Roadmap · Specialise
Cloud engineering
Opens with creditsFor students and early-career engineers who want to learn one cloud in depth, on AWS, Azure or Google Cloud, and pair each certification with real hands-on work. By the end you can secure an account, build networks, compute, storage and databases, keep costs under control, describe it all as code and show a deployed three-tier app to prove it.
Curated by Tauseef Fayyaz10 stages, 66 topics~9 months at a few hours a weekBy the end, you will be able to
- Set up a cloud account safely with MFA, least-privilege access, budgets and alerts, and explain the shared responsibility model in plain words
- Choose between virtual machines, managed containers and serverless functions for a workload, and deploy each one on your cloud
- Design a virtual network with public and private subnets, firewall rules, a load balancer and DNS, and debug why something cannot connect
- Read your bill, find the resources behind it, and cut waste with tags, rightsizing, schedules and teardown
- Pass the first associate-level certification on your cloud and back it with a three-tier app built in infrastructure as code, with a diagram and a cost report
The path
10 stages, in the order to learn them. Open one to start.
1Linux and networking you need for cloudLearn the Linux shell, SSH keys, IP addresses and CIDR blocks, ports, DNS and HTTPS: the layer every cloud service is built on and every cloud problem eventually comes down to.7 topics · ~4 weeks
- 1The Linux shell on a serverMost cloud virtual machines run Linux with no desktop, so the shell is how you work on them.
- 2SSH keys and remote accessSSH (Secure Shell) gives you an encrypted terminal on a remote server.
- 3IP addresses, CIDR and subnetsAn IPv4 address is 32 bits, written as four numbers such as 10.0.1.25.
- 4Ports, TCP and UDPAn IP address finds the machine; a port number finds the program on it.
- 5DNS recordsDNS (Domain Name System) turns names such as app.example.com into IP addresses.
- 6HTTPS and certificatesHTTPS is HTTP carried over TLS (Transport Layer Security), which encrypts traffic and lets the browser check it is talking to the real server.
- 7Debugging "it cannot connect"Most cloud problems reach you as "it cannot connect", and the fix comes from checking layers in order.
7 in this stageOpen this stage2Cloud concepts and billingLearn how AWS is organised and paid for: service models, shared responsibility, regions and availability zones, accounts and AWS Organizations, the free plan and credits, pricing models and the AWS Budget you set before anything else.8 topics · ~2 weeks
- 1IaaS, PaaS and SaaSCloud services come in three broad models.
- 2The shared responsibility modelSecurity in the cloud is split.
- 3Regions and availability zonesA region is a geographic area, such as a city or country, where the provider runs data centres.
- 4AWS accounts and OrganizationsOn AWS, the account is the main boundary for resources, permissions and billing.
- 5The AWS free plan and creditsAs of September 2026, new AWS accounts start with 100 USD in credits and can earn up to 100 USD more, for up to 200 USD over 6 months, on a free plan that…
- 6Pricing models and your first budgetCloud resources are billed on-demand by the second, hour, GB or request by default.
- 7The same service under three namesEvery cloud offers virtual machines, object storage, managed databases, networks and identity, but each gives them its own names.
- 8Well-Architected principlesEach provider publishes a framework of good design grouped into pillars: security, reliability, performance, cost optimisation and operational excellence,…
8 in this stageOpen this stage- Identity and accessControl who can do what on AWS: protect the root user, turn on MFA, use IAM Identity Center groups and IAM roles, write least-privilege IAM policies, give EC2 and Lambda their own roles and keep secrets in Secrets Manager.7 topics · ~3 weeksOpens with credits
- Compute: VMs, containers and serverlessRun code three ways on AWS: EC2 instances you manage, containers on ECS with Fargate and Lambda functions, then instance types, AMIs, user data, Auto Scaling groups and how to choose.6 topics · ~4 weeksOpens with credits
- Storage and databasesStore data the managed way on AWS: S3 with Block Public Access and lifecycle rules, EBS volumes and snapshots, RDS or Aurora, DynamoDB, automated backups, Multi-AZ and read replicas.6 topics · ~3 weeksOpens with credits
- Virtual networks, DNS and load balancersBuild your own network on AWS: a VPC with public and private subnets across availability zones, route tables, an internet gateway and NAT gateway, security groups, an Application Load Balancer, Route 53, CloudFront and VPC endpoints.7 topics · ~4 weeksOpens with credits
- Monitoring and cost controlSee what AWS resources are doing and what they cost: CloudWatch metrics, alarms and Logs, CloudTrail, cost allocation tags, Cost Explorer, Cost Anomaly Detection, the usual cost traps and rightsizing.6 topics · ~2 weeksOpens with credits
- Infrastructure as code (intro)Describe your cloud in files you review, version and apply: why infrastructure as code matters, a first Terraform configuration, plan and apply, state, your cloud's native tool and drift. Pipelines and larger IaC setups belong to the DevOps and cloud roadmap.6 topics · ~3 weeksOpens with credits
- Certifications: which, and in what orderTake AWS certifications in a sensible order: Cloud Practitioner (CLF-C02) if you are new, then Solutions Architect Associate (SAA-C03), then CloudOps Engineer Associate or Solutions Architect Professional, each paired with hands-on work.5 topics · ~6 weeksOpens with credits
- Portfolio: a three-tier app deployed with IaCBring everything together on AWS: CloudFront and an Application Load Balancer, ECS on Fargate in private subnets, RDS with Multi-AZ, S3, Secrets Manager and CloudWatch, all in Terraform or CloudFormation, secured, costed and documented.8 topics · ~6 weeksOpens with credits
8 more stages, 51 more topics, free with an account.
