Begin with account and identity design
Separate production from experiments, require strong human authentication, and use temporary role credentials. Give instances an IAM role rather than static access keys. Scope access by application and environment, then audit policy changes.
Tag resources with owner, purpose, environment, and cost information. Maintain a monitored break-glass process. Identity is the primary control plane, so broad administrator rights should be rare and time limited.
Segment the VPC
Use public subnets for controlled entry points and private subnets for application and data systems. Security groups should permit documented flows only. Define DNS, routing, egress, and administrative access before deploying instances.
Distribute resilient services across availability zones. Keep user sessions and uploads outside individual instances, and use meaningful health checks behind load balancers. Auto scaling depends on reliable images and fast, observable bootstrap.
Build approved Linux images
Choose a maintained distribution image and pin or publish an approved version. A golden-image pipeline can apply updates, install agents, enforce hardening, and run tests. Keep secrets out of images and user data.
Use cloud-init or configuration management for repeatable initialization. Centralize bootstrap logs, and do not send traffic to an instance until the application and required dependencies are healthy.
Protect data and prove recovery
Encrypt disks, use storage matched to the workload, and monitor I/O behavior. Back up databases with application-aware methods and keep critical recovery material outside the immediate failure domain.
Run restoration exercises, not only backup jobs. Recreate networking, identity, DNS, secrets, and application artifacts in an isolated environment. Track cost with budgets and unit metrics while preserving the controls required by the service objective.
