AWS best practices

This section collects the decisions that come up on almost every AWS engagement, written as positions rather than options: where instances belong on the network, how the two packet filters differ and what that means for the rules you write, which controls should be defaults rather than per-resource settings, and how to choose between compute and data-movement models.

The unifying principle behind most of them is least privilege applied to the network as well as to IAM — put things where they cannot be reached, then open the smallest path that makes the workload work.

Start with private subnets and security groups and network ACLs, which together describe the default network shape everything else assumes. The remaining pages are independent and can be read in any order: EBS encryption by default, endpoint policies as the control point, API Gateway usage plans and API keys, Lambda vs ECS, CloudFront for dynamic content, staging bulk data in S3, RDS Proxy and EC2 system metrics.