Free · Your 4-week roadmap

On-Prem → Cloud Engineer

The full journey, mapped day by day. 2 hours a day for 4 weeks — provider-flexible, so it works whether you choose AWS, Azure, or GCP, with the same Terraform, Kubernetes, and DevOps skills layered on top.

Get the full 4-week roadmap as a PDF

Pop in your details and we'll add you to the Cloud Career Lab list — then you can save this whole plan as a PDF to follow offline.

No spam. Unsubscribe any time.

How to use this roadmap

Block 2 hours every day. Hour 1 is theory and reading; Hour 2 is hands-on. Push your work to a single GitHub repository called onprem-to-cloud so by Day 20 you have a public portfolio. If a day feels heavy, don't skip it — split it across two evenings. Consistency beats intensity.

Pick one cloud (AWS / Azure / GCP) on Day 1 and stay with it through Day 20 — the concepts transfer, but switching providers mid-plan resets your muscle memory. Watch your billing alerts and tear down resources when you're done for the day.

Hour 1 · Learn

Read docs, watch one focused tutorial, take short notes.

Hour 2 · Practice

Code in your repo — no copy-paste.

Deliverable

The artifact you push to GitHub that day.

Pro tip

A small habit or shortcut to make the topic stick.

Not sure which platform to pick?

Choose the cloud platform you're leaning toward and we'll suggest a track to commit to for the full 4 weeks.

The 4 weeks · 40 hours total

Week	Days	Theme	Hours
1	1–5	Cloud & Linux Foundations (Linux, networking, DNS/HTTP, the cloud model, IAM)	10
2	6–10	Core Cloud Services (VPC, scaling, databases, serverless, monitoring, a 3-tier build)	10
3	11–15	Infrastructure as Code & Containers (Terraform, Docker, Kubernetes, Helm)	10
4	16–20	DevOps, AI & Capstone (CI/CD, GitOps, AI for cloud, SRE, security, portfolio)	10

Week 1 · Days 1–5

Cloud & Linux Foundations

Get comfortable with Linux, networking, and how the web actually works — enough to navigate a cloud console, read an architecture diagram, and understand the cloud model and identity basics.

Cloud Account, CLI & Git

Hour 1 · Learn: Create a free-tier account on ONE cloud (AWS, Azure, or GCP). Install the cloud CLI and Git. Set a billing alert. Learn git clone/add/commit/push/pull/status/log.
Hour 2 · Practice: Create your onprem-to-cloud repo, push a README with your goal and chosen cloud, and configure the CLI with a least-privilege user (not the root/owner account).
Deliverable: Public GitHub repo with a first commit + a working CLI (account/whoami check passes).
Pro tip: Set a low monthly budget alert on day one — a forgotten resource is the #1 way beginners get a scary bill.

Linux & the Shell

Hour 1 · Learn: Filesystem and navigation, files and permissions (chmod/chown), users/groups, package managers, processes (ps/top/kill), plus Bash basics and SSH key authentication.
Hour 2 · Practice: Spin up a small Linux VM (or use cloud shell). Create a user, set permissions, install a package, and SSH in to run a health-check script you write.
Deliverable: /week1 notes with 20 commands you ran + one Bash script committed to the repo.
Pro tip: Almost every cloud server is Linux — the shell is the single highest-leverage skill on this list. Always quote your variables in Bash.

Networking, DNS, HTTP & TLS

Hour 1 · Learn: IP addressing, subnets and CIDR, ports, TCP vs UDP, NAT, public vs private IPs; DNS record types; HTTP methods and status codes; what TLS actually secures.
Hour 2 · Practice: Subnet a /24 into four /26s by hand. Use dig/nslookup and curl -v to inspect a real site's DNS records and full TLS handshake.
Deliverable: /week1 subnetting worksheet + annotated dig/curl output.
Pro tip: CIDR math shows up in every VPC interview. Learn to compute usable hosts in your head.

The Cloud Model & IAM

Hour 1 · Learn: IaaS vs PaaS vs SaaS, regions and availability zones, the shared-responsibility model, pricing models; identity basics — users vs roles vs groups, policies, least privilege, MFA.
Hour 2 · Practice: Map 5 services to IaaS/PaaS/SaaS. In the console, create a group with a read-only policy, add a user, enable MFA, and confirm it can read but not write.
Deliverable: /week1 cloud-model notes + IAM setup screenshots + a 1-page least-privilege checklist.
Pro tip: Most cloud incidents are customer misconfigurations, not provider breaches. Never use the root account day-to-day — lock it with MFA.

Compute, Storage & Architecture

Hour 1 · Learn: Virtual machines (sizing, images, user-data, lifecycle), object vs block vs file storage, buckets and signed URLs, and how to read and draw cloud architecture diagrams (tiers, HA across AZs, the well-architected pillars).
Hour 2 · Practice: Launch a VM and host a page via user-data, create a private bucket with a signed URL, then diagram a 2-tier web app (VM + managed DB across two AZs).
Deliverable: /week1 with a screenshot of your live page, the bucket commands, and a 2-tier architecture diagram.
Pro tip: If you can draw it cleanly, you understand it — architecture diagrams are half of cloud interviews. And always tear resources down.

