Cloud Architecture Learning Roadmap

The Cloud Architect roadmap, step by step

3 stages and 35 topics, about 32 weeks in all. It starts at beginner level with Cloud Fundamentals and ends at advanced level with Advanced Cloud Solutions. It prepares you for roles such as Cloud Architect, Cloud Engineer, Solutions Architect.

1. 1

   Stage 1: Cloud Fundamentals

   8 weeks, Beginner, 11 topics

   Build a solid understanding of cloud computing models, core services across major providers, networking, identity management, and cost control

   • Cloud Computing Models (IaaS/PaaS/SaaS)Understand the three fundamental cloud service models and the shared responsibility model that defines security boundaries.
     • IaaS provides virtualized infrastructure (compute, storage, networking) with maximum control and responsibility
     • PaaS abstracts infrastructure management so developers focus on application code and data
     • SaaS delivers complete applications over the internet with the provider managing everything
     • The shared responsibility model defines which security tasks belong to the provider versus the customer at each level
   • AWS Core Services (EC2, S3, VPC)Master the foundational AWS services for compute, storage, and networking that form the building blocks of cloud architectures.
     • EC2 provides resizable compute capacity with instance types optimized for different workloads (compute, memory, GPU)
     • S3 offers virtually unlimited object storage with multiple storage classes for cost optimization based on access patterns
     • VPC enables isolated virtual networks with subnets, route tables, and security groups for network segmentation
     • Availability Zones within regions provide physical redundancy for high-availability deployments
   • Azure Core ServicesLearn Microsoft Azure's core compute, storage, and networking offerings and how they map to AWS equivalents for multi-cloud fluency.
     • Azure Virtual Machines, App Service, and Azure Functions cover the compute spectrum from IaaS to serverless
     • Azure Blob Storage, Disk Storage, and Azure Files address object, block, and file storage needs respectively
     • Azure Virtual Networks, NSGs, and Azure Firewall provide layered network security and isolation
     • Resource Groups and Management Groups organize Azure resources for access control and billing management
   • GCP Core ServicesExplore Google Cloud Platform's core infrastructure services and its strengths in data analytics, AI, and Kubernetes-native computing.
     • Compute Engine, Cloud Run, and Cloud Functions span the IaaS-to-serverless compute spectrum on GCP
     • Cloud Storage provides unified object storage with automatic storage class transitions based on access frequency
     • GKE (Google Kubernetes Engine) is an industry-leading managed Kubernetes service with Autopilot mode
     • BigQuery offers serverless, petabyte-scale data analytics without infrastructure management
   • IAM & Access ManagementImplement secure identity and access management using least-privilege policies, roles, federation, and multi-factor authentication.
     • Least-privilege principle grants only the minimum permissions required for each user, role, or service
     • IAM roles and service accounts enable applications to authenticate to cloud services without embedded credentials
     • Federation with identity providers (Okta, Azure AD) enables single sign-on and centralized user management
     • MFA and conditional access policies add additional security layers for privileged operations and sensitive resources
   • Networking in the CloudDesign cloud network architectures with VPCs, subnets, routing, DNS, and connectivity options for secure, performant applications.
     • Public and private subnets separate internet-facing resources from internal backend services
     • Security groups (stateful) and NACLs (stateless) provide layered network access control at different granularities
     • Route 53, Azure DNS, and Cloud DNS manage domain resolution with health checks and traffic routing policies
     • VPN and Direct Connect/ExpressRoute provide secure, private connectivity between on-premises and cloud environments
   • Cloud Storage Solutions(recommended)Choose the right storage service for each workload: object storage, block storage, file storage, and archival with lifecycle management.
     • Object storage (S3, Blob, GCS) is ideal for unstructured data like images, backups, and static assets
     • Block storage (EBS, Managed Disks) provides high-performance volumes for databases and applications requiring low latency
     • Lifecycle policies automatically transition data between storage tiers and expire old objects to optimize costs
     • Cross-region replication ensures data durability and availability for disaster recovery scenarios
   • Billing & Cost Management(recommended)Monitor, forecast, and optimize cloud spending using budgets, alerts, reserved capacity, and cost allocation best practices.
     • Budget alerts and spending anomaly detection prevent unexpected charges from runaway resources
     • Reserved Instances and Savings Plans offer 30-72% discounts for predictable, steady-state workloads
     • Cost allocation tags enable per-project and per-team billing breakdowns for accountability
     • Right-sizing recommendations identify over-provisioned resources that can be downsized without performance impact
   • Cloud CLI Tools(recommended)Manage cloud resources efficiently from the command line using AWS CLI, Azure CLI, and gcloud for scripting and automation.
     • CLI tools enable scriptable, repeatable cloud operations that can be version-controlled and automated
     • Named profiles and configuration files manage multiple accounts and regions without credential confusion
     • Output formatting options (JSON, table, YAML) allow easy parsing and integration with other tools
     • Shell scripts combining CLI commands automate complex multi-step provisioning and teardown workflows
   • Cloud Certifications Overview(optional)Navigate the cloud certification landscape to plan a certification path that validates skills and accelerates career growth.
     • Foundational certifications (Cloud Practitioner, AZ-900) validate broad cloud knowledge for any role
     • Associate-level certifications (Solutions Architect, Azure Administrator) prove hands-on implementation skills
     • Professional/Expert certifications demonstrate advanced architecture and specialization expertise
   • On-Premise vs Cloud(optional)Evaluate the trade-offs between on-premises infrastructure and cloud adoption including cost, scalability, compliance, and operational considerations.
     • Cloud eliminates upfront capital expenditure in favor of operational pay-as-you-go pricing
     • On-premises may be more cost-effective for highly predictable, sustained workloads at large scale
     • Data sovereignty and compliance requirements may mandate specific geographic or infrastructure controls

