Architect Scalable, Secure, and Cost-Effective Cloud Infrastructure

A persona and capability specification for a cloud architect skill spanning AWS, Azure, GCP, and multi-cloud design. Covers named services per provider (AWS EC2, Lambda, EKS, RDS, S3, VPC, IAM, CloudFormation, CDK, and the Well-Architected Framework; Azure Virtual Machines, Functions, AKS, SQL Database, Blob Storage, ARM templates, Bicep; GCP Compute Engine, Cloud Functions, GKE, Cloud SQL, Cloud Storage, Cloud Deployment Manager), Infrastructure as Code tooling (Terraform/OpenTofu module design and state management, AWS CDK, Pulumi in TypeScript, Python, or Go, GitOps via ArgoCD and Flux, and Policy as Code via Open Policy Agent), and FinOps practices (cost monitoring via CloudWatch, Azure Cost Management, GCP Cost Management, CloudHealth, and Cloudability, right-sizing, reserved and spot instances, tagging-based chargeback and showback, and cross-provider TCO modeling). Architecture patterns include service mesh (Istio, Linkerd) and API gateways for microservices, event-driven systems built on Kafka, Kinesis, or Event Hubs with CQRS/Event Sourcing, and data-lake and data-warehouse ETL pipelines. Security coverage spans zero-trust design, IAM role-based and cross-account access, named compliance frameworks (SOC2, HIPAA, PCI-DSS, GDPR, FedRAMP), and secrets management via HashiCorp Vault. Scalability guidance covers auto-scaling, load balancing, CDN, Redis, and Memcached caching, and database read replicas and sharding; disaster recovery covers active-active and active-passive multi-region strategies, RPO/RTO planning, and chaos engineering. DevOps integration names CI/CD tooling (GitHub Actions, GitLab CI, Azure DevOps, AWS CodePipeline), observability stacks (Prometheus, Grafana, DataDog, New Relic, OpenTelemetry), and infrastructure-testing tools (Terratest, InSpec, Checkov, Terrascan). The response approach is an eight-step sequence: analyze requirements, recommend services, design for resilience, provide IaC, include cost estimates, address security, plan observability, and document trade-offs.

Use for cloud architecture tasks - designing multi-cloud or single-cloud infrastructure, choosing IaC tooling, planning a FinOps cost-optimization strategy, architecting for a specific compliance framework, or designing disaster recovery with a target RTO/RPO. Example prompts it's built to answer include designing a multi-region auto-scaling web app with cost estimates, a hybrid on-prem/Azure strategy, or a HIPAA-compliant healthcare data architecture. Do not use it for tasks unrelated to cloud architecture, or when a narrower domain skill - a specific IaC tool, a single-service deep dive, or application-level development - is the actual need.

Input is a description of workload requirements: scalability, cost, security, compliance constraints, and target cloud provider(s). Output follows the eight-step response approach: recommended services, a resilient architecture design, Infrastructure as Code implementation, cost estimates with optimization notes, security controls, an observability plan, and documented trade-offs. Points to resources/implementation-playbook.md for detailed worked examples when needed.

Names specific tools across every layer: Terraform/OpenTofu, AWS CDK, Pulumi, ArgoCD, Flux, and Open Policy Agent for IaC and policy; CloudHealth and Cloudability for cost management; Istio and Linkerd for service mesh; Kafka, Kinesis, and Event Hubs for event streaming; HashiCorp Vault for secrets; and Prometheus, Grafana, DataDog, New Relic, and OpenTelemetry for observability.

Engineers and architects designing or reviewing multi-cloud or single-cloud infrastructure who need provider-specific service recommendations, IaC implementation, cost estimates, and compliance-aware security controls in one pass rather than researching each layer separately.