PRACTICAL CLOUD & DEVOPS LEARNING

Schedule & modules

Explore the 18 modules in BMT’s published curriculum, from basic computer skills and local file paths through VS Code and Windows/WSL 2 setup to secure authentication, connected toolchains, cloud automation, and observability.

Learn through practice

Follow the modules in order, beginning with Agile, laptop fundamentals, and Linux. Build your development and CI/CD skills before progressing to networking, containers, Kubernetes, and cloud infrastructure. Finish with monitoring and AI workflows. Windows learners use the WSL 2 setup module; other learners use an appropriate native or Linux lab environment.

Build real projects

Practice CI/CD pipelines, cloud deployments, infrastructure as code, automation, and monitoring.

Learn with guidance

Develop skills with mentorship from working engineers and a collaborative learning community.

Prepare for your next step

Work on your CV, portfolio, and interview preparation alongside technical learning.

MODULE 01

Agile Methodology

Learn how Agile practices support collaboration, incremental delivery, and continuous improvement in Cloud and DevOps teams.

Learning topics: Agile Methodology

Why Agile Matters

Rapid and reliable CI/CD delivery
Improved cross-team collaboration
Reduced deployment risks
Better alignment with cloud-native development

Scrum Framework

Scrum roles & responsibilities
Scrum ceremonies & sprints
Product backlog management
Incremental delivery approach

Kanban & Flow

Kanban boards & workflow optimization
Limiting work in progress (WIP)
Cycle time & throughput
Continuous improvement mindset

Agile Tools

Jira for Agile project delivery
Azure Boards for enterprise teams
Scrum & Kanban dashboards
Team velocity & forecasting

DevOps & Agile Integration

Agile in CI/CD pipelines
Trunk-based development
Continuous improvement loops
Fail-fast + learn-fast culture

Agile Outcomes

Faster deployments
Higher product quality
Stronger team collaboration
Consistent delivery cycles

MODULE 02

Basic Computer Review & Local File Paths

Review essential laptop skills and learn how to find, organize, and reference files before working with developer tools or Linux. Understand where commands run and how local paths connect Windows, VS Code, and WSL.

Learning topics: Basic Computer Review & Local File Paths

Know Your Laptop

Identify your operating system, signed-in user, home folder, processor, memory, and available storage
Distinguish files, folders, applications, processes, and operating system settings
Install and update trusted applications; understand administrator access and standard user accounts
Use copy, paste, search, keyboard shortcuts, and screenshots while keeping personal information private

Files, Folders & Extensions

Navigate File Explorer on Windows or the file manager on your operating system
Create, rename, copy, move, and organize folders and files without accidentally changing their extensions
Show file extensions and hidden files; recognize text files, scripts, archives, and configuration files
Understand the home folder, Desktop, Documents, Downloads, and a dedicated projects folder; distinguish local, synced, and network storage

Understand Local Paths

Read a Windows path such as C:\Users\YourName\Documents\projects and identify the drive, folders, and filename
Understand absolute paths versus relative paths, the current working directory, . for the current folder, and .. for the parent folder
Use ~ as a home-directory shortcut in shells that support it; understand that home locations differ across Windows, WSL, and remote hosts
Quote paths containing spaces; distinguish Windows backslashes from Linux and macOS forward slashes
Recognize that moving or renaming a file changes its path and can break a command, shortcut, or editor reference

Your First Terminal & Editor Session

Open PowerShell or your native terminal and identify the shell before entering commands
In PowerShell, use Get-Location, Get-ChildItem, and Set-Location to inspect the current folder and navigate safely
Use Get-Content to read a harmless text file; distinguish viewing a file from running a script
Open a project folder in VS Code, locate its files, and verify the integrated terminal starts in the intended directory
Understand that a terminal command operates in its current directory unless an explicit path is supplied

Windows, WSL & Remote Path Awareness

Preview the difference between C:\Users\YourName on Windows and /home/yourname inside a WSL Linux distribution
Recognize /mnt/c as the Windows C: drive mounted in WSL; a Linux home folder is a different location
Distinguish your laptop filesystem from a container, SSH server, cloud VM, or CI runner filesystem
In later WSL labs, keep Linux projects under a Linux directory such as ~/projects and confirm which environment VS Code has opened
Diagnose file-not-found errors by checking the environment, current directory, spelling, extension, case sensitivity, and access permissions

Local Laptop Practice Lab

Create a practice project folder and a notes.txt file using the file manager
Find and copy the folder’s absolute path, then navigate to it in PowerShell or your native terminal
List the files, read notes.txt, and open the same folder in VS Code
Practice a relative path to a child folder and return with ..; repeat using a quoted folder name containing spaces
Record where the file lives, which shell you used, and how to verify the working directory; use disposable practice files for move or delete exercises

MODULE 03

Linux

Build a foundation in Linux commands, system operations, networking, permissions, and Bash scripting for cloud environments.

