Cloud engineer roadmap for 2027: skills, certifications and projects

A cloud engineer roadmap for 2027 has eight stages: Linux, networking, one programming language, one provider's compute, storage and identity services, infrastructure as code, containers, monitoring and cost control, and one certification with a deployed project. NIST defines cloud computing as on-demand network access to a shared pool of configurable computing resources that can be provisioned and released with minimal management effort.

Last updated: 11 November 2026.

What does a cloud engineer do?

A cloud engineer builds, deploys and runs applications and infrastructure on a public cloud such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud. The three providers describe the associate-level role in similar terms. Google Cloud says an Associate Cloud Engineer deploys and secures applications, services and infrastructure and monitors the operations of multiple projects. Microsoft's Azure Administrator Associate page describes expertise in implementing, managing and monitoring an organisation's Azure environment, including virtual networks, storage, compute, identity, security and governance.

AWS describes its CloudOps Engineer - Associate, formerly the SysOps Administrator certification, as monitoring and maintaining workloads, implementing security controls and networking, and optimising cost and performance. AWS's shared responsibility model separates "security of the cloud", which AWS handles, from "security in the cloud", where the customer's share depends on the services selected.

What are the stages of a cloud engineer roadmap?

The roadmap has eight stages, and each has one project and a check before moving on. The table summarises them.

What should you learn before using a cloud console?

Linux, IP networking and one programming language come first, because every later stage uses them. AWS's EC2 documentation has a page on connecting to a Linux instance with an SSH client, and OpenSSH describes itself as the premier connectivity tool for remote login with the SSH protocol, so logging in to a Linux machine over SSH is the first hands-on skill.

Networking deserves its own stage. RFC 1918 reserves three private address blocks: 10.0.0.0 to 10.255.255.255 (10/8), 172.16.0.0 to 172.31.255.255 (172.16/12) and 192.168.0.0 to 192.168.255.255 (192.168/16). Amazon Virtual Private Cloud (Amazon VPC) lets you launch AWS resources in a logically isolated virtual network that you define. AWS's subnet page says a subnet can be between a /28 and a /16 and that the first four IP addresses and the last IP address of every subnet are not available for use. Python's standard-library ipaddress module can plan this without any account:

import ipaddress

vpc = ipaddress.ip_network("10.0.0.0/16")
subnets = list(vpc.subnets(new_prefix=24))
print("VPC", vpc, "holds", len(subnets), "subnets of /24")
for s in subnets[:3]:
    # AWS keeps the first four addresses and the last one in every subnet
    print(s, "addresses:", s.num_addresses, "usable on AWS:", s.num_addresses - 5)
print("10.0.1.7 in", subnets[1], "->", ipaddress.ip_address("10.0.1.7") in subnets[1])
print("10.0.0.0/16 private (RFC 1918):", vpc.is_private)

Run on Python 3.12.13, the script printed:

VPC 10.0.0.0/16 holds 256 subnets of /24
10.0.0.0/24 addresses: 256 usable on AWS: 251
10.0.1.0/24 addresses: 256 usable on AWS: 251
10.0.2.0/24 addresses: 256 usable on AWS: 251
10.0.1.7 in 10.0.1.0/24 -> True
10.0.0.0/16 private (RFC 1918): True

A /24 holds 256 addresses, AWS keeps five, and 251 remain. The membership check on the fifth line is the question to ask when one server cannot reach another: are the two addresses in the subnets that were planned?

Pick one programming language for the whole roadmap. This roadmap uses Python, because Boto3 is the AWS SDK for Python and the standard library already includes ipaddress. Go is a reasonable alternative: the Go project's website lists cloud and network services and DevOps among its use cases.

How do you learn one cloud properly?

Learn one provider's compute, storage, networking and identity services in depth before comparing providers, because the concepts carry over. Microsoft's Azure Architecture Center maps AWS services to roughly comparable Azure services, for example Amazon CloudWatch to Azure Monitor. The cloud careers comparison of AWS, Azure and Google Cloud covers how to choose a provider. Stack Overflow's Developer Survey 2026 gives a sense of use: among 10,889 respondents, AWS was used for extensive development work by 41.8%, Microsoft Azure by 25.1% and Google Cloud by 24.5%.

