DevOps/Cloud Engineer Simulation: Run real on-call shifts, sprints and programs in your own cloud account

Join Kestrel Pay, a fintech, as its DevOps/cloud engineer. AI colleagues page you, ask for changes and review your work, while a small sandbox we deploy into your own AWS, GCP or Azure account hides real misconfigurations for you to find and fix in your cloud console, CLI and terminal. Read-only checks verify what you actually changed.

Bring your own AWS, GCP or Azure account

The work happens in your own cloud account. Pricing is the same on every cloud; each cloud below shows whether it is available now or coming soon.

• AWS: available
• Google Cloud: coming soon
• Azure: coming soon

Solo · 2 plays per purchase · from US$10.00 (₹981.76 incl. GST) · upgrade within the same duration for the difference · Get the simulation

Prices (2 plays each)

Durations

• 1 day (on-call shift): An on-call shift: handover, two to four incidents, a change request and a postmortem. About 3 to 4 hours. Window: 45 days from play start.
• 7 days (sprint): A sprint of seven compressed game days: build or migrate something, stand-ups, a mid-sprint incident and a demo. About 6 to 10 hours over several sessions. Window: 60 days from play start.
• 30 days (program): A program of thirty compressed game days: hardening, an SRE rollout or a 30% cost-down, with weekly reviews, an audit, an outage and a QBR. About 15 to 25 hours. Window: 180 days from play start.

What you will do at each level

• Beginner: 1 day (on-call shift): AWS Console / CLI / CloudShell, IAM, S3, EC2 + Security Groups, CloudWatch basics, Linux shell, Git basics; 7 days (sprint): GitHub (repo, branches, PRs), GitHub Actions, Docker, ECR; 30 days (program): Docker Compose, Terraform, CloudWatch dashboards, AWS Budgets. A mentor offers runbooks, hints are free and risky actions are blocked. You learn the console, IAM, networking basics and your first pipeline.
• Intermediate: 1 day (on-call shift): Docker, GitHub Actions, CloudWatch alarms, ALB / Auto Scaling, RDS, Terraform; 7 days (sprint): Terraform modules + remote state, ECR → ECS deploy pipeline, ECR, Secrets Manager / SSM, Kubernetes (kubectl, manifests), Helm; 30 days (program): Ansible, Prometheus, Grafana, Blue/green deploys, Backup/restore drills, Cost allocation tagging. Hints are on request and cost a little score. Personas push trade-offs and deadlines; you own containers, Terraform and deploy pipelines.
• Advanced: 1 day (on-call shift): Kubernetes (kubectl, manifests), Helm, Terraform, Incident command, OpenTelemetry, Prometheus; 7 days (sprint): Argo CD (GitOps), Policy as code (Checkov / tfsec / OPA), Canary releases, HPA / cluster autoscaling; 30 days (program): Organizations / SCPs (multi-account), GuardDuty / Security Hub / Config, FinOps (CUR, savings plans), Chaos (AWS FIS), DR game day. Hints are rare and the manager expects you to lead. Escalations, overlapping incidents and blast-radius grading on Kubernetes, GitOps and multi-account work.

Cloud costs

You pay your cloud provider for the small sandbox we deploy; we show the estimated total before every play. Kubernetes plays: you choose k3s on one small VM (about $0.50/day) or a managed cluster (EKS, GKE or AKS: a control-plane fee of about $2.40/day where the provider charges one, plus nodes).

Security

• A scoped role, not your keys: A one-click template creates a read-only role and a sandbox role limited to our tagged resources, one region and small machine types (an IAM role with an External ID on AWS, workload identity federation on GCP, a federated service principal on Azure). Sessions are short-lived.
• Read-only checks: Verification only reads configuration. We never read your data (no storage objects, secrets or parameters) and never run commands you type with your credentials.
• Automatic teardown: The sandbox is deleted when a play ends, after 72 hours without activity, and when the play's window closes. A budget alert is set to the estimate you confirmed.
• Disconnect anytime: One button deletes everything we stored about your account and shows you how to remove the access we were given.

Questions

Do I need my own cloud account?

Yes: AWS, Google Cloud or Azure (each is marked available or coming soon above). The work happens in your real console, CLI and terminal, against a small sandbox we deploy for each play. The price is the same on every cloud.

How much will my cloud provider charge me?

Usually cents to a few dollars per play: the sandbox is free-tier sized. Before every play we show the estimated total, including a worst case if you leave it running. Kubernetes plays let you pick k3s on one small VM (about $0.50 a day) or a managed cluster (EKS, GKE or AKS, about $2.40 a day for the control plane where charged, plus nodes).

What do I get for one purchase?

Two plays of one level and duration. Every play draws fresh faults and a fresh story, and has its own window from the moment you start it: 45 days for a 1-day shift, 60 days for a 7-day sprint, 180 days for a 30-day program.

Can I upgrade later?

Yes, within the same duration you pay only the difference: owning Beginner 7-day, Advanced 7-day costs the price gap. Upgrades do not carry across durations.

Is it safe to connect my account?

We use a scoped, read-only role with short-lived sessions and no stored long-lived secrets where the cloud allows it. The sandbox role can only touch our tagged resources. You can disconnect at any time.

Can I play with friends?

No, it is solo: you are the on-call engineer. Leaderboards are per level and duration, best of your two plays.

Is it included for my university or company?

Yes, when your organization's licence includes Simulations: every level and duration, while the licence runs.