Learning topics: Linux

Core Linux Fundamentals

Linux file system
Essential commands
Shell navigation
Searching, sorting, filtering

User & Permission Management

Users & groups
File & directory permissions
Ownership (chown, chmod)
Sudo access control

Linux System Operations

Service management (systemctl)
Process monitoring
Disk usage & storage
System performance checks

Package Management

APT (Ubuntu/Debian)
YUM / DNF (CentOS/RedHat)
Installing & updating software
Repository management

Linux Networking & Tools

IP, DNS, routing
Ping, traceroute, nslookup
Network troubleshooting
Firewall basics

Bash Scripting Essentials

Variables & loops
Automating tasks
Writing reusable scripts
Error handling & debugging

SSH Authentication & Remote Access

Generate a passphrase-protected SSH key and load it into ssh-agent
Install the public key for an authorized lab user and protect ~/.ssh permissions
Verify server host fingerprints before trusting a new SSH host
Test SSH access and diagnose permission, agent, and authorized_keys problems

MODULE 04

WSL 2 for Windows Users

Prepare a Linux development environment on a supported Windows PC using WSL 2 and Ubuntu. Windows learners complete this setup before Linux labs; Linux and macOS learners use their native environment or an instructor-approved Linux alternative.

Learning topics: WSL 2 for Windows Users

Install & Verify WSL 2

Check supported Windows versions, virtualization requirements, administrator access, and available resources
In administrator PowerShell, run wsl --install -d Ubuntu and restart if prompted
Create the Ubuntu user and password, then check the distribution and version with wsl --list --verbose
Use wsl --update; if a supported existing distribution is on WSL 1, discuss backup and wsl --set-version Ubuntu 2 before conversion

Windows & Linux Working Together

Understand Windows drive paths, /mnt/c, Linux home directories, case sensitivity, permissions, and line endings
Keep Linux-based projects in the Linux filesystem, such as ~/projects, for the Linux toolchain
Install Git, Python, and the course CLI tools in the environment where they will run; verify versions and PATH
Use Windows Terminal, Bash, package updates, and code . to open a project through the VS Code WSL extension

Credentials, Networking & Containers

Understand separate Windows and WSL home directories, SSH agents, Git settings, and AWS profiles; configure or explicitly integrate each credential store
Use ssh-agent and protected key permissions; never copy private keys into a repository or share them with classmates
In the Docker module, enable Docker Desktop WSL 2 integration for the selected distribution and verify docker version
Troubleshoot localhost access, DNS, proxies, file permissions, PATH, and CRLF issues without disabling certificate verification

Environment Readiness Lab

Verify WSL version 2, open Ubuntu in VS Code, and run a Linux command in the integrated terminal
Create a project under ~/projects, authenticate to a GitHub lab repository, then clone, commit, and push
Later integration checkpoint: configure an AWS CLI profile inside WSL and verify the intended account with aws sts get-caller-identity
Document the setup and troubleshooting steps without including passwords, private keys, or tokens

MODULE 05

Scripting / Python (for DevOps)

Use Python to automate operational tasks, work with files and APIs, and build reusable tools for Cloud and DevOps workflows.

Learning topics: Scripting / Python (for DevOps)

Python Fundamentals

Variables, loops & conditions
Functions & modules
Working with files
Virtual environments

Automation Scripts

Automating Linux tasks
Log analysis scripts
Parsing system information
Automating repetitive work

APIs & Integrations (DevOps)

Calling REST APIs
Working with cloud APIs (AWS/Azure)
Requests, JSON & authentication
Integrating with DevOps tools

Authenticated APIs & AWS SDK Integration

Create a Python virtual environment in VS Code or WSL and select the matching interpreter
Use Boto3 Session(profile_name="bmt-lab") with an authorized AWS profile instead of hardcoded access keys
Load scoped API tokens from approved secret storage; keep local environment files out of Git
Handle expired sessions, HTTP 401 versus 403, timeouts, and permission failures without logging credentials

MODULE 06

Visual Studio Code (VS Code) & Developer Workflow

Set up VS Code as your working environment for Linux, GitHub, Python, cloud tools, and infrastructure code. Build the editor and terminal skills used throughout the course.