   Projects for this stage

   • Multi-Service Cloud Deployment: Deploy a web application using compute instances, managed databases, and object storage with proper IAM configuration on a cloud provider
   • Cloud Cost Analysis Report: Analyze cloud billing data for a sample workload and produce a cost optimization report with actionable recommendations
2. 2

   Stage 2: Cloud Architecture Design

   10 weeks, Intermediate, 12 topics

   Design resilient, scalable cloud architectures using well-architected frameworks, microservices, serverless patterns, and infrastructure as code

   • Well-Architected FrameworkApply the AWS Well-Architected Framework's six pillars to evaluate and improve cloud architecture decisions systematically.
     • The six pillars are: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability
     • Well-Architected Reviews identify risks and improvement opportunities before they become production incidents
     • Trade-offs between pillars (e.g., higher reliability may increase cost) require explicit architectural decisions
     • AWS, Azure, and GCP all provide their own well-architected frameworks with shared core principles
   • High Availability & Fault ToleranceDesign systems that remain operational during component failures using redundancy, health checks, and automated recovery across availability zones and regions.
     • Multi-AZ deployments protect against single data center failures with automatic failover
     • Health checks and auto-healing automatically replace unhealthy instances without manual intervention
     • Circuit breaker patterns prevent cascading failures by isolating failing dependencies
     • RTO (Recovery Time Objective) and RPO (Recovery Point Objective) define acceptable downtime and data loss targets
   • Scalability PatternsImplement horizontal and vertical scaling strategies using auto-scaling groups, read replicas, caching layers, and partitioning.
     • Horizontal scaling adds more instances to distribute load, while vertical scaling increases individual instance capacity
     • Auto-scaling groups dynamically adjust capacity based on CloudWatch metrics, schedules, or predictive scaling
     • Caching layers (ElastiCache, Memcached) reduce database load and improve response times for read-heavy workloads
     • Database sharding and partitioning distribute data across multiple nodes for write scalability
   • Microservices on CloudDesign and deploy microservices architectures using containers, service discovery, and inter-service communication patterns on cloud platforms.
     • Each microservice owns its data store and communicates through well-defined APIs or event streams
     • Service discovery (Cloud Map, Consul) enables services to locate each other dynamically in elastic environments
     • API versioning and backward compatibility strategies prevent breaking changes from disrupting dependent services
     • Distributed tracing (X-Ray, Jaeger) provides end-to-end visibility across service boundaries for debugging
   • Serverless Architecture (Lambda, Functions)Build event-driven applications using serverless compute that automatically scales to zero and charges only for actual execution time.
     • Serverless functions execute in response to events (HTTP, queue messages, file uploads) without server management
     • Cold starts add latency on first invocation; provisioned concurrency or warm-up strategies mitigate this
     • Step Functions and Durable Functions orchestrate complex multi-step workflows across serverless components
     • Serverless is cost-effective for sporadic, event-driven workloads but can become expensive for sustained high-throughput
   • Database Services (RDS, DynamoDB, CosmosDB)Select and configure managed database services for relational, NoSQL, and specialized data workloads with high availability and scaling.
     • RDS and Cloud SQL provide managed relational databases with automated backups, patching, and Multi-AZ failover
     • DynamoDB and Cosmos DB offer serverless NoSQL with single-digit millisecond latency at any scale
     • Read replicas and global tables distribute read traffic and provide cross-region data access
     • Database selection depends on access patterns: relational for complex queries, NoSQL for key-value and document workloads
   • Load Balancing & CDN(recommended)Distribute traffic across healthy instances with load balancers and accelerate content delivery with CDNs for global performance.
     • Application Load Balancers route HTTP/HTTPS traffic with path-based and host-based routing rules
     • Network Load Balancers handle millions of connections per second for TCP/UDP workloads with ultra-low latency
     • CDNs (CloudFront, Azure CDN, Cloud CDN) cache content at edge locations to reduce latency for global users
     • SSL/TLS termination at the load balancer offloads encryption work from backend instances
   • Message Queues (SQS, EventBridge, Pub/Sub)(recommended)Decouple services with asynchronous messaging using queues, event buses, and pub/sub systems for resilient event-driven architectures.
     • Message queues decouple producers and consumers, allowing independent scaling and fault isolation
     • Dead-letter queues capture failed messages for debugging without blocking the main processing pipeline
     • EventBridge and Pub/Sub enable fan-out patterns where a single event triggers multiple downstream consumers
     • FIFO queues guarantee exactly-once processing and message ordering for order-sensitive workflows
   • API Gateway Design(recommended)Expose backend services through managed API gateways with authentication, rate limiting, caching, and request transformation.
     • API Gateways provide a single entry point that handles authentication, throttling, and request routing
     • Usage plans and API keys enable monetization and rate limiting for different consumer tiers
     • Request and response transformations adapt backend services to client-expected API contracts
     • Caching at the gateway layer reduces backend load for frequently accessed, slowly changing data
   • Infrastructure as Code (Terraform)(optional)Define and provision cloud infrastructure declaratively using Terraform for repeatable, version-controlled, multi-cloud deployments.
     • Declarative HCL configuration describes desired infrastructure state; Terraform plans and applies changes incrementally
     • State files track resource mappings and must be stored remotely (S3, GCS) with locking for team collaboration
     • Modules encapsulate reusable infrastructure patterns for consistent provisioning across environments
     • Multi-provider support enables managing AWS, Azure, GCP, and third-party resources from a single codebase
   • Cloud Networking Advanced (VPC Peering, Transit Gateway)(optional)Connect multiple VPCs and accounts using peering, transit gateways, and private endpoints for enterprise-scale network architectures.
     • VPC Peering provides direct, non-transitive connections between two VPCs with no bandwidth bottleneck
     • Transit Gateway acts as a central hub connecting hundreds of VPCs and on-premises networks with simplified routing
     • PrivateLink and Private Endpoints access cloud services over private IP addresses without traversing the public internet
   • Cost Optimization Strategies(optional)Apply advanced cost optimization techniques including spot instances, committed use discounts, architecture rightsizing, and waste elimination.
     • Spot instances provide up to 90% savings for fault-tolerant, interruptible workloads like batch processing
     • Committed use discounts (Savings Plans, Reserved Instances) reduce costs for steady-state production workloads
     • Automated scheduling stops non-production resources outside business hours to eliminate idle spend

