Sefism Cloud Engineering Roadmap

What this roadmap is

The cloud engineering roadmap is Sefism's path for students and early-career engineers who want to learn one cloud in depth and pair each certification with real hands-on work. Tauseef Fayyaz wrote it around a simple pattern he describes as the one that succeeds: one cloud, one associate certificate, and one project you can explain end to end.

You choose your cloud at the start: AWS (the default), Azure or Google Cloud. Linux, networking and the overall order are shared; almost every other stage switches its summary, services and resources to your cloud, so you learn IAM roles and S3, or Entra ID and Blob Storage, or service accounts and Cloud Storage, rather than all three at once.

By the end you should be able to:

• Set up a cloud account safely with MFA, least-privilege access, budgets and alerts, and explain the shared responsibility model in plain words.
• Choose between virtual machines, managed containers and serverless functions for a workload, and deploy each one.
• Design a virtual network with public and private subnets, firewall rules, a load balancer and DNS, and debug why something cannot connect.
• Read your bill, find the resources behind it, and cut waste with tags, rightsizing, schedules and teardown.
• Pass the first associate-level certification on your cloud and back it with a three-tier app built in infrastructure as code, with a diagram and a cost report.

Who it suits, and who should start elsewhere

It suits computer science and IT students aiming for a first cloud, cloud support or junior cloud engineer role, developers who want to deploy their own work properly, and system administrators moving to the cloud. It goes deep on one provider rather than skimming all three.

If you want CI/CD pipelines, Kubernetes, larger infrastructure as code setups and GitOps, the DevOps and cloud roadmap is the natural next step; this roadmap's infrastructure as code stage is an introduction on purpose. If keeping production reliable is the goal, see Platform engineering and SRE. If routing, switching and network design are what interest you, the Network engineering roadmap goes further than the networking here. And if the terminal is new, start with Linux, terminal and Git.

Prerequisites and realistic time

Basic computer skills, a willingness to use the command line, and a cloud account with a budget alert set before anything else. No programming depth is required, though a small web app to deploy helps. The roadmap adds up to about 174 hours across 10 stages:

• At about 5 hours a week (the default on the public page): roughly 37 weeks.
• At about 8 hours a week: roughly 26 weeks.
• At about 12 hours a week: roughly 19 weeks.

The first stage, Linux and networking, is a foundation stage: skipped if you are comfortable with it, shortened if you know some of it. Tauseef's advice is not to skip it just because the console looks friendlier.

A sample week for a student (10 to 12 hours). Two evenings on your provider's free training path for the stage, one evening on the checklist in the CLI, and a weekend block on the milestone, ending with a cost check and teardown.

A sample week for someone working full time (5 hours). Two short weekday sessions on reading and small CLI exercises, and one longer weekend lab. Build labs from code once you reach the infrastructure as code stage, so a short session can rebuild yesterday's setup in minutes.

Stage by stage

1. Linux and networking you need for cloud (20 hours, foundation)

The Linux shell on a server, SSH keys, IP addresses, CIDR and subnets, ports, TCP and UDP, DNS records, HTTPS and certificates, and debugging "it cannot connect". Milestone: a Linux environment you reach over SSH with your own key, a web server you can check from the shell, and 10.20.0.0/16 split into subnets with each address count.

2. Cloud concepts and billing (10 hours)

IaaS, PaaS and SaaS, the shared responsibility model, regions and zones, how your cloud structures accounts (AWS Organizations, Azure subscriptions and resource groups, or Google Cloud projects and folders), your cloud's free offer, pricing models and your first budget, and the same service under three names. Milestone: your account with a budget and alerts, the free offer's end date written down, and a one-page service map.

3. Identity and access (12 hours)

Protecting the all-powerful account, MFA, users, groups and roles, least privilege, reading permissions on your cloud (IAM policies, Azure RBAC or Google Cloud IAM bindings), identities for applications and keeping secrets out of code. Milestone: the root or owner login locked away, a group-based setup for a small team, and an app reading a bucket through a workload identity with no stored key.

4. Compute: VMs, containers and serverless (18 hours)

Launching a VM, sizes, images and startup scripts, autoscaling groups, managed containers, serverless functions, and choosing between them. On AWS that means EC2, ECS with Fargate and Lambda; on Azure, Virtual Machines, Container Apps and Functions; on Google Cloud, Compute Engine, Cloud Run and Cloud Run functions. Milestone: the same small app running three ways, with a note on which you would keep. A managed container service is described as the sensible default for a web app today.

5. Storage and databases (14 hours)

Object storage and buckets, keeping buckets private, disks, snapshots and tiers, managed relational and NoSQL databases, and backups, replicas and high availability. Milestone: a private, versioned bucket with a lifecycle rule and a signed URL, and a managed database in a private subnet that you have backed up and restored.