Learning topics: Visual Studio Code (VS Code) & Developer Workflow

Install & Navigate VS Code

Install VS Code for your operating system; understand folders, workspaces, Explorer, and the Command Palette
Use the integrated terminal, choose a shell, and distinguish Windows PowerShell from a WSL Linux terminal
Edit, search, format, compare changes, and use debugging, breakpoints, and tasks
Install trusted GitHub Pull Requests, Python, Terraform, Docker, and AWS Toolkit extensions as needed

Identity, Authentication & Credential Basics

Distinguish signing in, proving identity, and being authorized to access a repository or cloud resource
Use MFA, least-privilege permissions, scoped tokens, and short-lived cloud credentials
Understand that VS Code sign-in, Git authentication, and AWS authentication are separate connections
Keep private keys, tokens, .env files, and cloud credentials out of Git; learn rotation and revocation

Connect VS Code, WSL & GitHub

Install VS Code on Windows and use the WSL extension to open a Linux workspace; run code . from the project directory in WSL
Install the required language and tooling extensions in the WSL environment when prompted
Authorize the GitHub extension in the browser; configure Git authentication separately for your chosen HTTPS or SSH workflow
Use Source Control to inspect diffs, stage changes, commit, create branches, and open pull requests

Cloud & Remote Development Labs

Later AWS lab: select an authorized AWS profile in AWS Toolkit and verify account, role, and region
Use Remote - SSH with a non-root lab user, an SSH key, and verified host fingerprints
Open a sample repository, run a script, debug it, and submit a reviewed pull request
Confirm which machine runs each terminal, extension, Git client, and cloud CLI before troubleshooting access

MODULE 07

Git & GitHub

Learn version control with Git, collaborate through GitHub, and connect repository workflows to CI/CD and infrastructure projects.

Learning topics: Git & GitHub

Git Fundamentals

Git init, clone, add, commit
Working directory vs staging area
Undoing & reverting changes
Git logs & version tracking

Branching & Collaboration

Branches & merging
Pull requests
Code reviews & approvals
Resolving merge conflicts

Repository Management

Creating & cloning repos
GitHub repo structure
Managing branches
Working with remotes

GitHub Workflows

Issues & project boards
Labels & milestones
Collaborator roles
Branch protection rules

Git for DevOps Projects

Git & CI/CD integration
Git in cloud workflows
Using Git for IaC (Terraform)
Managing DevOps repos

Advanced Git Techniques

Rebasing & squashing
Stashing & patching
Hooks & automation
Git troubleshooting

Authenticate Git & GitHub

Configure Git author name and email; understand that commit identity does not authenticate access
For HTTPS, use a supported credential manager or gh auth login and verify gh auth status; GitHub account passwords are not Git HTTPS credentials
For SSH, register a public key, verify GitHub host fingerprints, and test ssh -T git@github.com
Use fine-grained personal access tokens only when needed, with minimal repository permissions and expiration
Understand organization SSO authorization, GitHub App access, and repository membership when access is denied

VS Code → GitHub Integration Lab

Clone an authorized repository from the VS Code WSL terminal or native development environment
Create a branch, edit and stage changes in VS Code, push, and open a pull request
Compare HTTPS and SSH remotes and resolve authentication versus repository-permission failures
Remove a test credential and verify access is revoked; do not publish secrets in terminal screenshots

MODULE 08

Apache Tomcat (Java Web Applications)

Learn to install, configure, secure, and troubleshoot Apache Tomcat, and deploy Java web applications through CI/CD pipelines.

