Cloud Engineer → Architect

PHASE 00

Foundations

Weeks 1–4 Do not skip Cost: ₹0

Most freshers jump straight to AWS and get stuck because they don't understand what's happening underneath. Four weeks here saves months of confusion later — and these fundamentals are exactly what separates someone who can troubleshoot in an interview from someone who memorized slides.

WEEK 04Virtualization + cloud concepts + AWS account▾

Understand virtualization — hypervisors, VMs vs containers conceptually
IaaS vs PaaS vs SaaS — real examples, not just definitions
Cloud deployment models — public, private, hybrid
CapEx vs OpEx — why companies migrate to cloud
Create your AWS free tier account — enable MFA immediately
Explore the console — regions, availability zones, global infra map
Understand the AWS shared responsibility model
Set a billing alarm at $5 before touching any service

Checkpoint — you should now be able to explain subnetting, write a bash script, push code to GitHub, SSH into a remote machine, explain IaaS, and set up an AWS account safely. Shaky on any of these? Spend another week here.

PHASE 01

AWS core services + Cloud Practitioner

Weeks 5–8 Cert: AWS CLF-C02 — $100 (~₹8,500–10,500)

Every service you touch must be hands-on in your free tier account. Reading alone is useless. Break things, fix them, understand why.

WEEK 05EC2 + IAM — compute and identity▾

Launch a t2.micro instance, connect via SSH, run a web server, terminate it
Instance types (t/m/c/r families), pricing — on-demand, reserved, spot, savings plans
AMIs — launch from a community AMI, understand snapshots
Security groups — allow port 22/80, stateful rules vs NACLs
Key pairs — create, download, SSH, understand losing a key
IAM — create a user, attach a policy, never use root daily
IAM roles — EC2 role to access S3, understand trust policies
Read a JSON IAM policy — Effect/Action/Resource/Condition
Enable MFA on root and IAM user

AWS Skill Builder — free tier Stephane Maarek CCP — Udemy ₹499

WEEK 07RDS + Lambda + CloudWatch▾

Launch a MySQL db.t2.micro — multi-AZ vs single-AZ
Connect from EC2 — security group rules between them
Manual snapshot, automated backups, retention periods
Lambda — create a Python function, test in console, triggers
S3 trigger — Lambda logs filename on every upload
API Gateway — simple REST API calling your Lambda, test with curl
CloudWatch — metric alarm on EC2 CPU, log groups
CloudWatch Logs — push EC2 logs, query them
CloudTrail — enable, understand captured API calls

WEEK 08CCP exam prep + take the exam▾

Review all domains — Cloud Concepts 26%, Security 25%, Tech 33%, Billing 16%
3 full practice exams — aim for 85%+ before booking
Focus weak areas — billing and pricing trip most people up
AWS support plans — Basic, Developer, Business, Enterprise
Re-review the shared responsibility model with examples
Book exam — online proctored via Pearson VUE
Take it. Pass it. Get the digital badge.
Activate your 50% discount voucher for the next exam

Tutorials Dojo practice questions Jon Bonso practice exams — ₹499 Exam fee — $100 (~₹8,500–10,500)

Phase 1 end state — AWS Cloud Practitioner certified. Hands-on with EC2, S3, IAM, VPC, RDS, Lambda, CloudWatch. A static site live on S3. A GitHub repo. You look like a serious candidate now.

PHASE 02

AWS deep dive + Solutions Architect Associate

Weeks 9–16 Cert: SAA-C03 — $75 with 50% voucher (~₹6,200)

SAA-C03 is the most requested cert in Indian cloud job listings. Its four domains are weighted Security 30%, Resilience 26%, Performance 24%, Cost 20% — security is the single heaviest domain, so don't treat it as an afterthought. Eight weeks, deep work. This is where your resume goes from maybe to interview.

