Skip to main content
Course · 38 lessons

Cloud Engineer Roadmap.

A course on AWS, Azure and GCP side by side: identity, compute, storage, networking, managed services, IaC and cost, then the patterns that transfer between them.

A cloud engineer isn’t an “AWS engineer” or an “Azure engineer” — the job is knowing how the same problem gets solved across vendors, and when that even matters. This path teaches AWS, Azure, and GCP in parallel, then layers in the vendor-agnostic comparisons that show what actually transfers.

Beginner — one vendor’s shape, three times over

  • AWS: account/IAM basics, EC2 virtual machines, S3 object storage.
  • Azure: Entra ID identity and RBAC, Virtual Machines, Blob Storage.
  • GCP: IAM roles and service accounts, Compute Engine, Cloud Storage.

By the end you’ve provisioned compute, storage, and identity on all three — the same core shape, three different names.

Intermediate — networking, managed services, and what transfers

  • Cross-cloud: a real decision framework for picking a vendor, IAM concepts mapped AWS ↔ Azure ↔ GCP, and how each vendor names its compute instance types.
  • Each vendor: VPC/VNet networking, a managed relational database, a serverless compute service (Lambda / Azure Functions / Cloud Run), infrastructure as code (CloudFormation / Bicep / Deployment Manager), and monitoring basics.
  • Cross-cloud: one object-storage script rewritten against all three APIs, and which networking concepts are identical everywhere versus vendor-specific.

Advanced — cost, architecture tradeoffs, and multi-cloud patterns

  • Each vendor: cost management and the Well-Architected-style tradeoffs specific to it.
  • Cross-cloud: managed database selection, a serverless cost comparison across all three, and a single Terraform pattern parameterized to deploy to any of them.

The roadmap, step by step

1
aws Step 1 of 38

Introduction to AWS

What AWS regions and availability zones really are, then configure the CLI and confirm your identity against LocalStack with no AWS account required.

2
aws Step 2 of 38

IAM: Users, Roles, and Policies

Create a least-privilege IAM policy, attach it to a user, hit a real AccessDenied error, then read the policy to see exactly what was missing.

3
aws Step 3 of 38

EC2 Fundamentals

Launch an EC2 instance behind a security group with Terraform, SSH into it, and read the exact CLI output that confirms each step worked.

4
aws Step 4 of 38

S3 Fundamentals

Create a bucket, upload and download objects, attach a bucket policy, and turn on versioning to recover an overwritten file — all against LocalStack.

5
azure Step 5 of 38

Introduction to Azure

Understand Azure's subscription and resource-group model, then log in with the CLI and confirm which subscription your commands will actually hit.

6
azure Step 6 of 38

Entra ID: Users, Roles, and RBAC

Create a role assignment scoped too narrowly, hit a real authorization error, then fix the scope and watch the same command succeed.

7
azure Step 7 of 38

Azure Virtual Machines Fundamentals

Create a Linux VM with az vm create, open port 22 through its network security group, and connect over SSH using the generated key pair.

8
azure Step 8 of 38

Azure Blob Storage Fundamentals

Create a storage account and container, upload and download a blob with az storage blob, and compare hot, cool, and archive access tiers.

9
gcp Step 9 of 38

Introduction to Google Cloud Platform

Create a free-tier GCP account, understand the project and billing-account model, and get gcloud authenticated against a real project.

10
gcp Step 10 of 38

GCP IAM: Roles and Service Accounts

Create a service account, watch it fail with PERMISSION_DENIED, then grant exactly the role it needs — the real workflow behind every GCP access error.

11
gcp Step 11 of 38

Compute Engine Fundamentals

Create a Compute Engine VM from the command line, open a firewall rule for SSH, and connect to it — the smallest complete GCP virtual machine workflow.

12
gcp Step 12 of 38

Cloud Storage Fundamentals

Create a bucket, upload and download objects with gcloud storage, and compare storage classes with real per-GB pricing and retrieval costs.

13
cloud Step 13 of 38

Choosing a Cloud: A Decision Framework With Real Numbers

A weighted scoring framework — team skills, egress cost, service maturity, lock-in risk — run against three real scenarios to a concrete recommendation.

14
cloud Step 14 of 38

IAM Concepts That Transfer: AWS vs Azure vs GCP

Grant read-only access to one bucket, done in AWS IAM, Azure RBAC, and GCP IAM side by side — the vocabulary differs, the underlying model doesn't.

15
cloud Step 15 of 38

Compute Instance Types Decoded: AWS vs Azure vs GCP

One workload — 4 vCPU, 16 GB RAM, general purpose — priced and decoded across AWS, Azure, and GCP naming conventions, with real on-demand rates compared.