Learning topics: Apache Tomcat (Java Web Applications)

Tomcat Fundamentals

How Tomcat works
Tomcat directory structure
HTTP connectors & ports
Tomcat lifecycle & components

Installation & Configuration

Installing Tomcat on Linux
Environment variables
Server.xml configuration
Deploying WAR files manually

Tomcat Users, Roles & Security

Configuring tomcat-users.xml
Manager & Admin roles
Securing the management panel
Best security practices

Tomcat Logging & Monitoring

Access logs & catalina.out
Enabling log rotation
JVM tuning basics
Monitoring application health

Tomcat in CI/CD Pipelines

Jenkins → build → deploy to Tomcat
Automating WAR deployments
Using Maven for packaging
Pipeline deployment best practices

Troubleshooting & Best Practices

HTTP errors & access issues
Port conflicts
App failures & logs
Performance & tuning tips

Authenticated Deployment Integration

Create a dedicated deployment user with the required manager-script role; keep interactive manager-gui access separate
Store deployment credentials in the CI credential store and restrict management access to approved networks
Deploy a lab WAR file from Jenkins through the authenticated management API over protected transport
Verify least-privilege access, audit deployment logs, and remove the lab deployment credentials afterward

MODULE 09

SonarQube Cloud (formerly SonarCloud)

Explore code quality analysis, security findings, quality gates, and CI/CD integration with SonarQube Cloud (formerly SonarCloud).

Learning topics: SonarQube Cloud (formerly SonarCloud)

Understanding SonarQube Cloud

What SonarQube Cloud does
Why DevOps teams use it
How code quality is measured
Understanding Clean Code principles

Static Code Analysis

Bug detection
Vulnerability scanning
Code smells analysis
Cyclomatic complexity metrics

Quality Gates

What Quality Gates are
Pass/fail criteria
Setting minimum code standards
Blocking deployments on failure

Integrating SonarQube Cloud with GitHub

Connecting GitHub repos
Auto-scanning pull requests
Enforcing code quality rules
Generating reports automatically

Integrating with CI/CD Pipelines

GitHub Actions workflow
Jenkins Sonar Scanner
Failing builds on low quality
Pipeline quality enforcement

Interpreting SonarQube Cloud Reports

Understanding analysis results
Security hotspots
Coverage reports
Remediation & best practices

Authentication & Pipeline Credentials

Authorize the GitHub organization and selected repository through the approved SonarQube Cloud integration
Create the appropriate analysis token with minimal scope and store it as a CI secret such as SONAR_TOKEN
Pass the token through the supported scanner configuration without printing it or embedding it in source
Lab: run an authenticated scan from GitHub Actions or Jenkins and verify the quality gate on a pull request
Rotate or revoke a lab token and diagnose permission, organization, and project-key failures

MODULE 10

Jenkins (Automation)

Learn Jenkins jobs, agents, and pipelines to automate application builds, tests, and deployments.

Learning topics: Jenkins (Automation)

Core Jenkins Concepts

Jenkins architecture
Controller/agent architecture
Jobs, builds & workspace
Plugins & integrations
Understanding Jenkins logs
Fixing pipeline failures
Plugin conflicts
Agent connection issues

Freestyle Jobs

Configuring freestyle projects
Build triggers & schedules
Executing scripts & build steps
Artifacts & reporting
Branch discovery & automation
Pull request pipelines
GitHub & GitLab integrations
Pipeline triggers & webhooks

Pipeline as Code (Jenkinsfile)

Declarative vs scripted pipelines
Stages, steps & environment blocks
Pipeline syntax structure
Shared libraries
GitHub & Git setup
Maven, SonarQube Cloud & Docker
Notifications & Slack alerts
Pipeline artifacts

Credentials & Connected Toolchain

Authenticate Jenkins to GitHub with an appropriately scoped GitHub App or supported repository credential
Configure a GitHub webhook and secret, then validate delivery and repository event permissions
Store tokens, SSH keys, and deployment credentials in the Jenkins credentials store and bind them only to the job steps that need them
Prefer agent roles or workload identity for AWS access; scope permissions and avoid exposing secrets in logs
Lab: fetch from GitHub, scan with SonarQube Cloud, push a container to ECR, and deploy to an authorized target

MODULE 11

GitHub Actions (CI/CD – End-to-End Pipeline)

Build GitHub Actions workflows that test, scan, package, and deploy applications across environments.