   Projects for this stage

   • Serverless E-Commerce Backend: Design and deploy a serverless microservices backend with API Gateway, Lambda/Functions, DynamoDB, and event-driven order processing
   • High-Availability Architecture Blueprint: Create a detailed architecture blueprint for a multi-region, highly available application with automated failover and disaster recovery
3. 3

   Stage 3: Advanced Cloud Solutions

   12 weeks, Advanced, 12 topics

   Architect enterprise-grade cloud solutions with multi-cloud strategies, migration planning, security architecture, and operational excellence at scale

   • Multi-Cloud StrategyDesign architectures that leverage multiple cloud providers for resilience, vendor flexibility, and best-of-breed service selection.
     • Multi-cloud avoids vendor lock-in and enables selecting the best service from each provider for specific workloads
     • Abstraction layers (Terraform, Kubernetes) provide portability but add complexity and limit provider-specific features
     • Data gravity and egress costs make data placement one of the most critical multi-cloud architecture decisions
     • Unified identity and access management across providers requires federation and consistent policy enforcement
   • Cloud Migration (6 R's)Plan and execute cloud migrations using the 6 R's framework: Rehost, Replatform, Refactor, Repurchase, Retire, and Retain.
     • Rehosting (lift-and-shift) provides the fastest migration path with minimal code changes but limited cloud optimization
     • Refactoring re-architects applications to leverage cloud-native services for maximum scalability and cost efficiency
     • Portfolio assessment prioritizes applications by business value, technical complexity, and migration readiness
     • Wave planning groups related applications for phased migration with clear dependencies and rollback procedures
   • Disaster Recovery & Business ContinuityDesign disaster recovery architectures that meet business RTO/RPO requirements using backup, pilot light, warm standby, and multi-region active-active patterns.
     • DR strategies range from backup-restore (hours RTO) to multi-region active-active (near-zero RTO) with increasing cost
     • Pilot light maintains minimal always-on infrastructure that can scale up rapidly during a disaster event
     • Regular DR testing through chaos engineering and gameday exercises validates recovery procedures before real incidents
     • Automated runbooks reduce human error and recovery time during high-stress disaster scenarios
   • Cloud Security ArchitectureDesign defense-in-depth security architectures with network segmentation, encryption, threat detection, and incident response on cloud platforms.
     • Defense in depth layers security controls at network, identity, application, and data levels for comprehensive protection
     • Encryption at rest (KMS, managed keys) and in transit (TLS) protects data throughout its lifecycle
     • Security services (GuardDuty, Security Center, Security Command Center) provide continuous threat detection and alerting
     • Security automation through Infrastructure as Code ensures consistent security baselines across all environments
   • Container Orchestration (ECS/EKS/GKE)Deploy and manage containerized applications at scale using managed Kubernetes services and container orchestration platforms.
     • Managed Kubernetes services (EKS, AKS, GKE) handle control plane management, patching, and high availability
     • Pods, Deployments, and Services are the core Kubernetes abstractions for running and exposing containerized workloads
     • Helm charts package Kubernetes manifests for templated, versioned, and reusable application deployments
     • Fargate and Cloud Run provide serverless container execution without managing underlying node infrastructure
   • Cloud-Native CI/CDBuild continuous integration and deployment pipelines using cloud-native services for automated building, testing, and releasing of applications.
     • Cloud-native CI/CD services (CodePipeline, Azure Pipelines, Cloud Build) integrate tightly with their respective platforms
     • Blue/green and canary deployment strategies reduce risk by gradually shifting traffic to new versions