WK 09–10High availability — ELB, Auto Scaling, Route53▾

ALB vs NLB vs CLB — differences, use cases, SAA preferences
ALB hands-on — target group, test failover by stopping an instance
Auto Scaling Groups — min/max/desired, test scale-out with CPU stress
Scaling policies — target tracking vs step vs scheduled
Launch templates vs launch configurations — SAA tests this
Route53 routing policies — Simple, Weighted, Latency, Failover, Geo, Geoproximity
Route53 health checks — how failover routing uses them
CloudFront — distribution in front of your S3 site, edge locations, TTL, invalidation

WK 11–12Storage deep dive + decoupled architectures▾

EBS volume types — gp2 vs gp3 vs io1 vs st1 vs sc1, IOPS, throughput
EFS — mount on two EC2 instances simultaneously, test shared access
EFS vs EBS vs S3 — the classic SAA question
SQS — send/poll messages, visibility timeout, dead letter queues
SNS — topic, subscribe email + SQS, publish, observe fan-out
SQS vs SNS vs EventBridge — when to use which (heavily tested)
Kinesis Data Streams vs SQS — streaming vs queue differences
DynamoDB — create a table, put/query items, GSI vs LSI
DynamoDB on-demand vs provisioned capacity — cost implications

WK 15–16SAA-C03 exam prep + take the exam▾

5+ full practice exams — 65 questions each, target 82%+ consistently
Review every wrong answer — understand why, not just what
Focus on tradeoffs — cost vs availability vs performance vs security
Re-review ELB types, RDS vs Aurora vs DynamoDB, S3 lifecycle
Practice scenario questions — "company needs X, constraint Y, which architecture?"
Book exam using your 50% voucher from CCP — brings it to ~$75
Take the exam. Minimum passing score is 720 out of 1000. You're SAA-C03 certified.

Stephane Maarek SAA — Udemy ₹499 Adrian Cantrill — saa-c03.com, gold standard Jon Bonso practice exams — Tutorials Dojo ₹499 Exam fee — $75 with voucher (~₹6,200)

Phase 2 end state — AWS SAA-C03 certified. This single cert + Phase 1 hands-on work makes you viable for junior cloud roles at ₹6–9 LPA. Two AWS projects live on GitHub. Start applying while completing Phase 3.

PHASE 03

DevOps + Kubernetes — the salary multiplier

Weeks 17–22 K8s is now "the single most career-defining skill"

SAA gets you the interview. Container orchestration gets you the offer at higher pay. 2026 Indian hiring data treats Kubernetes as the single highest-leverage skill in this entire roadmap — it now gets a full two weeks here instead of being squeezed into a single week, alongside observability and FinOps as named, separate skill tracks.

WEEK 19Kubernetes part 1 — architecture and core objects▾

K8s architecture — control plane (api-server, etcd, scheduler, controller-manager) vs worker nodes (kubelet, kube-proxy)
Core objects — Pod, Deployment, ReplicaSet, Namespace
Services — ClusterIP, NodePort, LoadBalancer — when to use each
ConfigMaps and Secrets — externalize app configuration
kubectl — apply, get, describe, logs, exec, port-forward — your daily tools
Install minikube or kind locally, deploy a sample app, expose with a service
YAML manifests — write your own Deployment + Service from scratch, no copy-paste
Resource requests and limits — CPU/memory, why pods get OOMKilled

Kubernetes docs — k8s.io TechWorld with Nana — K8s tutorial

WEEK 20Kubernetes part 2 — networking, scaling, EKS, and GitOps▾

Ingress — what it does, how it differs from a LoadBalancer Service
Horizontal Pod Autoscaler — scale pods based on CPU/memory metrics
Cluster Autoscaler basics — scale nodes, not just pods
StatefulSets vs Deployments — when state matters (databases in K8s)
EKS — create a real cluster on AWS (free tier covers control plane cost partially), deploy your Docker image from week 17
EKS networking — VPC CNI, security groups for pods
GitOps concepts — what ArgoCD or FluxCD do and why they matter
Helm basics — package manager for K8s, install a chart, understand values.yaml
Terminate the EKS cluster when done — it is not free tier eligible long-term, avoid surprise bills

Why this gets two full weeks — 2026 Indian hiring data is explicit that Kubernetes is the single most career-defining skill in this stack. A fresher who can speak fluently about Services, Ingress, and autoscaling — and has actually run a cluster — stands out sharply from one who only memorized Docker.

