lived credentials for people, pipelines and workloads.
Prevent misconfiguration rather than chase it. Apply service control and resource control policies, Azure Policy and Google Cloud organisation policies, enforce tagging standards and detect drift with configuration rules.
Turn on and operate the native security services: audit trails, threat detection and cloud security posture management, and route findings to the right owners with clear service levels.
Milestone: You can stand up a governed multi-account landing zone with SSO, centralised logging and both preventive and detective controls.
Operate the network and compute layers: virtual networks, hybrid connectivity, load balancing, autoscaling and containers on managed services.
Design VPCs and VNets, routing, NAT, private endpoints and DNS, connect them in hub-and-spoke or transit architectures and link on-premises sites with VPN and dedicated circuits.
Run VMs and managed services in production: images, autoscaling groups, load balancers, storage tiers and lifecycle policies, and managed database maintenance windows, backups and failover.
Containers are now part of everyday cloud operations and of the AWS CloudOps exam. Learn to operate workloads on ECS, EKS, AKS and GKE: node pools, managed upgrades, scaling, logging and access through cloud IAM.
Milestone: You can build and troubleshoot a hub-and-spoke network with private connectivity and run autoscaled VM and container workloads behind load balancers.
Make every change reproducible: define infrastructure in code, manage configuration and images declaratively and deliver both through reviewed pipelines.
Terraform and its open source fork OpenTofu are the de facto multi-cloud IaC tools. Learn providers, modules, remote state, imports and drift detection, and how to lay out code for many accounts and environments.
Each cloud has native IaC that you will meet in landing-zone tooling, vendor templates and exams. Learn to read and operate CloudFormation and CDK stacks, Bicep files and Google Cloud Infrastructure Manager.
Keep servers consistent with declarative configuration and immutable images. Use Ansible for configuration, Packer for golden images and cloud-native state management such as Systems Manager State Manager and Azure Machine Configuration.
Deliver infrastructure like software: plans on every pull request, automated policy and security checks, approvals and applies, authenticated to the cloud with OIDC instead of stored keys.
Milestone: You can change any part of your environment through a pull request that plans, checks policy and applies infrastructure and configuration automatically.
See what your workloads are doing and respond when they misbehave, using native cloud monitoring, OpenTelemetry and disciplined on-call practice.
Master each cloud's monitoring stack: CloudWatch metrics, logs, alarms and dashboards, Azure Monitor with Log Analytics and KQL, and Google Cloud Observability. Learn cross-account views, log retention and ingestion cost control.
Standardise telemetry with OpenTelemetry so you can switch or combine back ends. Run the OpenTelemetry Collector, send OTLP to the clouds' native endpoints and use Prometheus and Grafana for multi-cloud views.
Good operations means fewer, better alerts. Alert on SLOs and user-facing symptoms, write actionable runbooks, run incidents with clear roles and learn from blameless postmortems.
Milestone: You can instrument a workload, alert on SLO burn instead of raw thresholds and run an incident from page to blameless postmortem.
Automate fleet operations and prove your workloads survive failure, from patch compliance and event-driven remediation to tested disaster recovery.
Manage hundreds of servers without SSH keys or bastions: inventory, remote commands, session access and patch baselines with AWS Systems Manager, Azure Update Manager and Google Cloud VM Manager.
Automate the response to routine events with Systems Manager Automation runbooks, EventBridge rules and Lambda, and Azure Automation runbooks, always with approvals, rate limits and safe rollback.
Design for failure with the reliability pillars of the Well-Architected frameworks. Choose DR strategies from backup and restore to multi-site active-active, centralise backups in immutable vaults and test recovery against RTO and RPO.
Validate resilience assumptions with controlled fault injection and scheduled game days using AWS Fault Injection Service and Azure Chaos Studio, then feed findings back into the backlog.
Milestone: You can keep a fleet patched and compliant automatically and demonstrate a disaster recovery that meets agreed RTO and RPO.
Operate at organisational scale: make cost visible and actionable, run hybrid and multi-cloud estates consistently and put AI operations agents to work under proper guardrails.
Operators control most of the levers that drive cloud cost. Enforce allocation tags, set budgets and anomaly alerts, rightsize and schedule resources, manage commitments and use FOCUS-formatted billing data for cross-cloud reporting.
Few enterprises run a single cloud. Extend management to on-premises and other clouds with Azure Arc and Systems Manager hybrid nodes, standardise on Terraform, OpenTelemetry and Kubernetes, and federate identity and logging across providers.
AI agents now investigate incidents, correlate deployments with telemetry and propose mitigations. Learn how AWS DevOps Agent, Azure SRE Agent and Gemini Cloud Assist work, connect assistants to clouds through MCP servers, and govern them with least-privilege roles, approval modes and audit.
Close the loop with continuous improvement: run Well-Architected reviews, track operational metrics and toil, prioritise remediation and keep runbooks and automation current.