Week 2 · Days 6–10

Core Cloud Services

Go deep on the services you'll use every day — VPC and security, load balancing and scaling, databases, serverless, DNS/CDN, and monitoring — then build a real 3-tier app by hand so you understand what IaC will later automate.

Virtual Networking (VPC)

Hour 1 · Learn: VPC/VNet, public vs private subnets, route tables, internet and NAT gateways, and security groups (stateful) vs network ACLs (stateless).
Hour 2 · Practice: Build a VPC by hand: 2 public + 2 private subnets across 2 AZs, an internet gateway, a NAT gateway, and route tables that work.
Deliverable: /week2 VPC topology diagram + the creation commands.
Pro tip: Public subnet = a route to an internet gateway. That single fact untangles most VPC confusion.

Compute, Load Balancing & Auto Scaling

Hour 1 · Learn: Instance families and sizing, AMIs/images, Layer 4 vs Layer 7 load balancers, target groups, health checks, auto-scaling groups, and why statelessness matters for scaling.
Hour 2 · Practice: Put two web VMs behind a load balancer with a health check, then add an auto-scaling group (min 2 / max 4) and watch a node get replaced.
Deliverable: /week2 with the LB + ASG config and a screenshot of traffic balancing.
Pro tip: If a node can't be killed and replaced freely, it isn't cloud-native yet. Cattle, not pets.

Databases & Caching

Hour 1 · Learn: Managed relational databases (engines, multi-AZ vs read replicas, backups, connection security), when NoSQL beats SQL, and in-memory caching with TTLs.
Hour 2 · Practice: Launch a managed Postgres/MySQL in a private subnet, connect from your web tier only, trigger a snapshot, then add a cache and benchmark a cached vs uncached read.
Deliverable: /week2 with DB setup, a connection test from the app tier, and a cache hit/miss note.
Pro tip: Never put a database in a public subnet. The app tier connects in; the world never does.

Serverless, DNS, CDN & Edge

Hour 1 · Learn: Functions-as-a-service (triggers, cold starts, execution roles, timeouts), managed DNS and routing, CDNs and edge caching, and TLS certificates.
Hour 2 · Practice: Write a function triggered by a file upload that logs name and size. Point a domain at your load balancer and put a CDN in front of your static bucket over HTTPS.
Deliverable: /week2 with the function code, a triggered-log screenshot, and a working HTTPS URL through the CDN.
Pro tip: Cache static assets aggressively at the edge; never cache authenticated or personalized responses.

Monitoring + Mini Capstone (3-Tier App)

Hour 1 · Learn: Metrics vs logs vs traces, dashboards, alarms, basic SLIs; and how to compose a web tier (LB + auto-scaled VMs) → app tier → managed DB into one secure VPC.
Hour 2 · Practice: Build a dashboard with a CPU alarm, then assemble a live 3-tier app end-to-end over HTTPS, document it, and tear it down cleanly.
Deliverable: /week2 with a dashboard + alarm, plus the full 3-tier architecture diagram, setup steps, and teardown checklist.
Pro tip: Always document teardown. The fastest way to a huge bill is forgetting what you spun up.

Week 3 · Days 11–15

Infrastructure as Code & Containers

Stop clicking in consoles. Define your infrastructure declaratively with Terraform, manage state safely with reusable modules, then package apps with Docker and run them on Kubernetes.

Terraform Basics

Hour 1 · Learn: What IaC is and why it matters, declarative vs imperative, providers, the core workflow (init → plan → apply → destroy), variables, outputs, and locals.
Hour 2 · Practice: Write a config that builds a VM or bucket, parameterize region/size/name as variables, output its IP/URL, then destroy it.
Deliverable: /week3 first Terraform config with variables.tf and outputs.tf.
Pro tip: Always read the plan before you apply — Terraform tells you exactly what it will change. Believe it.

Terraform State & Modules

Hour 1 · Learn: What state is and why it's sensitive, remote backends with locking, terraform import, modules (inputs/outputs, the registry, versioning), and for_each/count.
Hour 2 · Practice: Move state to a remote backend with locking. Refactor your VPC into a reusable module and use it to build a dev and a prod network from the same code.
Deliverable: /week3 with a /modules/vpc module used by two environments + remote-state proof.
Pro tip: Never commit terraform.tfstate to Git — it holds secrets. Use a remote backend with locking from day one.

Docker & Compose

Hour 1 · Learn: Images vs containers, the Dockerfile (FROM/RUN/COPY/CMD/EXPOSE), layers and caching, tags, registries, multi-stage builds, and Compose for multi-container apps.
Hour 2 · Practice: Containerize a small web app, push the image to a registry, convert it to a multi-stage build, and run it with a DB and cache via Compose.
Deliverable: /week3 Dockerfile + docker-compose.yml + a before/after image-size note.
Pro tip: Order Dockerfile steps from least- to most-frequently-changed. Good layer caching turns minute-long builds into seconds.