WEEK 22FinOps + Terraform Associate cert▾

FinOps basics — cost ownership is now expected of engineers, not just managers

AWS Cost Explorer — explore your own (small) free tier spend
Reserved Instances vs Savings Plans vs Spot — when each makes sense
Rightsizing — identify an oversized resource and resize it
S3 storage class transitions as a cost lever, not just an availability one
Set a budget alert in AWS Budgets, understand cost allocation tags

Terraform Associate cert

Review the official study guide and practice questions
Book and take the Terraform Associate exam

Terraform exam — ~₹5,000

PHASE 04

Portfolio projects + job applications

Weeks 23–28 This is what actually gets you hired

Certs prove you studied. Projects prove you can do the work. Recruiters now expect to see real GitHub repos with documented architecture — "three real GitHub projects with proper documentation beat any certificate sticker in interviews" is the consistent line across 2026 hiring guides.

WEEK 23Project 1 — Static website, full AWS stack▾

Build a personal portfolio website or static blog
Host on S3 with static website hosting
CloudFront in front of S3 with HTTPS via ACM
Route53 — register or use a subdomain, point to CloudFront
S3 bucket policy — public read only via CloudFront OAC
Provision everything with Terraform
CI/CD — GitHub Actions deploys on every push to main
Write a README — architecture diagram, deploy steps, cost estimate

Outcome — a live website at your own domain, deployed via IaC, with automated CI/CD. Demonstrates S3, CloudFront, Route53, ACM, Terraform, and GitHub Actions.

WEEK 24Project 2 — Serverless REST API▾

Build a URL shortener, notes API, or visitor counter
Stack — API Gateway → Lambda (Python) → DynamoDB
Lambda — implement full CRUD operations
DynamoDB — proper partition key design, single-table basics
API Gateway — REST methods, enable CORS for frontend access
IAM — Lambda role with least-privilege DynamoDB access only
Provision everything with Terraform — no manual console clicking
CloudWatch — log every invocation, alarm on error rate
GitHub Actions — deploy Lambda code automatically on push

Outcome — a live API you can curl. Shows Lambda, API Gateway, DynamoDB, IAM least privilege, Terraform, monitoring. Pure serverless — very in-demand.

WEEK 25–26Project 3 — Kubernetes app on EKS, full CI/CD▾

Containerize a Flask or Node.js app with Docker — multi-stage build
Push image to AWS ECR, registry created via Terraform
Deploy on EKS — write your own Deployment, Service, and Ingress manifests
RDS PostgreSQL outside the cluster — not a pod, in a private subnet
Horizontal Pod Autoscaler configured and tested under load
Full Terraform — VPC, subnets, EKS cluster, RDS, security groups
GitHub Actions — push → test → build → ECR → kubectl apply → zero-downtime rollout
Grafana dashboard showing your app's live CPU/memory and request count
Terminate the EKS cluster after recording a demo — avoid ongoing cost

Outcome — this is the project that impresses. Docker + EKS + Terraform + CI/CD + observability in one. Given that Kubernetes is the highest-leverage skill in 2026 hiring, this single project — properly documented with an architecture diagram — is worth more in interviews than any certificate alone.