Learning topics: GitHub Actions (CI/CD – End-to-End Pipeline)

GitHub Actions Fundamentals

Understanding workflows & triggers
Hosted vs self-hosted runners
Jobs, steps & YAML syntax
Reusable workflows

Complete CI Pipeline

Installing dependencies
Running tests automatically
Pipeline caching & artifacts
Build validations & quality checks

Docker Build & Push Automation

Build Docker images in pipelines
Push to Docker Hub / GHCR
Secure secrets & credentials
Tagging & semantic versioning

Security & Code Quality

Secret scanning
CodeQL security analysis
Fail pipelines on vulnerabilities

Deployments (CD)

Deploy to AWS ECS / EC2
Kubernetes automation
Multi-environment deployments

Advanced GitHub Actions

Reusable pipelines
Monorepo automation
Environment approvals
Production-ready CI/CD

OIDC, Tokens & AWS Role Trust

Use the built-in GITHUB_TOKEN with explicitly scoped workflow permissions; grant additional permissions only when required
Configure the AWS OIDC provider and an IAM role restricted to the trusted repository and branch or protected environment
Request id-token: write for the job that needs OIDC and use the supported AWS credentials action to assume the role
Keep non-OIDC tokens in repository or environment secrets; do not expose them to untrusted pull requests
Verify the assumed AWS account and role in CI, and diagnose role-trust failures separately from AWS resource-policy failures

End-to-End Tool Integration Lab

Use VS Code and, on Windows, WSL 2 to edit code and push a reviewed GitHub branch
Run tests and a SonarQube Cloud analysis, then build a container and push it to an authorized ECR repository
Use an OIDC-authenticated AWS role to deploy the approved image to the lab environment
Add environment approvals, verify the running application, and exercise a documented rollback
Record the integration map, credential owner, permission boundary, rotation method, and troubleshooting checks for every connection

MODULE 12

Networking

Develop networking foundations for designing and troubleshooting cloud infrastructure, including IP addressing, routing, DNS, and firewalls.

Learning topics: Networking

Core Networking Foundations

OSI & TCP/IP models
Ports, protocols & services
Understanding packets & routing
Network troubleshooting tools
VPC creation & structure
Subnets, NACLs & security groups
VPNs & direct connections
Hybrid network architecture

IP Addressing & Subnets

IPv4, IPv6 fundamentals
CIDR notation
Subnet calculation
Private vs public addressing
Pod-to-pod networking
ClusterIP, NodePort & LoadBalancer
Ingress controllers & routing
Network policies & service mesh basics

DNS, Routing & Firewalls

How DNS works
Routes & route tables
Firewall rules & ACLs
Forwarding, NAT & proxies
Load balancer types (ALB/NLB/Ingress)
Session persistence
Failover mechanisms
Service discovery concepts

MODULE 13

Docker (Containerization)

Learn to build container images, manage containers, and use registries to package and distribute applications with Docker.

Learning topics: Docker (Containerization)

Docker Fundamentals

Images vs Containers
Docker engine architecture
Working with Docker CLI
Container lifecycle management

Docker Images

Creating Dockerfiles
Image layers & caching
Optimizing images
Private/public Docker registries

Registry Authentication & Tool Integration

Connect Docker Desktop to the WSL 2 distribution when using Windows, then verify the client and engine connection
Use docker login with the registry-supported credential flow; use --password-stdin for scripted token login
Authenticate to Amazon ECR with aws ecr get-login-password and docker login --username AWS --password-stdin against the correct account and region
Distinguish Docker Hub tokens, GitHub Container Registry permissions, and expiring ECR authorization
Lab: build in VS Code or WSL, tag an image, push to an authorized private registry, and verify pull access

MODULE 14

Kubernetes (Container Orchestration)

Learn to deploy, connect, secure, and troubleshoot containerized applications in Kubernetes. Start with a local lab cluster and connect the workflow to CI/CD and cloud services in later integration labs.

Learning topics: Kubernetes (Container Orchestration)

Kubernetes Fundamentals

Understand container orchestration, desired state, and reconciliation
Identify the control plane, worker nodes, API server, scheduler, and kubelet
Work with Pods, Deployments, ReplicaSets, namespaces, labels, and selectors
Read and write YAML manifests and distinguish container images from Kubernetes workloads

Local Cluster & kubectl Setup

Install kubectl and create an instructor-approved local cluster with kind or minikube
Use the appropriate Linux or WSL environment and verify container-runtime connectivity
Inspect kubeconfig contexts and namespaces before running commands
Practice kubectl get, describe, apply, logs, exec, and delete on disposable lab resources

