Cloud roles mapped to real AWS work
The job is not four isolated titles. A full system test mixes them: design the landing zone, move the old app, run it as containers or serverless, lock it down, and keep the bill explainable. None of these roles train new ML models. They call existing AI services when the business needs text, vision, or documents.
Start here for coverage: DevOps system design checklist
What each role actually does on AWS
| Role | Owns in a build | Does not own |
|---|---|---|
| Cloud Architect | VPC layout, account boundaries, service choice, HA, DR, how AI APIs fit the flow | Training a custom model, day-to-day YAML commits |
| DevOps Engineer | Pipelines, IaC or repeatable console, observability, rollbacks, environment promotion | Product feature code |
| Cloud Developer | Lambda, containers, API contracts, event-driven code, SDK use of managed services | Org SCPs, Transit Gateway design |
| Cloud Security Engineer | IAM, KMS, encryption, logging, GuardDuty, edge controls, evidence for auditors | Feature velocity |
In a 6 hour system you will be asked to play all four. The hidden marks are usually a checkbox (encryption, deletion protection, private DNS on an endpoint, a budget alarm), not a new service name.
Responsibilities and where to read
| Responsibility | Practical shape | Read |
|---|---|---|
| Design the architecture | Private subnets, ingress, east-west, data tier | Networking overview, peering, VPN, TGW, ECS ShopFlow |
| Run infrastructure | EKS or ECS, patching via SSM, backups | EKS runbook, databases |
| Cloud-native apps | API + Lambda or containers, queues, config | serverless SAM, SQS/SNS KMS, AppConfig |
| Security | Identity, encryption, detective controls | security patterns, S3 KMS, IAM triage |
| Migrate workloads | Servers, databases, files | Migration console guide |
| Optimize cost | Tags, budgets, right-size, storage class | Cost console guide |
| Use existing AI | Textract, Comprehend, Rekognition, Bedrock | Managed AI console, Nova |
| Hidden exam settings | The boxes people skip | Competition hidden settings |
One system that uses every role
Northwind moves an on-prem store app to AWS:
- Architect: hub VPC on Transit Gateway, app VPC, data VPC, Site-to-Site VPN during migration, ALB in public subnets, RDS private.
- Migration: Application Migration Service for the app VM, DMS for MySQL, DataSync for the file share.
- Developer: new checkout path on API Gateway, Lambda, DynamoDB, SQS. Invoices go to Textract. No custom model.
- DevOps: CodePipeline builds the container, ECR lifecycle expires old images, AppConfig toggles the new checkout.
- Security: CMK on S3, RDS, SQS. CloudTrail on. GuardDuty on. IMDSv2 required. Flow logs on.
- Cost: cost allocation tags, a budget alarm, S3 lifecycle on raw invoices, Compute Optimizer after two weeks.
If a step has no owner, that is the part the scoring rubric still checks.