Cloud Architect
Design high-availability, high-scale global systems on cloud infrastructure
Not sure this is right for you? Find My Match →
0 of 8 missions done
Is this career for you?
Two minutes before you commit months
Tick what sounds like you
Tick the ones that are true for you.
Skills you'll walk away with
Jobs this leads to
- Cloud Architect
- Solutions Architect
- Enterprise Architect
Before you start
- ✓ Prior experience as a developer, sysadmin, or DevOps engineer
- ✓ Understanding of the software development lifecycle (SDLC)
8 missions to Cloud Architect
4 worlds, 8 missions. Tap any circle to open it; the glowing one is next.
Before you can architect remote infrastructure, you must deeply understand how systems function underneath.
Master the core services of a major provider (e.g., AWS, Azure, or GCP). Do not attempt to learn all three at once.
Architecture is about trade-offs. Learn to design robust templates for specific business needs.
Enterprise architects deal with cost, legacy migrations, and executive strategy.
More about this career
About the job, pay where you live, questions people ask, and where this career can take you next.
About the job
What you’d do
- Talk with staff or clients to understand what a system must do
- Identify the data, hardware and software components needed to meet user needs
- Check that a system design is stable, secure, portable and able to scale
- Give teams guidelines for building secure systems
- Work with engineers and developers to choose the right design solutions
- Present designs to management, customers and staff
Where you’d work
- Computer systems design firms
- Finance and insurance
- Telecommunications companies
- Company head offices
- Administrative and support services
Every step in full
The complete text of every step, to read or print. Work through them in the journey above.
IT & Systems Foundation 2 steps
Advanced Networking
The backbone of the cloud. Without networking skills, you cannot connect on-premise data centers to the cloud.
Real-world task: Use a subnet calculator to divide a generic 10.0.0.0/16 network into 4 private subnets (for databases) and 4 public subnets (for web servers), ensuring you don't overlap IP ranges.
Why it matters: The #1 reason a legacy application fails in a lift-and-shift migration is a misunderstanding of subnetting and cloud routing tables.
Checklist
- Master IP Subnetting and CIDR block notation natively
- Understand Layer 4 vs Layer 7 load balancing
- Understand DNS concepts (A records, CNAME, Alias, TTL)
- Learn BGP (Border Gateway Protocol) basics for hybrid routing
- Understand IPSec VPNs and dedicated lines (e.g., AWS Direct Connect)
Operating Systems & Virtualization
Knowing the difference between bare-metal, hypervisors, and containers to choose the right compute layer.
Real-world task: Install Docker locally. Run a basic NGINX web server container, mount a local volume to the container, and map port 8080 to your local machine. Contrast this with setting up a full VirtualBox VM.
Why it matters: If you just blindly recommend converting everything to Kubernetes without understanding the overhead, you will cost your client thousands of hours in unnecessary engineering.
Checklist
- Understand Type-1 vs Type-2 hypervisors
- Learn the difference between a virtual machine and a Docker container
- Understand block storage vs file storage vs object storage tradeoffs
- Grasp Linux system essentials, Daemons, and Kernel limits
Cloud Vendor Deep Dive 2 steps
Core Infrastructure (Compute, Network, Storage)
Implementing the holy trinity of IT inside a specific vendor's ecosystem.
Real-world task: In an AWS Free Tier account, create a highly available VPC spanning two Availability Zones. Put a load balancer in the public subnets routing traffic to EC2 instances in the private subnets. Ensure the EC2 instances can reach the internet via a NAT Gateway to download updates.
Why it matters: This is the absolute baseline topology for deploying secure enterprise applications to the cloud. You have to be able to build it with your eyes closed.
Checklist
- Configure a Virtual Private Cloud (VPC) with public/private subnets and NAT Gateways
- Understand Auto-Scaling Groups and Machine Image templates (AMIs)
- Master object storage constraints and lifecycle policies (e.g., S3 Glacier)
- Compare managed SQL vs NoSQL offerings provided by the vendor
- Learn serverless compute triggers and limitations/timeouts
Identity, Security & IAM
Designing the access permissions to ensure only the right people (and services) can modify cloud resources.
Real-world task: Create an IAM role that allows an EC2 instance to read from exactly one specific S3 bucket, and nothing else. Attach it. Never use long-term access keys on a compute instance.
Why it matters: A single asterisk '*' in an IAM policy has resulted in multi-million dollar data breaches. As the architect, the blast radius bounds are determined by you.
Checklist
- Understand Users vs Groups vs Roles
- Write strict JSON-based IAM policies using the 'Least Privilege' principle
- Implement cross-account role assumption for multi-environment setups (Dev/Prod)
- Configure a Web Application Firewall (WAF) to block bad traffic
- Enable CloudTrail (or equivalent) for architectural auditing
System Design Architecture 2 steps
Decoupling & Event-Driven Architecture
Breaking monoliths apart so that if one piece goes down, the entire system doesn't crash.
Real-world task: Architect a 'Ticket Master' style booking system on a whiteboard. Use an API Gateway hitting a queue before processing the orders, guaranteeing that if the database locks during high traffic, no customer orders are lost in the ether.