Application Deployment & Networking

Deploy a container image with a Deployment and expose it through a Service
Compare ClusterIP, NodePort, and LoadBalancer services; explore cluster DNS
Understand Ingress resources and the requirement for an installed ingress controller
Configure readiness, liveness, and startup probes; set resource requests and limits
Practice scaling, rolling updates, rollout status, and rollback

Configuration & Storage

Use ConfigMaps for non-secret application configuration
Understand Kubernetes Secrets, their access controls, and why base64 encoding is not encryption
Mount configuration and use environment variables without committing credentials
Introduce volumes, PersistentVolumes, PersistentVolumeClaims, and StorageClasses

Authentication, RBAC & Registry Access

Understand how kubeconfig selects a cluster and supplies authentication; protect credentials and verify TLS
Distinguish human identities from workload service accounts and authentication from RBAC authorization
Use Roles, ClusterRoles, and bindings with least privilege; verify access with kubectl auth can-i
Use short-lived service-account credentials where applicable and avoid sharing cluster-admin kubeconfig files
Configure scoped private-registry access through imagePullSecrets or the supported platform mechanism

CI/CD & AWS Integration Labs

Edit manifests in VS Code, review them in GitHub, and deploy an approved image to the local cluster
Introduce Helm charts, releases, values, and deployment verification
In the later AWS lab, obtain an authorized EKS kubeconfig with aws eks update-kubeconfig and verify account, role, region, and context
Distinguish AWS IAM authentication to EKS from Kubernetes access permissions; use assigned access rather than administrator credentials
Deploy through an approved CI identity, verify rollout and service access, then integrate monitoring in the Prometheus and Grafana module

Troubleshooting & Cleanup

Investigate Pending Pods, image-pull errors, CrashLoopBackOff, failed probes, and missing Service endpoints
Use events, logs, resource descriptions, and network checks to isolate the cause
Check context, namespace, credentials, and authorization before changing cluster resources
Document recovery steps and remove lab workloads and clusters when the exercise is complete

MODULE 15

AWS (Cloud Provider)

Practice deploying, securing, monitoring, and automating AWS infrastructure using core compute, storage, identity, and networking services.

Learning topics: AWS (Cloud Provider)

AWS Core Services

EC2 (virtual machines)
S3 (object storage)
IAM (identity & access)
VPC networking

Compute, Storage & Databases

Autoscaling & Load Balancers
EBS & EFS storage options
RDS, DynamoDB fundamentals
Serverless (Lambda & API Gateway)

Cloud Security Essentials

IAM policies & roles
Security Groups & NACLs
Encryption (KMS, S3 policies)
Shared Responsibility Model

Networking & Connectivity

Subnets & route tables
Internet Gateways & NAT Gateways
Load Balancers (ALB/NLB)
VPC endpoints & hybrid networking

Monitoring & Logging

CloudWatch metrics & dashboards
CloudTrail auditing
Event-driven automation
Log Insights

Infrastructure Deployment

Deploying workloads on EC2
S3-hosted static sites
CloudFormation
AWS automation for DevOps

AWS CLI Authentication & Profiles

Set up AWS CLI v2 in the execution environment, including WSL when that is where tools run
With an assigned IAM Identity Center account and permission set, run aws configure sso --profile bmt-lab and aws sso login --profile bmt-lab
Use an instructor-provided federation or temporary-role workflow when IAM Identity Center is not available; avoid root-user access keys
Verify the active account and role with aws sts get-caller-identity --profile bmt-lab, then check the intended region
Understand MFA, temporary session expiry, named profiles, role assumption, and authentication versus IAM authorization

Connect AWS to the Development Toolchain

Select the authorized profile in AWS Toolkit for VS Code; distinguish WSL and Windows profile locations
Use AWS_PROFILE to select a lab profile for compatible CLI, SDK, and Terraform workflows; inspect conflicting credential environment variables
Connect GitHub Actions to an AWS IAM role using OIDC rather than storing long-lived AWS access keys
Apply repository, branch, or environment restrictions to role trust and least-privilege policies
Lab: verify identity locally, inspect an allowed AWS resource, and repeat the approved operation from a scoped CI role

MODULE 16

Terraform (Infrastructure as Code)

Define reusable infrastructure with Terraform, manage remote state, and integrate infrastructure changes into CI/CD workflows.

