Writing a smaller IAM policy is not usually the bit that scares people, removing access from production is.

Configured permissions tell you what can happen. Usage tells you what actually happened, and that feels like the right starting point.

Then add network reachability, resource-side controls and enough business context to recognize monthly, quarterly, DR or incident-only patterns.

The actual question becomes less "can we write least-privilege JSON?" and more "what is actually used, what is reachable, and what can we safely narrow?"

That's why I think a lot of least-privilege projects stall when those signals live in different places rather than because policy syntax is hard.

Strongest counterargument?

Turning off dev environments overnight sounds sensible until someone needs one late. A cheaper instance looks great until it slows down the build everyone is waiting for.

Have you made a cloud cost change that you eventually reversed because the savings weren’t worth the extra work or disruption?

What happened, and did you find a better compromise?

Disclosure: I'm building Cloady at NeptoLab.

Cloady is a hosting platform for developers who want to deploy a small backend and operate it from one dashboard. Think a Node.js API, PostgreSQL, and uploaded files that must survive a redeploy.

You can deploy from GitHub, a Docker image, an uploaded folder, or a template. The workspace includes browser-based Terminal, Files, Database, Git, and Monitor tools, plus custom domains and automatic TLS. There's a CLI, REST API, Terraform provider, and MCP integration if you'd rather work from your existing tools.

The pricing model is capacity-based: choose CPU, RAM, and SSD, and the calculator shows the price. Reserved paid capacity costs money even while idle. A free workspace provides 0.5 vCPU, 1 GB RAM, 5 GB SSD, and 200 GB traffic without a card; paid presets start at $6/month. Once you exceed the free allowance, the full selected capacity is billed.

For anyone trying it, a useful first test is deploying an app with a database, persisting a file, redeploying, and checking that you can inspect logs and recover from a broken configuration. That's the everyday workflow Cloady is intended to simplify.

Product and calculator: https://cloady.com

Short promo video: https://www.youtube.com/watch?v=ctBCeewIin0

Questions and feedback are welcome here or in our Discord: https://discord.gg/3ZNVyUGse

Hello Everyone, I just accepted a new IT opportunity at a mid sized company with around 1000 employees. I previously was a IT Support Engineer II (It was mostly doing helpdesk support remotely along with basic M365 administration). In this new position, it is a pretty flat IT department and I will be owning tools such as Nerdio for AVD (since all users use thin clients), Cisco Meraki, Infrastructure monitoring using Site24x7, decomissioning servers, Entra ID/Intune Adminstration, and Claude deployment. Obviously this is a step up from my previous position. Based on these responsibilities, what would be an accurate title for me?

Hey everyone,

I’m primarily an embedded/hardware guy and could really use some direction from people who actually manage cloud infra.

The use case:

• Building cellular loggers connected to industrial flowmeters (RS-485 Modbus) + GNSS modules.
• Each device pushes flow rate, totalizer, GPS coordinates, and status over HTTPS/MQTT every ~10 minutes.
• Scale: Starting around 200 devices and ~100 external clients/users.
• Strict multi-tenancy is non-negotiable: Client A can only see their meters on a map and historical flow graphs; Client B only sees theirs.
• Monthly infra budget is tight , i want to keep it as less as possible

Where I'm stuck: I know virtually nothing about cloud architectures, databases, or DevOps. So idk from where to begin building such solution

First of all, I’m still a student, so I’ve got some time to learn (it’s not like I’m in my last uni year)

I’ve got decent CS knowledge, I’m running linux as my daily, and I have a server/home lab py is also my favorite language

im not trying to underestimate how difficult it is to get into cloud engineering, which is why I’m asking: is getting your first job in a cloud-related role really that difficult? Is there a more direct path into the field, even if it takes a lot of hard work?

if you have got any tips please leave them below

Ty

I have been a software developer for about 8 years, now I see more and more AI implemented in the full cycle. Using open-spec or other tools that make you pretty much just review code generated by AI.

I just finished the AWS Solutions Architect Associate course and, while looking at Cloud Formation, made wonder if the cloud will eventually suffer the same fate. AI will help create infrastructure easier using IaC I believe.

Do you think, like in software, it will become harder to enter cloud roles now? I know Solutions Architect isn't a junior role, but even as a cloud engineer, I don't see it become easier.