Milestone: You can run a multi-cloud estate with consistent governance and cost reporting, and use AI agents to speed up investigations without giving up control.
46 tools and platforms used across this path. Focus on concepts first — tools change, principles don’t.
Build these to prove your skills. Publish each one on GitHub with a clear README and architecture diagram.
Write a Git-versioned set of Python and shell scripts that inventories compute, storage and public IPs in AWS, Azure and Google Cloud sandbox accounts, flags untagged or idle resources and produces a single CSV report.
Use Terraform with AWS Organizations or Control Tower to create security, log-archive and workload accounts with IAM Identity Center SSO, an organisation trail, SCPs and an RCP, then implement equivalent guardrails with Azure Policy or Google Cloud organisation policies.
Bring a mixed Linux and Windows fleet, including one on-premises or Arc-enabled server, under Systems Manager or Azure Update Manager with patch baselines, maintenance windows, a compliance dashboard and an automated remediation runbook for non-compliant nodes.
Deploy a sample microservice on two clouds, instrument it with OpenTelemetry, route telemetry through a Collector to CloudWatch, Google Cloud Observability and Grafana, and alert on SLO burn rates with linked runbooks.
Implement a pilot-light or warm-standby design with AWS Backup cross-Region and cross-account copies or Azure Site Recovery, inject a regional failure with AWS FIS or Azure Chaos Studio, and report measured RTO and RPO against targets.
Connect AWS DevOps Agent, Azure SRE Agent or an MCP-based assistant to a lab workload with read-only roles, replay three staged incidents, compare its root-cause findings with your own and write an approval and audit policy for any write actions.
Certifications that validate this path’s skills. Always confirm the current exam version on the official page before booking.
DevOpsSchool
Multi-cloud foundation covering AWS, Azure and Google Cloud operations, Terraform, monitoring, cost and DR, aligned with the early stages of this path.
Official pageAmazon Web Services
The renamed SysOps Administrator exam (SOA-C03 since September 2025) covering monitoring, reliability, automation, security, networking and cost on AWS; the flagship certification for this path.
Official pageMicrosoft
Validates identity, governance, storage, compute, networking and monitoring administration on Azure, the Azure counterpart to the AWS CloudOps exam.
Official pageGoogle Cloud
Tests setting up, deploying, operating and securing Google Cloud environments, rounding out multi-cloud operations skills.
Official pageHashiCorp
Proves the multi-cloud infrastructure-as-code skills used throughout this path; the current 004 exam tests Terraform 1.12.
Official pageAmazon Web Services
The natural next step after the CloudOps Engineer associate, covering automation, resilience, monitoring and incident response at professional depth.
Official pageRoles that hire for these skills.
Runs day-to-day operations of cloud environments: monitoring, patching, backups, access requests, incident response and automating repetitive tasks away.
Manages accounts, subscriptions, identities, networking and core services on one or more clouds, keeping them secure, compliant and documented.
Designs and codifies the account structure, network topology, identity and guardrails that every workload lands on, usually with Terraform and the cloud's landing-zone tooling.
Focuses on availability, backup and disaster recovery, chaos experiments and SLO-based alerting for business-critical workloads.
CloudOps is the day-to-day operation of cloud environments: foundations, access, monitoring, patching, backup, governance and cost. DevOps is the broader culture of fast, automated delivery, and SRE applies software engineering and SLOs to reliability. In practice the roles overlap heavily, and CloudOps engineers use DevOps automation and SRE practices to run the cloud estate.
It was renamed rather than dropped. The SOA-C02 exam retired on 29 September 2025 and was replaced the next day by SOA-C03, now called AWS Certified CloudOps Engineer – Associate, which adds containers, multi-account and multi-Region scenarios and more infrastructure as code.
Start with the cloud your current or target employer uses; if you have no preference, AWS has the largest job market, and Azure is dominant in Microsoft-centric enterprises. Learn one deeply first, then map the same concepts to the other two, which is much faster once you understand landing zones, IAM, networking and monitoring on one platform.
Yes, but mainly for automation rather than application development. Expect to write Terraform or OpenTofu, Python or PowerShell scripts, CI/CD pipeline definitions and runbooks, and to review code changes through pull requests.
At about 10 hours a week this path takes roughly seven to eight months. Experienced system administrators often move faster through the foundations, and many learners take the AWS CloudOps Engineer, AZ-104 or Associate Cloud Engineer exam after the observability stage.
AI agents such as AWS DevOps Agent and Azure SRE Agent are automating first-line investigation and routine tasks, but they need engineers to define permissions, runbooks, guardrails and approval workflows and to own the outcome. The role is shifting from manual toil towards designing, governing and supervising automation.
Join DevOpsSchool instructor-led programs with hands-on labs, real-world projects and certification guidance.
Roadmap reviewed October 2026 · Last updated 26 Oct 2026 · JSON