Back to Blog

Cloud Certification Roadmap 2026: AWS, Azure, GCP, Kubernetes, and HashiCorp

The definitive 2026 cloud certification roadmap covering AWS, Azure, GCP, Kubernetes, and HashiCorp paths — with sequencing, costs, salary impact, and decision frameworks.

By Sailor Team , May 25, 2026

Introduction

In 2026, choosing a cloud certification path is harder than it’s ever been. Five providers (AWS, Azure, Google, Linux Foundation, HashiCorp) each publish 5–15 certifications, and most professionals don’t have time or budget for more than a handful. Picking the wrong sequence wastes months.

This roadmap distills the best-sequence-for-most-people for each major provider, plus three multi-cert “stacks” that consistently deliver the highest salary uplift in 2026 hiring data. If you’re starting from zero, returning after a break, or planning the next 2–3 years of your career, this is the playbook.

How to Read This Roadmap

For each provider, we show:

  • Entry: start here if new to that ecosystem
  • Core: the cert most working professionals should target
  • Specialized: branching paths by role (Architect, DevOps, Security, Data, AI)

Cost estimates are 2026 USD list prices; discounts and renewal credits are common.

AWS Path

Entry → Core → Specialized

Cloud Practitioner (CLF-C02, $100)
        │
        ▼
Solutions Architect Associate (SAA-C03, $150)
   ▲                                  ▼
   │                            ─────┴─────────────
   │                            │                  │
   │                  Developer Associate    SysOps Associate
   │                  (DVA-C02, $150)        (SOA-C02, $150)
   │                            │                  │
   └────────────────────────────┴──────────────────┘
                                ▼
              ┌─────────────────────────────────┐
              │   Pro & Specialty (pick path)   │
              └─────────────────────────────────┘
                  │              │            │
        SA Professional   DevOps Pro   Specialties
        (SAP-C02, $300)   (DOP-C02)    (Security, ML, AI Practitioner,
                          $300         Advanced Networking, Data Engineer, Machine Learning)

Recommended sequence for most:

  1. Cloud Practitioner — optional but useful for non-engineers
  2. Solutions Architect Associate — the most important AWS cert
  3. Developer Associate or SysOps Associate (pick by role)
  4. Optional: Solutions Architect Professional, DevOps Engineer Professional, Security Specialty, or AI Practitioner

Read more: AWS certification roadmap 2026

Azure Path

Entry → Core → Specialized

AZ-900 Fundamentals ($99)
        │
        ▼
AZ-104 Administrator ($165) ──┬── AZ-204 Developer ($165)
        │                     │
        ▼                     ▼
AZ-305 Solutions Architect Expert ($165)
   │
   ├── AZ-400 DevOps Engineer Expert ($165) — requires AZ-104 or AZ-204
   ├── AZ-500 Security Engineer Associate ($165)
   ├── AI-102 AI Engineer Associate ($165)
   └── SC-100 Cybersecurity Architect Expert ($165)

Recommended sequence for most:

  1. AZ-900 — lifetime certification, great fast win
  2. AZ-104 — the core operational cert
  3. Pick by role:

Read more: AZ-900 exam guide 2026

Google Cloud Path

Entry → Core → Specialized

Cloud Digital Leader ($99)      (Business / Sales)
        OR
Associate Cloud Engineer ($125)  (Engineers — start here)
        │
        ▼
       ┌─────────────────────────────────────┐
       │   Professional certs (pick path)    │
       └─────────────────────────────────────┘
          │             │                    │
  Cloud Architect  Cloud DevOps      Data Engineer
  (PCA, $200)      (PCDE, $200)      (PDE, $200)
                                          │
                                          ▼
                                  ML Engineer / Network Engineer
                                  / Cloud Security / Workspace Admin

Recommended sequence for most:

  1. Engineers: Associate Cloud Engineer directly. Non-engineers: Cloud Digital Leader
  2. Pick by role:
  3. Optional cross-cloud: pair with AWS SAA or AZ-104

GCP certifications expire every 2 years, faster than AWS (3) or Azure (1 with free renewal).

Kubernetes / Linux Foundation Path

Entry → Core → Specialist

KCNA — Kubernetes Cloud Native Associate ($250)   (entry-level)
KCSA — Kubernetes Cloud Native Security Associate ($250)
        │
        ▼
CKAD — Application Developer ($395)
CKA  — Administrator ($395)
        │
        ▼
CKS  — Security Specialist ($395)   (requires CKA)
        │
        ▼
KubeAstronaut — collect all 5 K8s certs ($0 — recognition badge)

Recommended sequence for most:

  1. Optional: KCNA and/or KCSA for knowledge-based foundation
  2. CKA or CKAD (pick by role): admins start CKA, developers start CKAD
  3. Optional: the other associate-level
  4. CKS for security-focused roles (requires CKA)
  5. KubeAstronaut by completing all five

Linux foundation: LFCS is the natural pairing — strong Linux fluency makes CKA/CKAD significantly easier.

