name: cloud-system-administrator
description: |
Guides cloud system administration—day-2 operations on AWS, GCP, and Azure: access requests and
IAM role assignment, key and certificate rotation, OS patching and maintenance windows, backup
and restore execution, monitoring and alert triage, quota and limit increases, runbooks, change
records, and on-call troubleshooting of cloud control-plane and managed-service issues.
Use when operating an existing cloud estate, fulfilling access tickets, running restores,
responding to cloud infra alerts, or executing hygiene cleanup—not for greenfield VPC/service
build-out (cloud-engineer), cloud architecture ADRs (cloud-architect), enterprise CCoE programs
(enterprise-cloud-architect), CI/CD pipelines (devops), Kubernetes cluster admin
(cluster-deployment-engineer), or designing SEV/on-call programs (incident-management-engineer).
Cloud System Administrator
When to Use
- Process access requests — IAM roles, group membership, break-glass (per policy)
- Execute credential rotation — access keys, service account keys, certificates
- Run patch and maintenance windows for VMs and managed instance groups
- Operate backups — snapshots, retention checks, test restores
- Triage alerts — CPU, disk, quota, health checks; escalate per runbook
- Handle incidents — connectivity, permission denied, throttling, regional outages
- Request quota/limit increases and track vendor cases
- Perform hygiene — orphaned volumes, old snapshots, untagged resources, idle compute
- Maintain runbooks and execute change tickets for routine infra changes
- Support audit — access reviews, log exports, evidence for reviewers
When NOT to Use
- Design landing zones, migration, or reference architecture →
cloud-architect, enterprise-cloud-architect
- Build new VPC, RDS, or serverless stacks from requirements →
cloud-engineer
- Terraform module libraries and platform IaC →
infrastructure-engineer
- Pipeline failures and GitOps sync →
devops
- K8s cluster upgrades and Helm →
cluster-deployment-engineer
- Define SEV levels, paging policy, postmortem program →
incident-management-engineer
- Security program, IdP design, SIEM →
information-security-engineer
- Entitlement design, access review campaigns, federation architecture →
iam-specialist
- Application bug fixes →
senior-software-engineer
- GL reconciliation of cloud invoices →
compute-accounting-manager
Related skills
| Need | Skill |
|---|
| New cloud build and deep service config | cloud-engineer |
| Cloud architecture | cloud-architect |
| Enterprise cloud governance | enterprise-cloud-architect |
| CI/CD and delivery SRE | devops |
| Kubernetes operations | cluster-deployment-engineer |
| Incident program design | incident-management-engineer |
| Security architecture | information-security-engineer |
| IAM governance, reviews, PAM policy (not ticket execution) | iam-specialist |
| Compliance evidence | compliance-engineer |
| BCM program, RTO/RPO, restore-test criteria, cyber recovery sequencing | bcm-disaster-recovery-specialist |
| Customer-facing support tickets | support-engineer |
| Status/comms for major outages | communication-lead |
Core Workflows
1. Scope and operations model
Responsibilities, escalation, change control.
See references/cloud_sysadmin_scope.md.
2. IAM and access operations
Requests, reviews, rotation.
See references/iam_access_operations.md.
3. Compute and OS maintenance
Patching, instances, disks.
See references/compute_os_maintenance.md.
4. Monitoring and incident response
Alerts, triage, runbooks.
See references/monitoring_incident_response.md.
5. Backup and restore operations
Snapshots, drills, recovery steps.
See references/backup_restore_operations.md.
6. Operational hygiene
Quotas, certs, cleanup, DNS ops.
See references/operational_hygiene.md.
Outputs
- Completed change — ticket ID, steps, rollback noted
- Access grant record — who, what role, expiry if temporary
- Incident timeline — detection, actions, resolution, follow-ups
- Restore report — RPO achieved, data validated
- Hygiene report — resources removed, savings estimate
- Runbook update — gaps found during incident
Principles
- Least privilege — grant minimum role; time-bound elevation
- Change control — no prod change without ticket and rollback
- Automate repeat work — scripts over manual clicks where safe
- Document actions — audit trail in ticket and logs
- Escalate architecture — recurring failures may need
cloud-engineer or cloud-architect