Cloud Operations Engineer

## Lộ trình Ôn tập & Chuẩn bị cho Cloud Operations Engineer – VPBank

### Giai đoạn 1: Tổng quan AWS (Tuần 1)

Tài liệu tham khảo:
- AWS Well-Architected Framework (miễn phí – aws.amazon.com/architecture)
- AWS Certified Solutions Architect Professional – course trên Udemy/AcloudGuru
- AWS re:Invent videos về Control Tower, Landing Zone

Trọng tâm ôn:
- AWS Organizations structure (OU design, SCPs)
- IAM advanced (permission boundaries, service control policies, resource-based policies)
- AWS SSO vs traditional IAM users

Hands-on lab:
```bash
# Thực hành tạo Organizations với SCP
aws organizations create-organization
aws organizations create-organizational-unit --name "Production"
aws organizations put-scoped-policy --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["s3:*Public*"],"Resource":["*"]}]}'
```

### Giai đoạn 2: Control Tower & AFT (Tuần 2)

Tài liệu:
- AWS Control Tower documentation (chính thức)
- AWS AFT GitHub repository
- Blog: "AWS Landing Zone vs Control Tower" – so sánh chi tiết

Trọng tâm ôn:
- Control Tower preventive vs detective controls
- Guardrails (mandatory, strongly recommended, elective)
- AFT customization pipeline (account provisioning, customizations)
- Event Engine account baseline

Hands-on lab:
- Design OU structure cho ngân hàng: Security, IT Operations, Dev, Test, Production, Suspended
- Viết SCP để deny tất cả regions ngoài Singapore và Hanoi

### Giai đoạn 3: Networking chuyên sâu (Tuần 3)

Tài liệu:
- AWS Certified Advanced Networking Specialty – official guide
- Transit Gateway scenarios documentation
- Route 53 Resolver documentation

Trọng tâm ôn:
```
Network Design Checklist:
├── Transit Gateway
│ ├── Attachments (VPC, VPN, Direct Connect Gateway)
│ ├── Route tables (propagation, static routes)
│ ├── Traffic inspection pattern (Transit Gateway + Firewall)
│ └── Shared VPC vs dedicated VPC per account
├── VPC Endpoints
│ ├── Gateway (S3, DynamoDB) vs Interface (private DNS)
│ └── PrivateLink cho SaaS services
├── DNS Architecture
│ ├── Route 53 Resolver + inbound/outbound endpoints
│ ├── Private Hosted Zones (cross-account sharing)
│ └── Hybrid DNS resolution
└── VPN/Direct Connect
├── Site-to-Site VPN (transit vs dedicated)
└── DX with Transit Gateway
```

### Giai đoạn 4: Security & Monitoring (Tuần 4)

Palo Alto Firewall:
- Security policy order of operations
- NAT policy types (Source, Destination, Bi-directional)
- Threat prevention profiles
- Panorama management

F5 Load Balancer:
- LTM concepts: nodes, pools, virtual servers
- Health monitor types (HTTP, HTTPS, TCP)
- SSL offload configuration
- iRules basic (when HTTP_REQUEST)

Monitoring Stack:
```
Observability Stack:
├── Metrics: Prometheus + CloudWatch Exporter
├── Logs: Loki + CloudWatch Logs
├── Traces: (optional) X-Ray, Jaeger
├── Dashboards: Grafana
│ ├── AWS Native dashboards
│ ├── Custom application metrics
│ └── Business KPIs dashboard
├── Alerting: Alertmanager → PagerDuty → Slack
└── SLO/SLA tracking
```

### Giai đoạn 5: IaC & Automation (Tuần 5)

Terraform Advanced:
- State management (S3 backend + DynamoDB lock)
- Workspace strategy (env-based vs project-based)
- Module design patterns (DRY, reusability)
- Terragrunt for DRY configs
- Testing: Terratest, Checkov

CI/CD Pipeline:
```yaml
# GitLab CI example cho Terraform
stages:
- validate
- plan
- apply
- test

terraform:validate:
stage: validate
image: hashicorp/terraform:latest
script:
- terraform init
- terraform validate
- terraform fmt -check

terraform:plan:
stage: plan
script:
- terraform plan -out=tfplan
artifacts:
paths: [tfplan]

terraform:apply:
stage: apply
only: [main]
script:
- terraform apply tfplan
```

Python Scripting:
- Boto3 automation scripts
- Lambda functions cho event-driven tasks
- CLI tools với argparse

### Tài liệu ôn tập tổng hợp

| Nguồn | Loại | Link |
|-------|------|------|
| AWS Well-Architected | Documentation | aws.amazon.com/architecture |
| AWS Control Tower Workshop | Hands-on | controls.aws.amazon.com |
| Terraform Up & Running | Book | terraformupandrunning.com |
| Palo Alto Networks Academy | Course | paloaltonetworks.com/academy |
| Prometheus/Grafana Tutorials | Video | Grafana YouTube channel |
| AWS re:Invent 2023 Sessions | Video | YouTube – AWS channel |
| r/aws subreddit | Community | reddit.com/r/aws |

### Lộ trình 2 tuần trước phỏng vấn

```
Ngày 1-3: Ôn AWS Organizations + Control Tower
├── Vẽ lại architecture trên giấy
├── Chuẩn bị 3 scenario answers

Ngày 4-6: Networking deep dive
├── Transit Gateway routing scenarios
├── PrivateLink use cases
└── Practice troubleshoot questions

Ngày 7-9: Security + Monitoring
├── Palo Alto policy design
├── Grafana dashboard design
└── Alerting strategy

Ngày 10-12: IaC + Automation
├── Terraform advanced patterns
├── CI/CD pipeline design
└── Python scripts demo

Ngày 13-14: Mock interview + Review
├── Practice STAR stories
├── Review weak areas
└── Prepare questions for interviewer
```