HashiCorp Path

Two associate-level credentials, both high-ROI:

Terraform Associate (TA-003, $70.50)     IaC fluency
Vault Associate (VA-002, $70.50)         Secrets management
        │
        ▼
Professional-level (where available):
  - Terraform Authoring & Operations Professional (hands-on)
  - Vault Operations Professional (where offered)

Recommended sequence for most:

  1. Terraform Associate — universally relevant
  2. Vault Associate — strong DevSecOps signal
  3. Professional credentials if/when your work calls for them

HashiCorp certs are the cheapest serious DevOps certifications on the market.

Security Path (Cross-Vendor)

CompTIA Security+ (SY0-701, $392)
        │
        ▼
   ┌──────────────────────────────────────┐
   │           Pick by direction          │
   └──────────────────────────────────────┘
        │              │             │
   CISSP (~$749)   CISA (~$760)   Cloud-specific:
   (broad mgmt)    (audit)        AZ-500 / AWS Security
                                  Specialty / GCP Security

Recommended sequence:

  1. CompTIA Security+ — universal entry
  2. Cloud-specific: AZ-500 or AWS Security Specialty
  3. Strategic: CISSP (5 yr exp) or CISA (audit-focused)
  4. Containers: KCSA + CKS

Multi-Cert “Stacks” That Deliver in 2026

The highest-paid candidates rarely hold a single certification. These three stacks consistently appear at the top of 2026 salary surveys:

Stack 1: “Cloud Architect” (~$170K–$220K US)

Stack 2: “DevOps / SRE” (~$155K–$200K US)

Stack 3: “Cloud Security” (~$150K–$200K US)

Year-By-Year Sample Plan (Engineer Starting From Zero)

A realistic 24-month path for a working engineer with limited cert budget:

Year 1

Year 2

  • Month 13–18: Pro-level cert (AWS DevOps Pro, AZ-400, GCP PCDE) or CKA
  • Month 19–22: Specialized (Security or AI) cert
  • Month 23–24: Cross-cloud if not done already

Total cost: ~$1,400–$2,000 over 24 months. ROI: a 20–40% compensation lift is the typical outcome for engineers who complete this kind of structured stack while building real projects.

How to Decide Which Cloud First

When in doubt, let the job market decide:

  1. Open three job board tabs in your target city/industry.
  2. Search for “AWS,” “Azure,” and “GCP” separately.
  3. Count postings.
  4. Pick the cloud with the most relevant postings.

For most candidates in 2026:

  • AWS is the largest hiring market in tech/startups/SaaS
  • Azure dominates enterprise IT, government, finance, healthcare
  • GCP is strongest in data, analytics, ML, and modernized engineering orgs

There is no universal “best” — only the best match for your target jobs.

Common Roadmap Mistakes

  1. Stacking 4 AWS certs while never touching Terraform or Kubernetes. Cloud-native breadth pays better than vendor depth past 3 certs.
  2. Chasing the “highest-paid cert list.” The cert correlated with high pay correlates because senior engineers hold it — not because the cert causes the pay.
  3. Multi-cloud without consolidation. One associate-level cert across three clouds is weaker than one Pro + one IaC + one Kubernetes cert in your primary cloud.
  4. Skipping foundations to chase associates. AZ-900 / AWS CCP / GCP CDL pay off in confidence and pass rate on associate exams.
  5. Letting certs expire mid-stack. 3-year recerts on AWS/CompTIA, 2-year on GCP/HashiCorp/K8s, 1-year on Microsoft (with free renewal). Plan the calendar.

Frequently Asked Questions

Q: How many certifications should I have? A: Three to five is the sweet spot for most senior IC engineers. More than seven shows diminishing returns and “cert collector” pattern matching from interviewers.

Q: Are certifications worth it without experience? A: Yes, as a credible signal to land interviews. They don’t replace experience — but they get you past the first resume filter.

Q: Which cloud has the easiest associate-level cert? A: GCP ACE and AZ-104 are typically considered slightly easier than AWS SAA, but all three require serious effort.

Q: Should I do AWS first or Azure first? A: Whichever your employer uses, or whichever has more jobs in your target city/industry.

Q: How do I keep certs current without burning out? A: Schedule renewals on a quarterly calendar. Use CPE/CEU-eligible activities you’d do anyway (conferences, courses, technical blog reading).

Q: Where can I get realistic practice exams? A: Sailor.sh offers exam-format mock exam bundles aligned to every major cloud and DevOps certification — see our full practice exams catalog.

Ready to Start?

The best certification roadmap is the one you actually execute. Pick your cloud, pick your stack, schedule the exams, and start drilling realistic practice questions today.

Browse Sailor.sh’s mock exam catalog to find the exact bundle for your next exam, or read our detailed guides for the certs on your roadmap:

Limited Time Offer: Get 80% off all Mock Exam Bundles | Sale ends in 7 days. Start learning today.

Claim Now