Learning topics: Terraform (Infrastructure as Code)

Terraform Fundamentals

Terraform workflow (init, plan, apply)
Providers & resources
State files & backends
Best practices for IaC structure

Modules & Reusability

Module structure & variables
Outputs & local values
Building reusable enterprise modules
Organizing IaC for teams

Deploying Cloud Infrastructure

AWS & Azure provisioning
VPCs, subnets, gateways
EC2, Storage, IAM automation
Scaling & load balancing

State Management & Backends

Remote backend (S3, Azure Storage)
S3 native state locking; migrating from deprecated DynamoDB locking
State security & encryption
Team collaboration & workflows

CI/CD with Terraform

Terraform in GitHub Actions
Automated plans & applies
Versioning & tagging
Pipeline security best practices

Advanced Terraform Topics

Workspaces for multi-environment IaC
Managing secrets & sensitive values
HCP Terraform & Terraform Enterprise concepts
Policy as Code (Sentinel)

AWS Authentication & CI Integration

Run Terraform using an authorized AWS profile or assumed role; distinguish provider credentials from backend access
Verify identity, region, and remote state permissions before planning changes
Authenticate GitHub Actions to AWS with OIDC and scope the CI role to the lab infrastructure and state backend
Keep credentials out of .tf files, variable files, plans, logs, and Git; understand that sensitive values may still be present in state
Lab: edit in VS Code, review a Terraform plan in a pull request, approve an apply in the authorized environment, and clean up lab resources

MODULE 17

Prometheus & Grafana (Monitoring)

Collect metrics with Prometheus, visualize them in Grafana, and explore alerting and monitoring for cloud systems.

Learning topics: Prometheus & Grafana (Monitoring)

Prometheus Fundamentals

Prometheus architecture
Pull-based metrics model
Jobs, exporters & targets
Time-series data concepts
End-to-end observability setup

Grafana Dashboards

Building real-time dashboards
Connecting data sources
Custom panels & visualizations
Sharing & managing dashboards
Monitoring clusters & pods
Performance visualization

Alerting & Reliability

Prometheus Alertmanager
Alert rules & notifications
Incident detection workflows
Monitoring microservices

Authentication & Secure Monitoring Integration

Authenticate Grafana users with assigned roles and use scoped service-account tokens for automation
Configure data-source credentials in approved secret storage; distinguish Grafana login from data-source authentication
Protect Prometheus endpoints with supported authentication and network controls; do not expose metrics or administration publicly
Lab: connect an authorized data source, build a dashboard for the deployed application, and verify viewer versus administrator access

MODULE 18

AI for Cloud & DevOps Engineering

Explore AI-assisted infrastructure, scripting, CI/CD, troubleshooting, and security workflows. Review and validate generated output before using it in real systems.

Learning topics: AI for Cloud & DevOps Engineering

AI for Infrastructure Automation

Generate Terraform, Bicep, ARM & YAML templates
AI-assisted cloud provisioning
Self-healing infrastructure
AI-driven cloud cost optimization

AI for DevOps Productivity

AI-generated CI/CD pipelines
Create Dockerfiles & Kubernetes manifests with AI
Bash, PowerShell & Python generation
Troubleshoot CI/CD failures using AI logs analysis

AI for Cloud Operations

AI log analysis (CloudWatch, Log Analytics)
Root-cause detection & anomaly alerts
AI-generated runbooks
Performance prediction & optimization

AI in Kubernetes & Containers

Auto-generate Kubernetes YAML
AI pod debugging & health checks
Predictive autoscaling
Cluster optimization suggestions

AI for Security & Compliance

Threat detection & vulnerability triage
AI code scanning for security issues
Policy-as-code generation
Compliance drift detection

AI Tools for DevOps Engineers

ChatGPT, GitHub Copilot, Gemini
AWS Bedrock & Azure AI Studio
Kubiya, StackStorm AI
AI observability & monitoring platforms

API Authentication & Developer Tool Integration

Distinguish signing in to an editor extension from authenticating an application to a model API
Use approved API keys or cloud role credentials with scoped access, quotas, and secret storage
Review generated cloud configuration and CI changes in a pull request before execution
Do not paste tokens, private keys, customer data, or confidential logs into unapproved AI tools

Interested in joining BMT?

Ask about the next intake, fees, and prerequisites before registering.