WEEK 27–28Resume + LinkedIn + applications — go live▾

Resume — 1 page. Certs at top, skills grouped by category (Cloud Platforms, IaC, Containers, Observability, FinOps), projects with GitHub links
Use exact service names from job descriptions — write "Amazon EKS" not "managed Kubernetes" for ATS matching
Quantify achievements even in personal projects — resource counts, deployment time saved, uptime
GitHub profile — pin 3 main projects, proper bio, link LinkedIn
LinkedIn — headline with certs, connect with cloud engineers, post about your projects
Apply daily — 10 to 15 targeted applications, Naukri + LinkedIn + career pages
Target companies — Persistent, HCLTech, Accenture Cloud, TCS, Cognizant, Capgemini, GCCs (Walmart, Goldman Sachs, HSBC)
In Kerala specifically — check Infopark Kochi and Technopark Trivandrum listings regularly; cloud fresher volume is smaller but real, and DevOps roles do open there
Interview prep — practice explaining your projects and common troubleshooting scenarios

End state after ~7 months — AWS Cloud Practitioner + SAA-C03 + Terraform Associate. Three deployed projects on GitHub including a real EKS deployment. Hands-on across EC2, S3, VPC, RDS, Lambda, EKS, Terraform, Docker, GitHub Actions, Prometheus/Grafana. Ready for ₹6–9 LPA at service companies, ₹8–12 LPA at product companies and GCCs.

PHASE 05

The engineer → architect transition

Starts after 2–3 years as a working engineer This is not automatic

This is the part most roadmaps skip. Getting hired as a cloud engineer is a skills problem you can solve by studying. Becoming a solutions architect is a different problem — it requires the same technical depth plus things that don't show up in a syllabus: real migration experience, the ability to make and defend trade-off decisions, and the comfort to present those decisions to people who aren't engineers. Below is what actually closes that gap, based on people who've made the jump describing it directly.

YEAR 1–2Be excellent at the engineer job first▾

Own infrastructure end to end — not just "I deployed it" but "I deployed it, debugged it at 11pm, and fixed the root cause"
Volunteer for the unglamorous work — IAM cleanups, cost audits, incident postmortems. This is where architects are made.
Get genuinely good at debugging distributed systems under pressure, not just building them when nothing's on fire
Add AWS DevOps Engineer Professional or Security Specialty once you have 1–2 years of real production experience
Start writing — internal runbooks, postmortems, design docs for even small changes. This builds the muscle architects need daily.

SAP-C02 / DOP-C02 exam — $300 (~₹25,000)

YEAR 2–3Seek out architecture and migration exposure deliberately▾

Find a system you're familiar with at work and design — on paper — how you'd migrate it to the cloud or to a better architecture
Follow AWS migration workshops and read AWS's own migration guidance blogs
Ask to shadow or assist on an actual migration or major infra redesign project at your company, even informally
Practice writing technical design documents — the kind that gets reviewed in a design meeting, not just code comments
Daily architecture practice — pick one real-world problem, design a solution, record yourself explaining it, refine until it's clean
Build a portfolio of 3–4 written architecture case studies — problem, constraints, trade-offs considered, final design, why

Why this matters — the technical bar for SAA-C03 and even AWS Professional certs is "can you pick the right service." The bar for an actual architect role is "can you justify why you picked it over three other valid options, in front of a room that includes non-engineers." That's a different skill, and it only comes from deliberate practice, not study alone.

ONGOINGCommunication and stakeholder skills — the part engineers skip▾

Practice presenting and whiteboarding — comfort speaking with both engineers and non-technical executives is explicitly called out as core to the SA role
Find opportunities to present in meetings at your current job — even small updates build this muscle
Join or attend cloud meetups in your city — Bangalore, Hyderabad, and increasingly Kochi/Trivandrum have active ones
Start a technical blog or YouTube channel explaining architecture decisions — this is one of the most repeated pieces of advice from people who made this exact transition
Learn basic business fluency — return on investment, cost-benefit framing, how to talk about technical decisions in terms a CFO cares about
Build comfort translating "we should use X service" into "this saves us 30% in monthly spend while keeping the same SLA" — that translation is the actual job

