---
name: aws
description: |
  Comprehensive AWS (Amazon Web Services) best practices and infrastructure guidelines. Use when deploying to AWS, writing CloudFormation/CDK/Terraform for AWS, configuring IAM permissions, S3 buckets, EC2 instances, Lambda functions, or ECS/EKS clusters. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.
---

# Amazon Web Services (AWS) Best Practices

**STOP.** Your knowledge of AWS may be outdated. Prefer retrieval over pre-training for any version-sensitive AWS configuration. Fetch current documentation when in doubt.

Production-grade standards for designing, deploying, and managing infrastructure on AWS.

## 1. Security & IAM (Identity and Access Management)

- **Principle of Least Privilege (PoLP)**: Never use `*` (wildcard) actions or resources in IAM policies unless absolutely required (e.g., specific S3 list actions). Scope policies to specific ARNs and exact actions.
- **Root Account**: Never use the root account for day-to-day operations. Use AWS SSO (IAM Identity Center) or assume roles.
- **Secrets Management**: Never hardcode secrets in code or environment variables attached to instances. Always use **AWS Secrets Manager** or **AWS Systems Manager Parameter Store (SSM)**.

## 2. Serverless (Lambda & API Gateway)

- **Cold Starts**: Minimize cold starts in Lambda by keeping deployment packages small. For Node.js/TypeScript, use tools like `esbuild` to bundle and tree-shake code.
- **Concurrency**: Set reserved concurrency for critical functions to ensure they always have execution capacity.
- **Idempotency**: Lambda functions should be idempotent, especially when triggered by SQS, SNS, or EventBridge, as AWS guarantees at-least-once delivery (not exactly-once).

## 3. Storage & Databases (S3, DynamoDB, RDS)

- **S3 Security**: ALWAYS enable "Block Public Access" at the bucket level unless serving a static website. Enforce server-side encryption (`AES256` or `aws:kms`).
- **DynamoDB**: Prefer single-table design when access patterns are strictly known. Use On-Demand capacity for unpredictable workloads and Provisioned capacity (with Auto Scaling) for predictable workloads to save costs.
- **RDS**: Never place RDS instances in public subnets. They must reside in private subnets, accessed via Bastion Hosts, VPN, or Session Manager.

## 4. Networking (VPC)

- **Multi-AZ**: Always deploy critical resources (NAT Gateways, RDS, ALB, ECS) across at least two Availability Zones for high availability.
- **Security Groups**: Security Groups are stateful. Only allow necessary inbound ports (e.g., 443 for HTTPS). Do not open `0.0.0.0/0` on port 22 or 3306.

## 5. Infrastructure as Code (IaC)

- **Tooling**: Prefer AWS CDK or Terraform over raw CloudFormation templates.
- **Immutability**: Never make manual changes in the AWS Console (ClickOps). All infrastructure changes must be codified, reviewed, and deployed via CI/CD.