16
aws Step 16 of 38

VPC and Networking Basics

Build a subnet, route table, and internet gateway, then walk through the exact debugging sequence for an EC2 instance that can't reach the internet.

17
aws Step 17 of 38

RDS Basics

Launch a managed Postgres instance on RDS, connect to it with psql, take a snapshot, and restore it into a brand-new instance.

18
aws Step 18 of 38

AWS Lambda Fundamentals

Write, deploy, and invoke a real Lambda function through the CLI, then measure cold start against warm invocation with the numbers AWS actually reports.

19
aws Step 19 of 38

CloudFormation Basics

Deploy a minimal CloudFormation stack, break it on purpose with a bad parameter, and read exactly what a failed rollback prints in the events log.

20
aws Step 20 of 38

CloudWatch Monitoring Basics

Push a custom metric, create a log group with a metric filter, and set an alarm that actually transitions to ALARM state on real threshold breaches.

21
azure Step 21 of 38

Azure Virtual Network Basics

Build a VNet with two subnets, apply an NSG, then walk the exact debugging sequence for a VM that can't reach the internet.

22
azure Step 22 of 38

Azure SQL Basics

Provision an Azure SQL Database and logical server, connect with sqlcmd past a firewall error, then restore to a point in time after a bad delete.

23
azure Step 23 of 38

Azure Functions Fundamentals

Write an HTTP-triggered function, deploy it with func and az functionapp, invoke it twice, and see the timing gap between cold start and a warm call.

24
azure Step 24 of 38

Bicep and ARM Templates Basics

Write a minimal Bicep file, deploy it with az deployment group create, then read the exact error output from a deployment that fails validation.

25
azure Step 25 of 38

Azure Monitor Basics

Read a VM's CPU metrics, query its logs with Kusto (KQL) in Log Analytics, and wire both into an alert rule that fires on a real threshold breach.

26
gcp Step 26 of 38

GCP VPC Networking Basics

Build a custom VPC with a subnet and firewall rules, then debug the classic case of a VM with a public IP that still can't reach the internet.

27
gcp Step 27 of 38

Cloud SQL Basics

Provision a managed Cloud SQL Postgres instance, connect with the Cloud SQL Auth Proxy, and run a real backup and restore cycle.

28
gcp Step 28 of 38

Cloud Run and Cloud Functions Fundamentals

Deploy a real Cloud Run service and a Cloud Function from source, invoke both, and measure the actual cold-start versus warm-invocation latency gap.

29
gcp Step 29 of 38

Infrastructure as Code on GCP

Write a minimal Terraform config for a GCP bucket and VM, run a real terraform apply, and read a genuine failed-apply error end to end.

30
gcp Step 30 of 38

Cloud Monitoring Basics

Read a Compute Engine metric with gcloud, turn a log pattern into a log-based metric, and wire both into a real alerting policy.

31
cloud Step 31 of 38

Object Storage: One Script, Three APIs

Upload a file, list a bucket, and generate a signed URL against S3, Azure Blob Storage, and GCS — one small script per cloud, with real output from each.

32
cloud Step 32 of 38

Cloud Networking Basics: What's the Same Everywhere

VPCs, subnets, and firewall rules share one model everywhere — the same allow-443-deny-rest rule as a security group, an NSG rule, and a GCP rule.

33
aws Step 33 of 38

AWS Cost and Well-Architected Basics

Query real Cost Explorer output, walk the Well-Architected Framework's six pillars, and compare On-Demand, Reserved, and Spot pricing with the math shown.

34
azure Step 34 of 38

Azure Cost Management Basics

Break down spend with az costmanagement, weigh real pay-as-you-go vs. reserved instance pricing for one VM size, and skim the Well-Architected cost pillar.

35
gcp Step 35 of 38

GCP Cost and Billing Basics

Query billing export, skim the Architecture Framework's pillars, and compare On-Demand, Committed Use, and Spot pricing for one machine type, math shown.

36
cloud Step 36 of 38

Managed Databases: Picking One Across Clouds

RDS vs Azure Database for PostgreSQL vs Cloud SQL — real failover times, backup/restore mechanics, and pricing compared at an equivalent instance size.

37
cloud Step 37 of 38

Serverless Cost Comparison: Lambda vs Azure Functions vs Cloud Run

1M invocations/month, 200ms duration, 256MB memory — the actual monthly bill computed on Lambda, Azure Functions, and Cloud Run, with the math shown.

38
cloud Step 38 of 38

Multi-Cloud Terraform: One Pattern, Three Providers

One root module, three provider blocks — AWS, Azure, GCP — provisioning the same storage bucket, plus the state and naming decisions behind it.