Cloud projects for your resume, ranked by interview value

What makes a cloud project worth an interview

Hiring managers do not read your repository line by line. They open the README, glance at the diagram, check whether the infrastructure is defined in code, and decide whether to ask you about it. A project earns interview time when it shows four things: you built the network and permissions yourself rather than accepting defaults, the whole thing deploys from code, something went wrong and you fixed it, and you know what it costs.

That is why the ranking below puts a plain VPC project above a flashier AI demo. Most AWS interview questions are about networking, IAM, resilience and cost (see the AWS solutions architect interview questions), so a project that covers those topics gives the interviewer twenty minutes of material and gives you answers you have lived through.

Build two or three of these properly. Seven half-finished tutorials in seven repositories read as seven tutorials.

The projects, ranked by interview value

Build a VPC across two Availability Zones with public, private application and private data subnets. Put an Application Load Balancer in the public subnets, an Auto Scaling group of small instances (or ECS on Fargate) in the private application subnets, and an RDS database in the data subnets. Security groups reference each other, so the database accepts traffic only from the application tier. Define all of it in Terraform.

What it proves: you understand routing, subnets, security groups, high availability and the patterns behind half the questions in an architect interview.

Resume bullet: "Designed and deployed a two-AZ, three-tier web application on AWS with Terraform: ALB, Auto Scaling group in private subnets, RDS with Multi-AZ, least-privilege security groups."

Host a site in a private S3 bucket behind CloudFront with origin access control, an ACM certificate (issued in us-east-1, which CloudFront requires), and a Route 53 record for your domain. Deploy from GitHub Actions using OIDC federation to an IAM role, so the pipeline never stores long-lived AWS keys.

What it proves: CDN and DNS basics, TLS, bucket policies, and CI/CD security done properly. The OIDC detail is the part worth talking about.

Resume bullet: "Built a CI/CD pipeline deploying a static site to S3 and CloudFront via GitHub Actions with OIDC role assumption, no stored credentials; infrastructure in Terraform."

API Gateway in front of Lambda functions writing to DynamoDB, with input validation, an IAM execution role scoped to one table, structured logs in CloudWatch, and authentication through Cognito or an API key. Add a dead-letter queue for failed asynchronous calls.

What it proves: event-driven design, IAM scoping and serverless cost behaviour. It pairs well with the AWS Developer Associate.

Take the VPC from project 1 and turn it into a module with input variables, outputs, a README, an example directory and automated tests using terraform test. Store state in an S3 backend with locking enabled through the use_lockfile setting; HashiCorp now marks the older DynamoDB-based locking as deprecated, and knowing that shows your Terraform knowledge is current. Run terraform fmt, validate and a linter in CI on every pull request.

What it proves: infrastructure as code beyond copy-paste, the core of the Terraform Associate exam and of most platform jobs.

Add CloudWatch dashboards, alarms on error rate and latency, log metric filters and SNS notifications to one of the projects above. Then break it on purpose: kill instances, fill a disk, throttle the database. Write a short incident report for each failure: what alarmed, how long it took you to find the cause, what you changed.

What it proves: operations thinking, which is exactly what cloud support and CloudOps roles hire for. It maps to SysOps Administrator.

Enforce a tagging scheme (owner, project, environment), set AWS Budgets alerts, and write a scheduled Lambda that reports untagged resources, unattached EBS volumes and idle public IPv4 addresses to email each week.

What it proves: you think about the bill. It is cheap to build, and it gives you a real answer when an interviewer asks how you would track down a cost spike.

Azure and homelab versions

If your target employers run Azure, rebuild the ideas rather than the services. A hub-and-spoke virtual network with network security groups, a VM scale set behind a load balancer and Azure SQL in a private subnet, all in Bicep or Terraform, mirrors project 1. Static Web Apps with Azure Functions and Cosmos DB mirrors projects 2 and 3. Azure Monitor alerts and Cost Management budgets mirror projects 5 and 6. Microsoft's always-free list covers a lot of this: Azure Functions includes 1 million requests, Static Web Apps includes 100 GB of bandwidth per subscription and 2 custom domains, and Cosmos DB includes 1,000 request units per second with 25 GB of storage. These projects line up with AZ-104, and Azure administrator jobs covers the matching job search.