Storage and identity are the two services to learn first. Amazon Simple Storage Service (Amazon S3) is an object storage service that stores data as objects in buckets, and new buckets do not allow public access by default. AWS Identity and Access Management (IAM) controls who is signed in and what they may do, and its best-practice list asks for temporary credentials through roles and federation, multi-factor authentication, least-privilege permissions and regular removal of unused users, roles and credentials.

The script below creates a bucket, uploads a file, blocks public access and reads the settings back. It runs against Moto, a library that mocks AWS in memory, so it needs no account:

import boto3
from moto import mock_aws

@mock_aws
def main():
    s3 = boto3.client("s3", region_name="ap-south-1")
    s3.create_bucket(
        Bucket="demo-reports-1234",
        CreateBucketConfiguration={"LocationConstraint": "ap-south-1"},
    )
    s3.put_object(Bucket="demo-reports-1234", Key="2026/11/report.csv", Body=b"id,total\n1,250\n")
    s3.put_public_access_block(
        Bucket="demo-reports-1234",
        PublicAccessBlockConfiguration={"BlockPublicAcls": True, "IgnorePublicAcls": True,
                                        "BlockPublicPolicy": True, "RestrictPublicBuckets": True},
    )
    keys = [o["Key"] for o in s3.list_objects_v2(Bucket="demo-reports-1234")["Contents"]]
    block = s3.get_public_access_block(Bucket="demo-reports-1234")["PublicAccessBlockConfiguration"]
    print("keys:", keys)
    print("all public access blocked:", all(block.values()))

main()

With Boto3 1.43.127 and Moto 5.2.5 the output was:

keys: ['2026/11/report.csv']
all public access blocked: True

A mock proves the code runs, not that a real account is configured correctly. Free offers help with the real thing: Google Cloud says its free usage limit does not expire but is subject to change, and AWS says new customers who create a Free Tier account receive credits. Limits and eligibility change, so set a budget alert first. AWS says AWS Budgets can track and take action on costs and usage.

What do infrastructure as code, containers and monitoring add?

Infrastructure as code turns the console clicks of stage 4 into files that can be reviewed, versioned and rebuilt. HashiCorp says Terraform is an infrastructure as code tool that lets you define cloud and on-prem resources in human-readable configuration files that you can version, reuse and share. AWS CloudFormation does the same for AWS only: you write a template describing the resources, and CloudFormation provisions them and works out the dependencies.

Terraform's licence is worth checking before choosing a tool. The LICENSE file on the main branch of hashicorp/terraform is a Business Source License, with International Business Machines Corporation (IBM) as licensor for version 1.6.0 and later, so the licence is not an open-source one. OpenTofu's website describes the change as HashiCorp's switch from an open-source licence to the BUSL.

OpenTofu is a fork created in response, now stewarded by the Linux Foundation, and its GitHub repository carries the Mozilla Public License 2.0. GitHub lists Terraform v1.17.1 (28 October 2026) and OpenTofu v1.13.9 (5 November 2026) as the latest releases. The concepts are the same on both, so learn them on either and check the licence before choosing one for work.

Containers come next. Docker is an open platform for developing, shipping and running applications, and Kubernetes is a portable, extensible, open source platform for managing containerized workloads and services. In the same survey, Docker was used by 59.1% of respondents, Kubernetes by 26.0% and Terraform by 18.3%. The Docker for beginners guide covers images and containers, and the microservices vs monolith comparison explains what gets split into separate containers.

Monitoring and cost close the loop. Amazon CloudWatch monitors AWS resources and applications in real time, and OpenTelemetry is an open source, vendor-neutral framework for generating, exporting and collecting traces, metrics and logs; it is not a monitoring backend itself.

The FinOps Foundation defines FinOps as an operational framework and cultural practice that creates financial accountability through collaboration between engineering, finance and business teams. AWS names six Well-Architected pillars (operational excellence, security, reliability, performance efficiency, cost optimization and sustainability) and Microsoft lists five for Azure, which makes either list a ready review checklist for the capstone.

Which cloud certification should a beginner take?

A beginner should take the foundational certification of the provider used in the first project, then the associate certification for the role wanted. The table lists the entry and next steps as each provider's page shows them today; certification names and exam codes change, so check the provider's page before booking.

AWS's Cloud Practitioner page says candidates could have up to 6 months of exposure to AWS, though this is not required, and calls the certification an entry point for candidates from non-IT backgrounds. The Solutions Architect - Associate page says the exam does not require deep hands-on coding experience, although basic programming concepts help. Google Cloud's Cloud Digital Leader lists no technical prerequisites. A certification is evidence of study and not a substitute for the stage 8 project, because the project is the part a reviewer can open and redeploy.

