Self-directed learning journal for cloud infrastructure on a Java backend stack, targeted at technical screening filters used by banks, consulting firms, and large enterprises in Spain. Documents the complete process — decisions and outcomes — module by module.
Complements my other repository, ai-engineer-roadmap-java, focused on AI Engineering specialization. This one focuses on the platform layer: cloud, containers, identity, and observability.
Move from the "Java + Spring Boot" profile to "Java + Spring Boot + AWS + Kubernetes + OAuth2 + Observability + IaC (Terraform)" — the dominant pattern in target job market offerings.
- Current progress: Check Current Progress for the latest completed module
- Roadmap structure: See the Modules table to understand what comes next
- Decisions: Open
decisions/to understand architectural trade-offs (ADRs, Michael Nygard format) - Infrastructure code: Open
infra/to see Terraform, Kubernetes manifests, and Helm charts
| Module | Technologies | Focus |
|---|---|---|
| 1 · AWS + Terraform | IAM, VPC, EC2, RDS, S3, ECS Fargate, Secrets Manager, CI/CD | Infrastructure as Code, cost discipline |
| 2 · Kubernetes | Pods, Deployments, StatefulSets, RBAC, Services, Ingress, HPA, Helm, EKS | Container orchestration, scaling |
| 3 · OAuth2 / OIDC | Keycloak, PKCE, resource servers, AD federation (LDAP/SAML) | Identity, authorization, enterprise SSO |
| 4 · Observability | Micrometer, Prometheus, Grafana, Loki, Tempo, SLI/SLO | Metrics, logs, traces, alerting |
Each module is self-contained and uses a real project as its vehicle: task-manager-api (monolith) or task-manager-microservices (distributed).
| Module | Content | Status |
|---|---|---|
| 1 · AWS + Terraform | IAM, VPC, EC2/RDS, S3, ECS Fargate, Secrets Manager, CI/CD, IaC | 🔄 In progress |
| 2 · Kubernetes | Pods, Deployments, RBAC, Services, Ingress, HPA, Helm, EKS | ⏳ Planned |
| 3 · OAuth2 / OIDC | Keycloak, PKCE, resource server, AD federation (LDAP/SAML) | ⏳ Planned |
| 4 · Observability | Micrometer, Prometheus, Grafana, Loki, Tempo, SLI/SLO | ⏳ Planned |
Module 1 (AWS) — in progress:
- AWS account configured with MFA and IAM group-based permissions
task-manager-apideployed on EC2 + RDS PostgreSQL with Security Groups referenced by ID (not CIDR)- Terraform IaC with remote state on S3, migrations via Flyway verified against real RDS
- Spend budget alert configured; monthly bill target under 5 USD
Next: Complete AWS module (multi-AZ RDS, S3 with lifecycle, ECS Fargate migration) before pivoting to Kubernetes.
cloud-roadmap/ ├── README.md This file ├── .gitignore Excludes secrets, Terraform state, credentials ├── decisions/ ADRs (Michael Nygard format) │ ├── A001-IAM-Strategy.md │ ├── A002-Cost-Discipline.md │ └── ... └── infra/ Infrastructure code ├── terraform/ Terraform IaC (modules, vars, state) │ └── task-manager-api/ ├── k8s/ Kubernetes manifests └── helm/ Helm charts
Folders decisions/ and infra/ are populated as content appears.
- Language: English for code, comments, and documentation
- Dates: ISO 8601 format (YYYY-MM-DD)
- ADRs: Michael Nygard format, numbered by module prefix (
A001..A010,K001..K010,O001..O010,Ob001..Ob010) - Cost discipline: Destroy all non-free-tier resources at end of each session. Monthly bill target: < 5 USD
- Secrets: Zero secrets in this repo. All AWS credentials, API keys, and state files live outside version control.
This repository contains:
- ❌ No AWS credentials, access keys, or secret tokens
- ❌ No Terraform state files (
.tfstate) - ❌ No API keys or passwords
- ✅ Infrastructure patterns and decisions (shareable, reusable, no PII)
All secrets and credentials are managed via environment variables, .env files (excluded by .gitignore), or AWS Secrets Manager.
- task-manager-api — Spring Boot monolith (deployment target for this roadmap)
- task-manager-microservices — Distributed system (deployment target for Kubernetes module)
- ai-engineer-roadmap-java — AI/LLM specialization (parallel track)
If you're evaluating this as evidence of cloud infrastructure knowledge:
- Check decisions: Browse
decisions/to see the reasoning behind trade-offs (IAM strategy, cost discipline, security posture) - Verify implementation: Browse
infra/terraform/to see actual Terraform modules and configurations - Assess depth: Look for cost trade-offs, security decisions (Security Groups by ID, not CIDR), and scaling patterns
This is a learning journal in progress, not a production deployment guide. The value is in the reasoning, not the perfection.
Last updated: 2026-09-22