Kubernetes Core

Hour 1 · Learn: Cluster anatomy (control plane, nodes), pods, deployments, rolling updates/rollbacks, services (ClusterIP/NodePort/LoadBalancer), Ingress, ConfigMaps/Secrets, and liveness/readiness probes.
Hour 2 · Practice: Deploy your image to a managed cluster (EKS/AKS/GKE), scale to 3 replicas, expose it via a Service + Ingress, move config to a ConfigMap and Secret, and add probes.
Deliverable: /week3 with deployment.yaml, service.yaml, ingress.yaml, and probes configured.
Pro tip: kubectl get/describe/logs are your first three moves on any broken pod. Learn them cold.

Helm, Scaling & Storage

Hour 1 · Learn: Helm charts and values/templating, the Horizontal Pod Autoscaler, resource requests and limits, and persistent volumes and claims.
Hour 2 · Practice: Package your app as a Helm chart with a values file, add an HPA that scales on CPU, and load-test it to watch pods scale out.
Deliverable: /week3 Helm chart + an HPA scaling-event screenshot.
Pro tip: Always set resource requests and limits. Without them, one greedy pod can starve every neighbor on the node.

Week 4 · Days 16–20

DevOps, AI & Capstone

Ship automatically on every push with CI/CD, multiply your output with AI without losing engineering judgment, touch the reliability and security disciplines, then ship a portfolio and an interview-ready demo.

Git & CI Pipelines

Hour 1 · Learn: Branches, merge vs rebase, pull-request flow and review etiquette, signed commits; CI/CD concepts and pipeline syntax (GitHub Actions / GitLab CI) — triggers, jobs, steps, runners, caching, artifacts.
Hour 2 · Practice: Raise a PR, self-review and merge, tag a release, then build a pipeline that lints and validates your Terraform (fmt -check + validate) on every push to main.
Deliverable: /week4 with visible PR history + a green CI workflow committed.
Pro tip: Small, focused PRs get reviewed fast and break less. Start with the simplest pipeline that fails on bad code.

Build, Deploy & GitOps

Hour 1 · Learn: Building/scanning/tagging container images in CI, deploying from a pipeline (terraform apply / kubectl / Helm), environments and approval gates, the GitOps principle, rollbacks, and OIDC keyless cloud auth.
Hour 2 · Practice: Extend your pipeline to build, scan, and push your image tagged by commit SHA, then deploy to dev automatically and to prod behind a manual approval — using OIDC instead of stored keys.
Deliverable: /week4 with a multi-environment deploy pipeline, an approval step, and keyless auth.
Pro tip: Tag images with the commit SHA, never just :latest. Gate prod behind a manual approval — automation is great until it ships a bad change at 2 AM.

AI for Cloud Engineers

Hour 1 · Learn: Prompt patterns for ops (role + context + constraints + format), AI-assisted Terraform/YAML/shell, and AI for log triage, cost analysis, and incident summaries — plus the guardrails.
Hour 2 · Practice: Have AI draft a Terraform module and a Kubernetes manifest, then review and harden every line. Use it to summarize a real log dump into a 1-paragraph triage note.
Deliverable: /week4 with the AI-generated artifacts, the prompts (in version control), and a list of corrections you made.
Pro tip: Never apply AI-generated infra unread — confidently wrong IaC can delete a production database. Mask secrets and account IDs before pasting anything into a model.

Observability, SRE & Security

Hour 1 · Learn: The four golden signals, SLIs/SLOs/error budgets, alerting that doesn't cry wolf; IAM least privilege revisited, encryption at rest/in transit, the provider's security scanner, and cost-allocation tags + budgets.
Hour 2 · Practice: Define SLOs and build a golden-signals dashboard with one meaningful alert, run your cloud's security scanner and fix the top 5 findings, then add cost tags and a budget.
Deliverable: /week4 with an SLO + golden-signals dashboard and a before/after security-findings summary.
Pro tip: Alert on symptoms users feel (errors, latency), not every internal metric. Encryption and least privilege are interview table stakes.

Capstone, Portfolio & Interview

Hour 1 · Learn: How to package everything: a polished capstone README, an architecture diagram, a 3-minute demo video, a write-up of your journey, and a 2-minute project pitch.
Hour 2 · Practice: Make the capstone reproducible (terraform apply → live app), record the demo, then practice 10 common cloud interview questions out loud (VPC design, IAM, IaC, scaling, incident response) and apply to 3 roles.
Deliverable: Final portfolio: IaC repo + README + architecture diagram + demo video + write-up + 3 applications submitted.
Pro tip: A clean repo + an architecture diagram + a 3-minute demo beats most resumes. Put the link at the top of your CV.

Want the interview prep that goes with this journey?

Our cloud kits cover the solved Q&A for exactly these topics — AWS, Azure, GCP, Kubernetes, Terraform, and DevOps — so you walk into interviews ready.

Browse the kits