AWS

Account structure

• Separate AWS accounts per environment (dev, staging, prod). Never share prod account
• AWS Organizations with SCPs for org-wide guardrails. Control Tower for multi-account setup
• Dedicated logging/security account. Ship CloudTrail, Config, and GuardDuty findings there
• SCPs: deny root usage, deny disabling CloudTrail/GuardDuty, enforce region restrictions

IAM

• Least privilege. No wildcard actions/resources (*) in production
• No long-lived human access keys. Use IAM Identity Center, roles, temp credentials
• EC2/Lambda/ECS: instance profiles and execution roles. Never credentials in code or env vars
• EKS: IRSA (IAM Roles for Service Accounts) per pod. No node-level roles for app permissions
• Separate roles per service and environment. No shared roles across workloads
• Permission boundaries for delegated admin. Prevents privilege escalation via role creation
• MFA on all IAM users. Root locked — never used
• Rotate credentials. Audit via IAM Access Analyzer. Remove unused permissions

Secrets

• Store in Secrets Manager or SSM Parameter Store (SecureString). Never in env vars, AMIs, images, Terraform state, or CloudFormation parameters (use SSM/Secrets Manager references)
• Auto-rotate via Secrets Manager rotation lambdas
• Reference by ARN in task definitions and Lambda config. Never pass values directly

Networking

• VPC per environment. Public subnets: load balancers only. Private: compute and data
• Security groups: ingress from known sources only. No 0.0.0.0/0 except ALB port 443
• WAF in front of ALB and CloudFront for all public-facing workloads
• No EC2 public IPs unless required. Session Manager for all access — no SSH
• NACLs as secondary subnet-level layer
• VPC Flow Logs enabled. Ship to CloudWatch or S3
• PrivateLink for AWS service access where internet routing is avoidable

Security

• CloudTrail in all regions. Logs to dedicated locked-down S3 bucket
• GuardDuty enabled. Security Hub enabled with baseline standard (AWS Foundational or CIS)
• Macie enabled on S3 buckets containing sensitive or PII data
• S3: block public access at account level. Explicit bucket policies only
• S3 versioning + MFA delete on sensitive buckets
• S3 lifecycle policies: transition to IA/Glacier, expire old versions. Unbounded storage compounds cost
• KMS: customer-managed keys (CMK) for sensitive data at rest. Audit key usage
• Config enabled with conformance packs for drift detection
• ECR: image scanning on push. Block deploy on critical/high CVEs

Compute

• Lambda: least-privilege role, explicit timeout and memory, concurrency limits, dead-letter queues
• ECS: Fargate preferred. Task definitions: read-only root filesystem, no privileged, drop unused Linux capabilities
• EKS: Fargate or managed node groups. Pod security standards enforced. IRSA per workload
• Unmanaged EC2 nodes require justification
• Patch AMIs regularly via EC2 Image Builder. No unpatched instances
• Auto Scaling groups for all stateless compute. No single-instance production

IaC

• All infrastructure as code (CDK, Terraform, CloudFormation). No manual console changes in production
• IaC in version control. Changes via PR, not direct apply
• Drift detection enabled in CloudFormation. Config rules catch out-of-band changes
• Stack/workspace separation per environment. No shared state across envs
• Secrets never in IaC source. Use SSM/Secrets Manager references at deploy time

Ops

• Tag all resources: env, team, service, owner
• CloudWatch Logs retention set explicitly on all log groups. Default is indefinite — costs accumulate
• CloudWatch alarms on error rates, latency, queue depth
• X-Ray or ADOT (AWS Distro for OpenTelemetry) for distributed tracing
• Savings plans or reserved instances for predictable baseline
• Billing alarms and budgets set. Unexpected spikes require investigation
• Multi-AZ for all stateful services (RDS, ElastiCache). Single-AZ not production
• RDS: automated backups on, deletion protection on, encryption at rest on