6. Virtual networks, DNS and load balancers (16 hours)

Designing a virtual network, public and private subnets, routes, NAT, security groups and firewall rules, load balancers and health checks, managed DNS and a CDN, and private access to managed services. Milestone: a network built from the CLI across two zones with a load balancer in front of two app servers and your own domain over HTTPS. Then break it on purpose and note what each failure looks like.

7. Monitoring and cost control (10 hours)

Metrics and alerts, central logs and audit trails, tags and labels, reading your bill, cost traps, and rightsizing and schedules. Milestone: a dashboard and three alerts, searchable logs with a chosen retention, a tagging scheme, and a one-page breakdown of last month's bill with what you changed.

8. Infrastructure as code (intro) (14 hours)

Why infrastructure as code, a first Terraform configuration, plan, apply and destroy, state, your cloud's native tool (CloudFormation, Bicep, or Terraform and Infrastructure Manager), and drift. Milestone: your network, a bucket and a small compute service defined in code, applied from a saved plan, destroyed and rebuilt.

9. Certifications: which, and in what order (30 hours)

The order that makes sense on your cloud, studying from the official exam guide and pairing each certificate with a project. On AWS: Cloud Practitioner if you are new, then Solutions Architect Associate. On Azure: AZ-900, then AZ-104. On Google Cloud: Cloud Digital Leader, then Associate Cloud Engineer. Milestone: your first associate certification booked or passed, a study plan mapped to the exam guide, and one public project using the same services.

10. Portfolio: a three-tier app deployed with IaC (30 hours)

Design and diagram, build entirely from code, secure end to end, health checks, alerts and a failure drill, an optional deployment pipeline, a cost report, a timed teardown and rebuild, and documented decisions. Milestone: a public repository with the app built from code, destroyed and rebuilt from scratch. "Keep the app itself boring and make the cloud work excellent."

Projects to build alongside

• Three-Tier Web App on AWS with Infrastructure as Code and a Cost Report, the capstone as a full project on AWS.
• Cloud Landing Zone Starter Kit for Small Teams
• Student Cloud Sandboxes with Budgets and Automatic Cleanup
• Serverless Product Photo Pipeline for Small Online Sellers, a beginner-friendly build.
• Multi-Provider Cloud Bill Tracker with Anomaly Alerts

How it works on Sefism

Everything on Sefism is free to learn from. The public roadmap page lists all ten stages with their summaries and length and opens the first two in full. Adding the roadmap to your dashboard opens every stage, tracks your progress as you tick stages off and gives you the companion cheat sheet. Your first roadmap is free to add; after that, adding a roadmap uses credits, and new members get starting credits when they join.

Each topic in the dashboard has an explanation, a check question and an AI prompt that quizzes you, and each stage has Tauseef's advice, a checklist and curated resources, including your provider's free official training. You can ask Tauseef a question about any stage.

The companion cheat sheet

The Cloud engineering cheat sheet revises every stage with commands for your cloud's CLI and a service map showing the other two providers' names alongside.

Related on Sefism

• Can a fresher get a cloud engineer job?
• Which cloud to learn first: AWS, Azure or GCP
• Are certifications like AWS and Google Cloud worth it?
• How do I practise AWS, Azure or Google Cloud without a surprise bill?
• Learn to Cloud and The Cloud Resume Challenge, both used in the portfolio stage.

What you can do afterwards

Apply for cloud support, junior cloud engineer and cloud operations roles with an associate certificate and a three-tier app you can rebuild from code in front of an interviewer. From there, DevOps and cloud is the natural next roadmap.

FAQ

How long does it take to become a cloud engineer? The roadmap estimates about 174 hours, including certification study: roughly 19 weeks at 12 hours a week or 37 weeks at 5 hours a week.

Which cloud should I learn first? Any of the three works; the roadmap supports AWS, Azure and Google Cloud equally. Learn one to associate level before touching a second: the concepts transfer, the badges do not.

Which cloud certification should I take first? Your cloud's first associate exam: Solutions Architect Associate on AWS, AZ-104 on Azure, or Associate Cloud Engineer on Google Cloud, with the foundational exam first if you are new.

Can I learn cloud without paying? The roadmap leans on each provider's free offer and free official training, and asks you to set a budget alert before creating anything and to tear down what you are not using at the end of each session.

Do I need to know Kubernetes for a cloud job? Not for this roadmap. Its advice is that a managed container service is the sensible default for a web app, and Kubernetes belongs to the DevOps and cloud and platform roadmaps.