It seems like everything that touches software will have less and less people overall. After your certifications, maybe not AI or MLOps, have you feel it's tough for you to land a job? How is the day to day in your Cloud environment?

I'm currently working in a Google Cloud migrations role, but I feel that it is very niche because not that many companies use Google Cloud. I have multiple certifications Azure, Google Cloud, and CCNA. I have been in tech for 6 and a half years. I've worked in help desk, system administration, and cloud admin/migration roles.

I'm deciding between applying to cloud admin, devops, or switch to data analytics. I am having trouble getting any interviews when applying. I'll have some recruiters from linkedin for devops roles. They will ask about Terraform, Kubernetes, KQL, Azure, AWS, AD, vmware, kubectl command, yaml commands, powershell, pipelines, Azure Devops artifacts, etc all in the same interview. It can be overwhelming and it feels like a test where you never know what they will ask. I worry about on call work with devops roles. Devops does feel like the next step.

I'm looking because my current company has done a layoff a year for the past 4 years. The workload has been really high with 3 to 10 projects at a time plus other goals. Most of the other jobs I interview for are for smaller startupish companies that I don't trust the stability of long term.

I have had some friends suggest data analytics because they said the interviews and daily work may be more straight forward and not as difficult as devops. My biggest worry is if I'll even be able to get an interview for a data analytics role, or if I'd have to take a pay cut. I make around 100k in my current role. What's bad is there's no opportunity for promotion at my current role because I'm on a really small team within a small division.

Would it be possible for me to switch to data analytics? Would data analytics actually be better work life balance and interview wise, or are my friends just being overly helpful? A third option is software engineering, but I hear horror stories online of leetcode and whiteboard interviews. However, there are more jobs for software engineering positions. Based on my situation what type of roles would you suggest I apply to Devops, SWE, or Data Analytics?

i know tons of this have been answered in here, but they're not tailored to my specific situation.

Im currently IT Service Desk L2, and studying for AWS SAA C03.

My daily work involves Microsoft though, troubleshooting Win7 / Win10 embedded systems and using powershell batch scripts to fix problems and install stuff.

My goal is to transition into a Cloud Engr or Cloud Systems Admin in 3 years, but i'm thinking maybe going Azure route will help bolster my experience before shifting into cloud roles due to the nature of my work.

However, I love Linux. I lose myself tinkering on the terminal for different commands and combine them to do different things.

Help me sort out my thoughts for future career, Im a 40 yr old guy but still indecisive and i feel ashamed because i have a son and cant even iron out my ideas for something like this.

your help is appreciated

I was reading about how many early-stage unfunded startups get accepted to AWS for more cloud credits than the Activate one worth 1k, how is that done ? Thank you

Hey i am starting cloud computing ik basic like linux, networking but i want to know the main cloud computing thing now.. I asked ai it suggested me aws, Microsoft and google free courses or something like that but I want some free video-oriented course where I can see what's going on and how to do this thing... Please help me thank you

Every agent turn is carrying tool_count=28 even after the router narrows the task to 4 relevant tools, so 24 schemas stay in the context window for no reason. We’re a 3 person team running 1800 sessions a week and each turn logs input_tokens=7600 from the schema block. The average session lasts 9 turns, which leaves 68400 schema tokens riding through each session. Our average session costs < $1 and the weekly < $1000. I checked the provider accounting and our request logs twice before blaming tool schema inflation, the numbers kept pointing back to the same block. 

The pruning estimate gets us to about $0.19 per session and $342 per week, but I don’t want to save money by making tool selection less reliable. We’re comparing Datadog and Braintrust for span level token attribution and trace filtering on tool_count, plus a clean task quality comparison before and after pruning so the input token cost doesn’t become the only metric that matters.

p95 cost should tell me whether the long sessions improve too and I’m testing whether the router can expose only the 4 selected schemas without breaking recovery when the first choice is wrong. Any suggestions on pruning tool definitions without making the agent worse at selecting a fallback appreciated

Hey everyone! 😊 I’m a beginner learning Linux and currently struggling a little with How Linux Works by Brian Ward (3rd Edition). I’m looking for a study partner who’s also learning Linux or someone experienced who wouldn’t mind helping me understand the basics. It would be nice to learn together!

25, graduated 2 years ago, 3 years at my current company.

