Why Companies Need a Cloud Engineer

# main.tf — provisioning a real cloud environment with Terraform
# This is the kind of project that convinces interviewers you can build,
# not just talk about, cloud infrastructure.

terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"   # Mumbai
}

# 1. Networking — a VPC with public and private subnets
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags = {
    Name = "app-vpc"
  }
}

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.${count.index}.0/24"
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
}

resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 10}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
}

# 2. Compute — an EC2 instance with a security group
resource "aws_security_group" "web" {
  name   = "app-web-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami                    = "ami-0c1a7f894efd4c6b4"
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.public[0].id
  vpc_security_group_ids = [aws_security_group.web.id]
}

# 3. Storage — a private S3 bucket
resource "aws_s3_bucket" "artifacts" {
  bucket = "app-artifacts-${random_id.suffix.hex}"
}

resource "aws_s3_bucket_public_access_block" "artifacts" {
  bucket                  = aws_s3_bucket.artifacts.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "random_id" "suffix" {
  byte_length = 4
}

# 4. Outputs
output "vpc_id" {
  value = aws_vpc.main.id
}

output "web_public_ip" {
  value = aws_instance.web.public_ip
}

# What an interviewer looks for:
# - Do you use modules and variables, or hardcoded values?
# - Do you understand VPC, subnets, security groups, and IAM?
# - Do you think about least privilege (S3 public access blocked)?
# - Can you explain why terraform state should be stored remotely?
#
# This single project — with a README and a public plan output — is
# worth more than three certification PDFs.

# aws_cli_workflow.sh — a real day-in-the-life workflow of a cloud engineer
# The AWS CLI is one of the most underrated skills for cloud interviews.

#!/usr/bin/env bash
set -euo pipefail

# 1. Verify identity and account — first thing a cloud engineer does
echo "=== whoami ==="
aws sts get-caller-identity

# 2. List running EC2 instances in the account
echo "=== running instances ==="
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query "Reservations[*].Instances[*].[InstanceId,InstanceType,PublicIpAddress]" \
  --output table

# 3. Check S3 buckets and their public access status
echo "=== S3 buckets ==="
aws s3 ls

# 4. Look at CloudWatch alarms that are currently firing
echo "=== firing alarms ==="
aws cloudwatch describe-alarms \
  --state-value ALARM \
  --query "MetricAlarms[*].[AlarmName,StateUpdatedTimestamp]" \
  --output table

# 5. Estimate cost impact of a recent change
echo "=== cost forecast ==="
aws ce get-cost-forecast \
  --time-period Start="$(date +%Y-%m-01)",End="$(date -d '+1 month' +%Y-%m-01)" \
  --metric BLENDED_COST \
  --granularity MONTHLY \
  --output table

# What an interviewer looks for:
# - Do you know what STS is and why identity checks matter?
# - Can you use --query to filter CLI output (JMESPath)?
# - Do you understand filters vs tags vs state?
# - Do you think about cost, not just uptime?
#
# This is the daily reality of a cloud support or cloud engineer role.
# Freshers who know this well clear interviews faster than those
# who only know the console UI.

# deployment.yaml — deploying a containerised app to Kubernetes
# Kubernetes is the default container orchestration layer on every cloud.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  labels:
    app: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: 123456789012.dkr.ecr.ap-south-1.amazonaws.com/api:latest
          ports:
            - containerPort: 8000
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "256Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: LoadBalancer
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 8000
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

# What an interviewer looks for:
# - Resource requests and limits — do you understand why both matter?
# - Health checks — liveness vs readiness probes
# - Autoscaling — how does HPA react to CPU pressure?
# - LoadBalancer vs ClusterIP vs NodePort — when to use each?
#
# A fresher who can explain this file end-to-end stands out
# immediately in a cloud engineering interview.