aws

name	aws
description	Comprehensive AWS (Amazon Web Services) best practices and infrastructure guidelines. Use when deploying to AWS, writing CloudFormation/CDK/Terraform for AWS, configuring IAM permissions, S3 buckets, EC2 instances, Lambda functions, or ECS/EKS clusters. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Amazon Web Services (AWS) Best Practices

STOP. Your knowledge of AWS may be outdated. Prefer retrieval over pre-training for any version-sensitive AWS configuration. Fetch current documentation when in doubt.

Production-grade standards for designing, deploying, and managing infrastructure on AWS.

1. Security & IAM (Identity and Access Management)

• Principle of Least Privilege (PoLP): Never use * (wildcard) actions or resources in IAM policies unless absolutely required (e.g., specific S3 list actions). Scope policies to specific ARNs and exact actions.
• Root Account: Never use the root account for day-to-day operations. Use AWS SSO (IAM Identity Center) or assume roles.
• Secrets Management: Never hardcode secrets in code or environment variables attached to instances. Always use AWS Secrets Manager or AWS Systems Manager Parameter Store (SSM).

2. Serverless (Lambda & API Gateway)

• Cold Starts: Minimize cold starts in Lambda by keeping deployment packages small. For Node.js/TypeScript, use tools like esbuild to bundle and tree-shake code.
• Concurrency: Set reserved concurrency for critical functions to ensure they always have execution capacity.
• Idempotency: Lambda functions should be idempotent, especially when triggered by SQS, SNS, or EventBridge, as AWS guarantees at-least-once delivery (not exactly-once).

3. Storage & Databases (S3, DynamoDB, RDS)

• S3 Security: ALWAYS enable "Block Public Access" at the bucket level unless serving a static website. Enforce server-side encryption (AES256 or aws:kms).
• DynamoDB: Prefer single-table design when access patterns are strictly known. Use On-Demand capacity for unpredictable workloads and Provisioned capacity (with Auto Scaling) for predictable workloads to save costs.
• RDS: Never place RDS instances in public subnets. They must reside in private subnets, accessed via Bastion Hosts, VPN, or Session Manager.

4. Networking (VPC)

• Multi-AZ: Always deploy critical resources (NAT Gateways, RDS, ALB, ECS) across at least two Availability Zones for high availability.
• Security Groups: Security Groups are stateful. Only allow necessary inbound ports (e.g., 443 for HTTPS). Do not open 0.0.0.0/0 on port 22 or 3306.

5. Infrastructure as Code (IaC)

• Tooling: Prefer AWS CDK or Terraform over raw CloudFormation templates.
• Immutability: Never make manual changes in the AWS Console (ClickOps). All infrastructure changes must be codified, reviewed, and deployed via CI/CD.