diff --git a/rfcs/text/0033-new-cloud-fields.md b/rfcs/text/0033-new-cloud-fields.md
index 0420647a37..4dbcf31a5b 100644
--- a/rfcs/text/0033-new-cloud-fields.md
+++ b/rfcs/text/0033-new-cloud-fields.md
@@ -1,7 +1,7 @@
 # 0033: New cloud (or related) fields
 <!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->
 
-- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
+- Stage: **1 (Draft)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
 - Date: **2022-07-22** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
 
 <!--
@@ -52,6 +52,8 @@ Possible alternatives proposed in https://github.com/elastic/ecs/issues/1725
 Stage 1: Describe at a high level how this change affects fields. Include new or updated yml field definitions for all of the essential fields in this draft. While not exhaustive, the fields documented here should be comprehensive enough to deeply evaluate the technical considerations of this change. The goal here is to validate the technical details for all essential fields and to provide a basis for adding experimental field definitions to the schema. Use GitHub code blocks with yml syntax formatting, and add them to the corresponding RFC folder.
 -->
 
+
+
 <!--
 Stage 2: Add or update all remaining field definitions. The list should now be exhaustive. The goal here is to validate the technical details of all remaining fields and to provide a basis for releasing these field definitions as beta in the schema. Use GitHub code blocks with yml syntax formatting, and add them to the corresponding RFC folder.
 -->
diff --git a/rfcs/text/0033/cloud.yml b/rfcs/text/0033/cloud.yml
new file mode 100644
index 0000000000..b79237c19d
--- /dev/null
+++ b/rfcs/text/0033/cloud.yml
@@ -0,0 +1,34 @@
+---
+fields:
+  - name: network.edge_location
+    level: extended
+    type: keyword
+    short: Edge location identifier
+    description: >
+      The Cloud/CDN provider's edge location identifier, usually the IATA Airport code
+    example: LAX1
+
+  - name: cloud.image.id
+    level: extended
+    type: keyword
+    short: The ID of the cloud virtual machine image.
+    description: >
+      The ID of the cloud virtual machine image. AWS uses AMI.
+    example: ami-99999999
+
+  - name: cloud.image.name
+    level: extended
+    type: keyword
+    short: The friendly/display name of the cloud virtual machine image.
+    description: >
+      The friendly/display name of the cloud virtual machine image.
+    example: Amazon Linux AMI 2018.03
+
+  - name: cloud.instance.state
+    level: extended
+    type: keyword
+    short: The state of the virtual machine.
+    description: >
+      The current state of the virtual machine; pending, running, stopped, shutting-down, terminated...
+    example: running
+