Is there demand for cloud skills in India?

Demand shows up in India's hiring reports, and it is stronger above the entry level. foundit's Insights Tracker for December 2025 (India) lists Cloud (AWS/Azure/GCP) at a 12% share of top skills for 0 to 3 years of experience, Cloud Engineering (AWS/Azure) at 21% for 4 to 6 years and Cloud Architecture at 20% for 7 to 10 years. Its June 2026 hiring snapshot, published in July 2026, lists Cloud Engineers at +28% year on year among trending roles in BFSI global capability centres and Cloud Architects at +25% in IT-sector global capability centres.

The skill labels differ by band, but cloud ranks first in the 4 to 6 year list and fourth in the 0 to 3 year list, so demand leans towards people with some experience. A project that runs, is monitored and has a cost note is the closest substitute a beginner can show.

What are the limits of this roadmap?

A roadmap shortens the search and does not replace experience. Vendors set their own markers: Google Cloud recommends 6+ months of hands-on work for its associate certification, and AWS recommends one or more years for the Developer - Associate. Free offers and exam details change, a mock is not a real account, and pay depends on employer, city and experience and is not covered here. Names also move: AWS renamed SysOps Administrator to CloudOps Engineer, and Terraform's licence change produced OpenTofu.

Where does this roadmap fit in an AI and ML programme?

Certification in Artificial Intelligence and Machine Learning is an online programme from Vishlesan i-Hub, IIT Patna, delivered on Masai's online platform, that covers Python, machine learning, deep learning, generative AI and LLMs, agentic systems and deploying models to production. Its topics include Python programming, containerised cloud deployment, and logging, monitoring and alerting, which overlap with stages 3, 6 and 7. The topic list does not name networking or infrastructure as code, so those stages need separate practice.

Frequently asked questions

How long does it take to become a cloud engineer?

The time to become a cloud engineer depends on the starting point, and the vendors set experience markers rather than timelines: Google Cloud recommends 6+ months of hands-on experience for the Associate Cloud Engineer certification, and AWS recommends one or more years for its Developer - Associate. Plan by stages passed and projects deployed, not by weeks.

Do you need a degree to work in cloud computing?

The AWS, Microsoft and Google Cloud entry and associate certification pages do not list a degree as a requirement. Google Cloud's Associate Cloud Engineer lists no prerequisites, and AWS describes Certified Cloud Practitioner as a good starting point for people with no prior IT or cloud experience. Employers set their own requirements, so check each posting.

Which cloud certification should a beginner take?

A beginner should take the foundational certification of the provider used for the first project: AWS Certified Cloud Practitioner (CLF-C02), Microsoft Azure Fundamentals (AZ-900) or Google Cloud's Cloud Digital Leader. The associate certifications follow, such as Azure Administrator Associate (AZ-104) or Google Cloud's Associate Cloud Engineer.

Do cloud engineers need to code?

Scripting is part of the job, though associate exams do not demand deep coding. AWS says the Solutions Architect - Associate exam does not require deep hands-on coding experience, while Microsoft's Azure Administrator Associate page expects experience with PowerShell, Azure CLI and Bicep or ARM templates. One language, Python or Go, is enough to start.

Should a beginner learn AWS, Azure or Google Cloud first?

A beginner should pick the one that the target employers use and learn it in depth, because the concepts carry over. In the Stack Overflow Developer Survey 2026, AWS was used by 41.8% of 10,889 respondents, Azure by 25.1% and Google Cloud by 24.5%. Microsoft's own documentation maps AWS services to roughly comparable Azure services.

What is infrastructure as code in cloud engineering?

Infrastructure as code means defining cloud resources in configuration files that can be versioned, reused and shared, instead of creating them by hand in a console. HashiCorp describes Terraform this way, and AWS CloudFormation does the same for AWS with templates that describe the resources to create.

Next step

Pick one provider this week, finish stages 1 and 2 with the subnet script, then build the stage 4 bucket and role. The Certification in Artificial Intelligence and Machine Learning page lists the deployment and MLOps modules for readers who want a guided route into running models in production, and the DevOps engineer roadmap and data engineer roadmap show where the cloud skills lead next.