410-aws

AWS Engineering Ruleset

Goal: Build secure, scalable, maintainable AWS infrastructure following best practices for Platform Engineering, Zero Trust, and EKS.

[!IMPORTANT] MAKE SURE TO READ AWS WELL-ARCHITECTED FRAMEWORK BEFORE ANSWERING. Use the AWS Well-Architected Framework as the baseline for recommendations: https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html

[!IMPORTANT] Treat AWS Service Quotas as a first-class design constraint (regional/account limits). Validate quotas early for the services you depend on, request quota increases before rollout, and bake the limits into scaling and architecture decisions: https://docs.aws.amazon.com/servicequotas/latest/userguide/intro.html

AWS Engineering Philosophy

Guiding Principles:

• Security First: Zero Trust architecture, least privilege, defense in depth, encryption everywhere
• Infrastructure as Code: All infrastructure defined in code (Terraform, CloudFormation, CDK); no manual changes
• Observability: Comprehensive logging, metrics, and tracing; monitor everything
• Cost Optimization: Right-sizing, reserved instances, spot instances; measure and optimize continuously
• Disaster Recovery: Multi-region, backups, failover strategies; test regularly
• Automation: Automate everything possible; reduce toil, increase reliability
• Scalability: Design for growth; horizontal scaling preferred over vertical

Core Tenets:

1. Zero Trust: Never trust, always verify. Every request authenticated and authorized
2. Least Privilege: Grant minimum permissions necessary; review regularly
3. Defense in Depth: Multiple security layers; don't rely on single controls
4. Fail Securely: Default deny; explicit allow; fail closed, not open
5. Immutable Infrastructure: Replace, don't patch; version everything
6. Idempotency: Operations should be safe to repeat; infrastructure as code ensures this

Applying AWS Philosophy:

# BAD: Trusting network boundaries
resource "aws_security_group" "app" {
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # Trusting all IPs
  }
}

# GOOD: Zero Trust - explicit allowlist
resource "aws_security_group" "app" {
  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.lb.id]  # Only from load balancer
  }
}

# BAD: Overly permissive IAM
resource "aws_iam_role_policy" "app" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:*"  # Too broad
      Resource = "*"
    }]
  })
}

# GOOD: Least privilege
resource "aws_iam_role_policy" "app" {
  policy = jsonencode({
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:GetObject",
        "s3:ListBucket"
      ]
      Resource = [
        aws_s3_bucket.data.arn,
        "${aws_s3_bucket.data.arn}/*"
      ]
    }]
  })
}

# BAD: Manual changes (not idempotent)
# Manual: Created RDS instance via console

# GOOD: Infrastructure as Code (idempotent)
resource "aws_db_instance" "main" {
  identifier     = "app-db"
  engine         = "postgres"
  instance_class = "db.t3.medium"
  # ... Terraform manages state
}