Why it matters: Spiky workloads destroy traditional monolithic systems. Modern architectures absorb spikes asynchronously.
Checklist
- Use message queues (SQS, RabbitMQ) to buffer traffic spikes
- Implement Pub/Sub models (SNS, Kafka) to push events to multiple listeners
- Understand stateless vs stateful application design
- Design for idempotency (an operation can safely run multiple times)
High Availability (HA) & Disaster Recovery
Ensuring the business survives an availability zone failing or a ransomware encryption event.
Real-world task: Write a disaster recovery document detailing a 'Warm Standby' strategy for a critical application. Detail the latency metrics required to automatically trigger a DNS flip to the backup region.
Why it matters: Executives do not care about the underlying technology; they care how many minutes of downtime they endure when 'us-east-1' inevitably goes down.
Checklist
- Calculate RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
- Design Pilot Light vs Warm Standby vs Multi-Region Active-Active failovers
- Implement immutable backups spanning multiple geographic regions
- Use Route53 (DNS) health checks to automate regional traffic failback
Migration, FinOps & Strategy 2 steps
Cloud FinOps (Cloud Economics)
Controlling the massive bill that surprises companies moving to the cloud.
Real-world task: Use the AWS Pricing Calculator. Estimate the monthly cost of running two large EC2 database servers across different AZs, 1TB of S3 storage, and 500GB of outbound data transfer. Re-calculate the cost using a 3-Year Reserved Instance plan.
Why it matters: Architects who can cut a large share of an enterprise cloud bill through optimisation quickly show their worth to the business.
Checklist
- Implement rigorous Cost Allocation tagging policies
- Balance On-Demand, Reserved Instances, and Spot compute buying strategies
- Evaluate data transfer (egress) costs which are notoriously expensive
- Set up billing alerts to catch run-away serverless workloads
Migration Strategies & Executive Alignment
Navigating the business politics and execution of leaving a data center.
Real-world task: Create a high-level presentation deck. Propose why a legacy on-premise application should be 'Replatformed' to managed containers rather than merely 'Rehosted' (lift-and-shifted) onto cloud virtual machines, citing specific operational overhead reductions.
Why it matters: The hardest part of the job isn't the technology, it's convincing the Board of Directors that the risk of migrating is worth the ROI (Return on Investment).
Checklist
- Master the 6 R's: Rehost, Replatform, Refactor, Repurchase, Retain, Retire
- Communicate complex diagrams via draw.io to non-technical stakeholders
- Assess applications for 'Cloud Readiness' (licensing, strict latency boundaries)
- Understand vendor lock-in risks (Kubernetes vs proprietary managed services)
Questions people ask about Cloud Architect
Clear answers regarding timelines, prerequisites, salaries, and study strategies.
How long does it take to become a Cloud Architect?
This roadmap estimates 12–18 months. It has 4 phases and 8 steps, from “IT & Systems Foundation” to “Migration, FinOps & Strategy”.
How do I become a Cloud Architect?
Follow the 4 phases in order, starting with Phase 1, “IT & Systems Foundation”. Your first task: Use a subnet calculator to divide a generic 10.0.0.0/16 network into 4 private subnets (for databases) and 4 public subnets (for web servers), ensuring you don't overlap IP ranges.
How much does a Cloud Architect earn?
Pay depends on the country. The salary box on this page shows DraftMyCareer’s estimate, in local currency, for the country chosen in the menu.
What do I need before starting?
This roadmap lists: Prior experience as a developer, sysadmin, or DevOps engineer; Understanding of the software development lifecycle (SDLC).
What skills does a Cloud Architect need?
This roadmap covers: System Design, AWS / Azure / GCP, Networking, Security / IAM, Cost Optimization, Microservices, Migration Strategies.
Switch Careers: Paths Into and Out of This Role
See every switch →Moving Into This Role From Other Jobs
- From: DevOps Engineer
Cloud Architects define strategic technical direction for enterprises, earning top-tier staff compensation.
⏱ 4–6 months🧭 ModerateWhat carries overIaC & Terraform · Cloud platform primitives · Containerization
View Action Plan
- Month 1–2: Cloud Architecture Certification Study and obtain AWS Solutions Architect Professional or Google Cloud Architect.
- Month 3–4: Enterprise Distributed Systems Design resilient multi-AZ architectures, event-driven pipelines, and VPC peering topologies.
- Month 5–6: FinOps & Governance Implement organization-wide cost optimization, security boundaries, and SLA governance.
- From: Cybersecurity Analyst
Combine critical cybersecurity expertise with cloud architecture for premier enterprise security architect roles.
⏱ 4–6 months🧭 ModerateWhat carries overNetwork security & firewalls · Threat modeling · Compliance & identity (IAM)
View Action Plan
- Month 1–2: Cloud Core Services Deeply study compute, storage, VPC networking, and database services on AWS or Azure.
- Month 3–4: Cloud Security & IaC Author secure Terraform templates with automated compliance guardrails and least-privilege IAM.
- Month 5–6: Solutions Architecture Design resilient, fault-tolerant enterprise systems and pass Cloud Solutions Architect Pro exam.