YEAR 3–4Make the formal jump▾

By now you should hold SAA-C03 plus one Professional-level cert (SAP-C02 or DOP-C02)
Your portfolio should include real production migration or major redesign experience — not just personal projects
Update your title positioning — "Senior Cloud Engineer" with explicit architecture ownership language in your resume bullets
Target Junior/Associate Cloud Architect roles internally first — internal transitions are easier than external for this jump
If targeting Microsoft, Amazon, or similar — note that some companies do hire directly into customer-facing CSA-style roles for strong M.Tech or research-background candidates; for a standard BTech path, the internal-promotion route after 3–5 years of strong engineering work is the realistic and well-trodden path
Interview prep — expect system design rounds, trade-off discussion rounds, and at least one round assessing communication and stakeholder handling, not just technical depth

Realistic timeline — 3 to 5 years from your first cloud engineering job to a genuine architect title, faster at high-growth product companies, slower at large service companies. This matches what people who've actually made this transition report, and it lines up with how Indian and global job markets price the role — architect-level compensation in India runs roughly ₹22–45 LPA depending on company tier, against ₹6–12 LPA at the fresher engineer stage you're starting from.

You are here — CSE fresher

Month 0

Completing this roadmap. Target: first cloud engineering role.

Junior / Associate Cloud Engineer

Month 7–12

₹6–12 LPA. Ticketed work, guided deployments, learning production operations.

Cloud Engineer

Year 1.5–3

₹9–15 LPA. Owns infrastructure, writes Terraform modules, debugs production issues independently.

Senior Cloud Engineer / SRE

Year 3–5

₹15–22 LPA. Leads design discussions, mentors juniors, owns migration projects.

Cloud Solutions Architect

Year 4–7

₹22–45 LPA. Designs systems, owns trade-off decisions, presents to stakeholders and leadership.

PHASE 06

Summary — the full picture

Certifications — phase 1 to 3 (≈7 months)

AWS Cloud Practitioner CLF-C02 (wk 8), AWS Solutions Architect Associate SAA-C03 (wk 16), HashiCorp Terraform Associate (wk 22).

Certifications — engineer to architect (year 1–4)

AWS DevOps Engineer Professional or Solutions Architect Professional (SAP-C02), optionally AWS Security Specialty depending on specialization.

Projects on GitHub

Static site with S3/CloudFront/Terraform, serverless API with Lambda/DynamoDB, and a Kubernetes app on EKS with full CI/CD and observability.

Skills demonstrated by job-hunt stage

AWS core services, Terraform, Docker, Kubernetes/EKS, GitHub Actions, Prometheus/Grafana, FinOps basics, Python scripting, Linux.

Total cost breakdown — engineer phase (~7 months)

AWS Cloud Practitioner exam$100 (~₹9,000)

AWS SAA-C03 exam (with 50% voucher)$75 (~₹6,500)

Terraform Associate exam~₹5,000

Udemy courses (on sale)~₹1,500

Domain for projects (1 yr)~₹700

AWS free tier + EKS testing usage~₹1,000

Engineer-phase total≈ ₹23,700

Total cost — full path to architect (years 1–4)

Engineer-phase certs (above)≈ ₹23,700

AWS Professional-tier exam (SAP-C02 or DOP-C02)$300 (~₹25,000)

Optional Specialty cert (Security, Networking)$300 (~₹25,000)

Full fresher-to-architect total≈ ₹50,000–₹75,000

Time commitment — minimum 2 to 2.5 hours daily to stay on schedule through the engineer phase, no days off during cert prep weeks. Recommended 3 to 4 hours/day, 5 to 6 on weekends. Every concept must be done hands-on in your AWS account — reading alone achieves nothing in cloud, and this is doubly true for Kubernetes.

The honest bottom line — 7 months gets you hired as a cloud engineer. 3 to 5 more years of deliberate, well-directed engineering work — not just time served — gets you to architect. There is no shortcut that skips the engineering years; the few people who land architect-adjacent titles very early typically have an M.Tech or equivalent research background plus exceptional self-directed work. For a standard BTech path, the route above is the real one, and it leads somewhere genuinely good.

Engineer first.Architect after.