CertQuests
AWS Cloud Engineer Roadmap: 4 certs, 12–18 months, the order AWS shops actually hire in
The path is CCP → SAA → DVA → SOA, in that order. Cloud Practitioner gets you the vocabulary and confidence. Solutions Architect Associate is the cert most AWS-shop ATS systems screen for — it's also the longest. Developer Associate adds the application-side fluency. SysOps Associate adds operational depth.
Many candidates get hired after just CCP + SAA and finish DVA + SOA on the job. That's a legitimate path. The trade-off is the salary anchor: candidates with all three associates negotiate ~$10–20k higher in the entry-level band. Don't bother with Pro-tier certs (SAP / DOP) until you have 18+ months of hands-on AWS work.
Who this path is for
This roadmap is built for someone targeting a Cloud Engineer / AWS Engineer / Cloud Operations Engineer role at an AWS-shop — meaning the company runs primarily on AWS rather than on Azure or GCP. The job involves provisioning infrastructure (often via Terraform or CloudFormation), writing Lambdas and integrations, debugging CloudWatch logs, and slowly building toward solutions-architecture or platform-engineering work.
It is not the right path if your target is:
- Azure-shop work — see the Azure Cloud Engineer roadmap instead.
- DevOps / SRE generalist — see the DevOps roadmap for the multi-cloud + Kubernetes shape.
- Cloud security specialist — SCS-C02 is a different end-state cert and the path looks different.
The 4-step path, in order
Each step lists the cert, why it sits there in the sequence, what skills you'll actually walk away with, and roughly how long it takes for someone studying ~10 hours per week.
AWS Cloud Practitioner CLF-C02
4–6 weeks ~60 hours FoundationWhy here: not because it's required — it's not — but because it builds your AWS vocabulary and console muscle memory before the harder cert. CCP also pays for itself the first time you skip a Stack Overflow rabbit hole because you already know what an AZ vs. region is.
Skip CCP only if you've already touched AWS daily for a job. The cert is genuinely easy if you study, and recruiters recognize it — an extra $100 line on the resume that costs 60 hours of your life.
AWS Solutions Architect Associate SAA-C03
10–14 weeks ~160 hours ATS gateWhy here: SAA-C03 is the single most-recognized AWS cert. It's what most "AWS Cloud Engineer" job postings list. If you only ever do one AWS cert, this is the one.
SAA is broad: VPC design, EC2/ECS/Lambda compute trade-offs, RDS vs. DynamoDB, S3 storage classes, IAM, KMS, monitoring, cost optimization. Expect 80–100 questions of scenario-based architecture decisions. This is where you stop memorizing AWS and start thinking in AWS.
AWS Developer Associate DVA-C02
8–10 weeks ~120 hours Application sideWhy here: SAA tells employers you understand AWS architecture; DVA tells them you can build things on it. Lambda internals, API Gateway integrations, DynamoDB query patterns, X-Ray tracing, CodePipeline, SAM/CDK fundamentals.
DVA overlaps SAA by about 30%. The new material is mostly: serverless deep-dive, application observability, secrets handling (Parameter Store / Secrets Manager), and CI/CD primitives. If you're going into a developer-shaped Cloud Engineer role, this is more useful than SOA.
AWS SysOps Administrator SOA-C02
8–10 weeks ~140 hours OperationsWhy here: SOA is the operations side — deployment, monitoring, incident response, automation, troubleshooting. It's the cert that turns a Cloud Engineer into an Cloud Operations Engineer, and it's the prerequisite vibe-shift toward the DevOps Engineer Pro cert later.
SOA-C02 is harder than people expect because it includes a hands-on lab section (the only associate-tier cert that does). Budget extra time on console drilling, not just MCQs.
What you'll be able to do at the end
- Design a multi-AZ, multi-tier VPC architecture from a vague business requirement, including the data store, the compute layer, and the failure modes.
- Write Lambda functions in Python or Node, wire them through API Gateway, and instrument them with X-Ray and CloudWatch.
- Read a CloudFormation or Terraform plan and explain what it'll do before apply.
- Triage a "the API is slow" page using CloudWatch metrics, X-Ray traces, and RDS Performance Insights.
- Articulate cost trade-offs between EC2 / Fargate / Lambda for a given workload, with rough $-per-month numbers.