     • Container image scanning and policy enforcement in the pipeline prevent deploying vulnerable or non-compliant images
     • GitOps (ArgoCD, Flux) uses Git repositories as the single source of truth for declarative infrastructure and application state
   • Service Mesh (Istio/App Mesh)(recommended)Implement service mesh infrastructure for advanced traffic management, observability, and security between microservices without application code changes.
     • Sidecar proxies (Envoy) intercept all network traffic between services for transparent policy enforcement
     • Traffic management features enable canary releases, traffic mirroring, and fault injection for resilience testing
     • Mutual TLS (mTLS) automatically encrypts all service-to-service communication with identity-based authentication
     • Distributed tracing and metrics collection provide deep observability into inter-service communication patterns
   • Observability & Monitoring (CloudWatch, Stackdriver)(recommended)Implement comprehensive observability with metrics, logs, and traces across cloud infrastructure and applications for proactive operations.
     • The three pillars of observability (metrics, logs, traces) provide complementary views of system health and behavior
     • Custom dashboards aggregate key metrics across services for at-a-glance operational awareness
     • Log aggregation and structured logging enable rapid root cause analysis across distributed systems
     • SLIs, SLOs, and error budgets quantify service reliability targets and guide operational priorities
   • FinOps & Cloud Governance(recommended)Establish organizational governance frameworks for cloud spending, compliance policies, resource management, and cross-team accountability.
     • FinOps brings financial accountability to cloud spending through collaboration between engineering, finance, and business teams
     • Organizational units, SCPs, and guardrails enforce security and compliance policies across multiple accounts
     • Tagging strategies and cost allocation enable showback/chargeback models for team-level accountability
     • Regular cloud optimization reviews identify waste and reallocate resources based on changing business priorities
   • Edge Computing & IoT(optional)Extend cloud architectures to the edge with IoT device management, edge compute, and data processing closer to the source.
     • Edge computing processes data close to the source for low-latency responses and reduced bandwidth costs
     • IoT device management platforms handle provisioning, monitoring, and OTA updates for device fleets at scale
     • Edge-to-cloud data pipelines filter and aggregate data locally before sending summaries to the cloud
   • Hybrid Cloud Architecture(optional)Design architectures that span on-premises data centers and cloud environments with consistent management, networking, and security.
     • Hybrid architectures keep latency-sensitive or compliance-restricted workloads on-premises while leveraging cloud for burst capacity
     • Consistent tooling (Azure Arc, Anthos, EKS Anywhere) provides unified management across on-premises and cloud environments
     • Dedicated connectivity (Direct Connect, ExpressRoute) provides reliable, low-latency links between on-premises and cloud
   • Cloud Compliance & Auditing(optional)Meet regulatory compliance requirements (HIPAA, PCI-DSS, SOC 2, GDPR) on cloud platforms with automated auditing and evidence collection.
     • Cloud providers offer compliance certifications but customers must ensure their own configurations meet requirements
     • AWS Config, Azure Policy, and Organization Policies continuously audit resource configurations against compliance rules
     • Audit logs (CloudTrail, Activity Log, Audit Logs) provide tamper-proof records of all API actions for forensic analysis

   Projects for this stage

   • Enterprise Cloud Migration Plan: Design a comprehensive migration plan for a legacy on-premises application portfolio including assessment, wave planning, and cutover strategy
   • Multi-Cloud Kubernetes Platform: Deploy a Kubernetes-based platform with workloads spanning two cloud providers, unified observability, and automated failover