A homelab (an old PC running Proxmox, a small Kubernetes cluster, Pi-hole, a backup job to cloud storage) shows curiosity and Linux skill, and it gives you good troubleshooting stories. It counts most for sysadmin, NOC and support roles. For cloud roles, connect it to the cloud: back the lab up to S3 or Azure Blob with lifecycle rules, or run a site-to-site VPN into a VPC. A homelab with no cloud link reads as a hobby, which is fine, but it does not answer the AWS questions.

Writing the README an interviewer will actually read

Treat the README as the cover letter for the project. Put these in order:

1. One sentence on what it does and who it is for.
2. An architecture diagram (draw.io or Excalidraw exported to PNG in the repository).
3. How to deploy it, in three or four commands.
4. Design decisions with the reason for each: why private subnets, why a gateway endpoint instead of NAT traffic, why DynamoDB on-demand.
5. What it costs per month at idle and at light use, and how you checked.
6. What broke while you built it and how you fixed it.
7. What you would change for production: multi-account setup, WAF, backups tested by restore.

The "what broke" section is the most valuable part. It is the honest version of experience, and it is the first thing you will be asked about.

Resume bullets that survive a technical interview

Put projects in their own section under a heading such as "Cloud projects", directly below experience, with a link to each repository. Each bullet follows the same shape: action verb, what you built, the services, and one decision that shows judgement.

• Weak: "Created an AWS project using EC2, S3 and RDS."
• Better: "Deployed a three-tier application across two Availability Zones with Terraform; restricted database access to the application tier by security group reference."
• Weak: "Learned Lambda and DynamoDB."
• Better: "Built a serverless REST API (API Gateway, Lambda, DynamoDB) with a table-scoped IAM role and a dead-letter queue for failed events."

Only add a number if you measured it, such as deploy time or monthly cost from your own billing console. Every service you name is an invitation to be questioned on it, so leave off anything you cannot explain. For layout and where the certificate goes, see how to list certifications on a resume.

Keeping the cost near zero

AWS changed its free tier for new accounts, and older tutorials that promise a year of free EC2 hours no longer describe what you get. As the AWS Free Tier pages now stand, a new account receives $100 in credits on sign-up and can earn up to $100 more by completing activities in the console. The Free plan lasts up to 6 months or until the credits run out, whichever comes first. When it expires, AWS suspends the account and keeps your data for 90 days unless you upgrade to the Paid plan. More than 30 services also have always-free monthly allowances that continue on either plan. Only new customers qualify, so you cannot reset the clock with a second account.

The always-free allowances cover most of projects 2, 3 and 6. Lambda includes one million requests and 400,000 GB-seconds a month, and DynamoDB includes 25 GB of storage. CloudFront now offers a flat-rate Free plan at $0 a month, with 1 million requests and 100 GB of data transfer.

The traps are elsewhere:

• NAT gateways bill by the hour whether or not traffic flows; AWS's own example quotes $0.045 per hour plus $0.045 per GB processed in US East (Ohio). Build project 1, demonstrate it, record a short video, and run terraform destroy. Rebuilding from code is itself part of the demonstration.
• Public IPv4 addresses cost $0.005 per hour each, in use or idle.
• Route 53 hosted zones cost $0.50 per month each, plus the domain registration.
• RDS and EC2 beyond your credits bill at normal rates; stop or destroy them between sessions.

Set an AWS Budgets alert on day one. Budget monitoring and notifications are free, and the first two action-enabled budgets each month are free as well. If you move to the Paid plan after six months, AWS lets you set a monthly spend limit starting at $20 that pauses resources when reached.

Azure is similar in spirit: a new free account gets a $200 credit to use within 30 days, 20+ services free for 12 months, and 65+ always-free services.

Talking about your project in the interview

Prepare a two-minute walkthrough and rehearse it until it sounds like conversation. Problem, architecture, one hard decision, one failure, what you would change. Then stop and let the interviewer pick a thread.

Expect three follow-ups. Why did you choose this service over the alternative (Lambda over containers, DynamoDB over RDS)? What happens when a component fails (an AZ goes down, the database fills up, a deploy goes wrong)? What would it cost at a hundred times the traffic? Have a sentence ready for each.

Be precise about scope. "I built this on my own account, it has had no real users, and here is how I tested it" is credible. Implying production experience you do not have falls apart at the first operational question. If the project is the main evidence on your resume because you are new to IT, getting a job after AWS certification covers which roles to aim it at.