What this path is worth
Snapshot of the AWS Cloud Engineer market in 2026 (US). Verify against current postings before negotiating.
Entry base (US)
$95k–$130kMid-market shops at the lower end. Tech-forward enterprise and FAANG-adjacent at the upper end.
Mid-level after 2–3 yrs
$130k–$170kSenior Cloud Engineer or Cloud Solutions Architect track. Adds Pro-tier certs (SAP, DOP).
Open postings (US)
~58,000AWS leads cloud job volume by a wide margin. Demand is durable across labor cycles.
Top hiring sectors
Tech · FinServ · RetailSaaS and pure-tech pay best. Financial services pay well but hire selectively. Retail and media are growing fast.
Common mistakes that cost candidates offers
- No homelab or GitHub. Three certs without a single AWS project on GitHub looks like memorization. Build one Terraform-deployed thing end-to-end and document it. This is the single highest-ROI move you can make.
- Skipping IaC. Real AWS work is 90% Terraform or CloudFormation. Don't graduate without writing both. The certs barely test it; the job demands it.
- Treating SAA as the finish line. Many candidates pass SAA, plateau, and stay junior for years. The shortest path to a senior offer is to keep learning hands-on after the cert — not to stop at the certificate.
- Ignoring cost. AWS hiring managers will ask "how would you reduce the bill on this?" in interviews. Spend 10 hours learning cost-allocation tags, Compute Savings Plans, and S3 lifecycle policies. Most candidates skip this and regret it.
Start step 1 right now — no signup
Every cert in this path has a free practice pack on CertQuests with engineer-written explanations on every question.
Frequently asked questions
How long does it take to become an AWS Cloud Engineer?
Realistic range: 12–18 months part-time (8–12 hours/week) for the four-cert path. Faster with prior IT or developer experience. Most candidates get hired after CCP + SAA-C03 (months 6–9) and finish DVA + SOA on the job.
Can I skip Cloud Practitioner and start with SAA?
If you have hands-on AWS experience, yes. CCP doesn't unlock anything — it's a confidence-builder and a $100 cert that recruiters recognize. Going straight to SAA-C03 is fine if you can sketch a 3-tier VPC on a whiteboard before opening the study guide.
Should I do DVA or SOA first after SAA?
Depends on your target role. Going into a developer-shaped role (Lambda, API Gateway, DynamoDB)? DVA first. Going into ops/platform engineering? SOA first. Both ladder into the DevOps Engineer Pro cert eventually, so the order is mostly preference.
Do I need the Pro-tier cert (SAP-C02 or DOP-C02)?
Not for entry-level Cloud Engineer roles. The associate trio (SAA + DVA + SOA) is enough to land a job at most AWS shops. Pro certs become useful once you have 18–24 months of hands-on work and want to push into senior Cloud Engineer or Solutions Architect tracks (typical $20–40k bump).
What does an AWS Cloud Engineer earn?
US median for entry-level AWS Cloud Engineer in 2026 is roughly $95,000–$130,000 base, with major metros (NYC, SF, Seattle) pushing 20–30% higher. Three associate certs typically anchor the upper end of the entry band; SAA alone anchors the middle.
Is AWS still the best cloud to specialize in?
AWS still leads in market share, headcount, and job postings, but Azure has closed the gap especially in enterprise and Microsoft-shop environments. If you can pick by employer market in your metro, do that. If not, AWS is the safer default — broader job availability and the certs are recognized everywhere.
Are hands-on labs required?
Yes. Use the AWS Free Tier — $0 for 12 months across most associate-tier services. Build at least one project end-to-end: a static site on S3+CloudFront, a Lambda+API Gateway+DynamoDB CRUD app, a 3-tier VPC with RDS. Document on GitHub. Most candidates get rejected at the technical interview stage for not having this, regardless of certs.
How we wrote this roadmap
No AWS or training-vendor revenue. We don't take money from AWS, A Cloud Guru, Cantrill, Tutorials Dojo, or any cert vendor mentioned. The sequence is based on what AWS-shop job descriptions actually list as required vs. preferred, plus interviews with hiring managers across SaaS, FinServ, and retail in 2025–2026.
What we'll change without being asked: if AWS retires a cert or releases a new revision, we'll re-sequence within days. Tell us what you'd change. Last reviewed: April 27, 2026.