You have seen the open stages of the Cloud engineering roadmap. Every topic it covers is listed above, and an account opens the rest: what each topic means, a question to check yourself, the courses, the practice and Tauseef's advice for every stage. Early access is open: sign up and your account is active shortly after.
Everything here is free to learn from. A few things, like adding a roadmap, keeping a cheat sheet or asking Tauseef a question, use credits. You get 15 when you join, your first roadmap is free, and if you are learning seriously and run out, you can ask for more. Credits only make sure the platform goes to people who are actually learning.
Build a project
A finished project proves more than a certificate.
- Start with this onebeginner1 semester · 1 to 2 studentsServerless Product Photo Pipeline for Small Online Sellers
A beginner-friendly build with object storage events, functions, a CDN and a per-image cost estimate
- AWS, Azure or Google Cloud
- Object storage events
- Lambda, Azure Functions or Cloud Run
- CDN
- Python or Node.js
- intermediate1 semester · 2 to 3 studentsStudent Cloud Sandboxes with Budgets and Automatic Cleanup for University Labs
Accounts or projects, budgets, tags, least privilege and automated clean-up, solving a problem every university lab has
- Terraform
- AWS, Azure or Google Cloud
- AWS Organizations or Azure Policy
- Python
- Serverless functions
- intermediate2 semesters · 2 to 3 studentsMulti-Provider Cloud Bill Tracker with Anomaly Alerts for Startups
Takes the cost stage further: pull real billing data, split it by team and explain spikes
- Python
- PostgreSQL or DuckDB
- AWS Cost and Usage exports
- Provider billing APIs and CSVs
- FastAPI
- advanced1 semester · 2 to 3 studentsCloud Landing Zone Starter Kit for Small Teams with Terraform
Identity, networking, logging, budgets and guardrails for a small team, all in code: the foundations a real cloud account needs
- Terraform
- AWS, Azure or Google Cloud
- Single sign-on (SSO)
- GitHub Actions with OIDC
- Open Policy Agent or Checkov
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- Kubernetes Best PracticesRun workloads on Kubernetes that schedule well, survive restarts and node drains, and stay locked down: resources, probes, PDBs, Pod Security and RBAC.
- Terraform Best PracticesWrite Terraform that teams can review and change safely: file layout, version pinning, remote state with locking, secrets, modules, refactoring and tests.
Checklists
See all- Cloud Cost Optimization ChecklistFinOps for engineers: tagging and allocation, budgets and anomaly alerts, rightsizing, scheduling, commitments, storage lifecycle, egress, idle resources and unit cost metrics.
- AWS Account Security ChecklistLock down an AWS account: root user, IAM Identity Center, roles instead of keys, CloudTrail, GuardDuty, S3 Block Public Access, IMDSv2 and guardrails.
- Incident Response ChecklistPrepare for and handle production incidents: on-call, severity levels, declaring, roles, mitigation, security containment, status updates and blameless postmortems.
Project structures
See all- Terraform project structureAn infrastructure repository for a small app on AWS: reusable modules, one folder per environment with its own remote state, pinned providers, tests and security scans, with plan on every pull request and apply from CI. For students who have finished the Terraform tutorials and want to know how a real team lays out the files. The same layout works unchanged with OpenTofu.
- Kubernetes with Helm project structureA Helm chart repository for one app: the chart that
helm creategives you, grown into a tested, versioned package with per-environment values, unit tests, install tests in a kind cluster and releases to an OCI registry. For students who can write a Deployment by hand and want to know how a team organises charts. It is about the repo layout and what each file does, not about cluster design. - Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks.
Career questions
See all- Which cloud should I learn first: AWS, Azure or GCP?If you have no reason to choose otherwise, start with AWS: it has the largest market share and the most learning material. Choose Azure if the employers you want run on Microsoft, and GCP if you are heading into data and ML work at companies that use it. The concepts transfer, so the first cloud matters less than learning it properly.
- How do I practise on AWS, Azure or Google Cloud without getting a surprise bill?Use the free offer that fits you, set a budget alert before you create anything, tag every resource, build and destroy your labs with code, and run a five-minute check for the usual culprits, such as NAT gateways, load balancers, databases and public IPs, before you close your laptop.
- Are certifications like AWS or Google Cloud worth it for getting a tech job?It depends on the role. For cloud, DevOps, security and some data roles, a respected certification can help you get shortlisted, especially combined with a real project. For general software engineering roles, projects and skills matter far more. Do the certification to structure your learning, not as a replacement for building.
Cheat sheets
See allWork with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com