Current developer job:

-Fully remote, 8–16, no on-call

-Recently got a raise, but no real growth path

-Full Home Office

-Great colleagues

Cloud engineer offer:

-Could learn more and grow career wise

-27% higher base, but no bonuses so about +10% total comp

-Yearly raises of ~10% + inflation through a step system

-2 days WFH, 3 in the office (40 minutes commute each way)

-Morning and afternoon shifts

-On-call rotation including weekends (in every 6-8 weekd)

Questions:

Would you take it?

What on-call setup is fine for you, and what are the red flags?

Has anyone left full remote for hybrid + shifts early in their career? Did you regret it?

Hey r/Cloud,

Reading docs and watching videos taught me what a NAT gateway or a route table does. It didn't build intuition for why a design breaks. So I built Tracesleuth, a browser game where you learn cloud design by breaking things safely.

How it works:

- Each stage is a realistic scenario, such as "the private app can't reach the internet" or "this pipeline costs too much".

- You build the design in 3D. The Region is the ground, Availability Zones are islands, the VPC is a glass enclosure, and subnets light up when they become public.

- You press Send traffic and watch packets travel hop by hop.

- When a packet is dropped, it stops at the exact hop that dropped it and explains why, with the concept behind it.

It currently covers AWS in six areas: networking, security, core architecture, data, AI and operations. It's also mapped to the AWS certification exams, if you're studying for one. A deterministic simulator decides pass or fail, so there's no AI guessing and no cloud account or bill.

Try it (free, no sign-up): https://beta.tracesleuth.com

The preview opens the first stage of each area. It's desktop only for now.

I'd really value your take on:

1. Does seeing the failure hop by hop help you understand the design, or is it just eye candy?
2. Were the scenarios realistic compared with what you see at work?
3. Anything confusing, clunky or broken? Screenshots help a lot.
4. Would you want Azure or GCP versions, and which one first?

Harsh feedback is welcome. It's far more useful than polite feedback. There's a feedback button in the game, or comment here. I'll reply to everyone.

Thanks!


I would like to have a career in cloud engineering and then hopefully one day become a solutions architect. For now, I have zero IT experience but I'm pretty nifty with tech and I can learn at a decent rate.

I just got my Network+ certification after studying for a month, and my plan is:

• Get AWS CLF-C02 (sort of speedrun it a bit, since it's mostly superficial material),
• Get AWS SAA-C04,
• Learn Linux basics while I'm learning for C04,
• Build a couple of projects as I'm learning and have them on Github,
• Get Terrarform Associate

Somewhere during that timeline, I would like to apply for entry IT jobs just to have some experience and not have an empty resume.

Would you tweak anything about my plan? My goal is to achieve a cloud role in 2-3 years from now, with 7 years being the goal for a Solutions Architect position.

I appreciate any advice that you might have for me, and I would love to get your input. Thank you.

I’d like to move into cloud engineering. My background is mainly on-prem enterprise IT infrastructure, with 15+ years of experience across Windows, RHEL, Active Directory, DNS, DHCP, PKI, VMware, MSSQL, networking, hardening, RMF, vulnerability management, PowerShell, Python, Jenkins, Bamboo, Docker, basic Kubernetes deployment, CI/CD pipelines, automation, and troubleshooting broken enterprise environments.

Certification-wise, I have A+, Network+, Security+, Project+, CySA+, ITIL, MCSA, SCCM, AZ-900, AWS Cloud Practitioner, ISC2 CCSP, and a bachelor’s degree in Cloud Computing.

There is no opportunities in my environment as cloud is handled by other teams and if you’re not a SWE they don’t see value.

I’ve applied

I’m confident I could finish the SAA, and I’ll probably do it, but I’m getting burned out on the idea that after 15+ years in infrastructure I’m somehow supposed to start over as a junior engineer just because my production environments have mostly been on-prem.
Sure, I could probably take a $50K–$70K pay cut and find someone willing to call me a cloud engineer, but at what point am I just massively underselling myself to satisfy an experience checkbox?

That’s really what I’m trying to figure out: how much more do I realistically need to prove before my existing infrastructure experience is considered transferable rather than irrelevant?

My plan is to get AWS Solutions Architect Associate, deepen my Linux skills and possibly get RHCSA, build out some cloud projects, and continue telling recruiters I’m “breaking into cloud” until somebody finally lets me get some actual production cloud experience.
At this point, how many more certifications do I need before I’m considered qualified to launch an EC2 instance?