Cloud Solution Design and Implementation
Cloud Solution Design and Implementation tests your ability to build the approved design: provision infrastructure repeatably, wire services together, and deliver with least-privilege automation.
Provision with infrastructure as code
Use IBM Cloud Schematics workspaces backed by Terraform to create VPCs, subnets, clusters, and service instances. Keep environments in separate resource groups, and pass environment-specific variables rather than cloning code.
Choose the runtime deliberately
IBM Cloud Code Engine runs containerized or source-based workloads without cluster operations. Red Hat OpenShift on IBM Cloud (ROKS) fits teams needing Kubernetes APIs, operators, and fine-grained control. IBM Cloud Kubernetes Service is the managed Kubernetes option. Use IBM Cloud Container Registry for images and IBM Cloud Continuous Delivery toolchains for pipelines.
Bind services without hard-coded secrets
Create a service ID and API key per pipeline, assign only required IAM policies, store credentials in Secrets Manager, and bind services to the runtime. Code Engine and Kubernetes can consume bindings as environment variables or mounted files.
Worked example
A team must deploy a containerized API with a database. Reasoning: Schematics provisions VPC, registry namespace, Code Engine project, and a managed database; the pipeline builds and pushes an image; Code Engine deploys it and binds database credentials from Secrets Manager; the service ID has write access only to that project and read access to the secret.
Traps
Using the account owner's API key in pipelines; embedding credentials in images; assuming a service binding grants IAM permissions; forgetting that resource groups scope access and cost.