{"id":4839,"date":"2026-07-21T21:59:59","date_gmt":"2026-07-21T16:29:59","guid":{"rendered":"https:\/\/itsupportwale.com\/blog\/master-aws-best-practices-optimize-cost-and-security\/"},"modified":"2026-07-21T21:59:59","modified_gmt":"2026-07-21T16:29:59","slug":"master-aws-best-practices-optimize-cost-and-security","status":"publish","type":"post","link":"https:\/\/itsupportwale.com\/blog\/master-aws-best-practices-optimize-cost-and-security\/","title":{"rendered":"Master AWS Best Practices: Optimize Cost & Security"},"content":{"rendered":"

text
\n2024-05-21T03:14:07.892Z [ERROR] [BatchID: 9921-X] FATAL: Connection reset by peer.
\n2024-05-21T03:14:08.001Z [WARN] [Kinesis-Consumer] Shard iterator expired. Retrying…
\n2024-05-21T03:14:08.445Z [CRITICAL] [Billing-Alert] Estimated charges for current month: $42,901.12 (Threshold $5,000 exceeded).
\n2024-05-21T03:14:10.112Z [SYS] Kernel Panic – not syncing: Fatal exception in interrupt.
\n$ aws ec2 describe-instances –filters “Name=instance-state-name,Values=running” –query “Reservations[].Instances[<\/em>].[InstanceId, State.Name, PrivateIpAddress, InstanceType]” –output table<\/p>\n

\n

| DescribeInstances |
\n+———————-+———-+—————-+———————-+
\n| i-0abc123456789def0 | running | 10.0.45.12 | t3.medium |
\n| i-0fed987654321cba0 | running | 10.0.45.13 | t3.medium |
\n+———————-+———-+—————-+———————-+<\/p>\n

I\u2019ve been awake for 48 hours. My eyes feel like someone rubbed them with sandpaper and fiberglass. Why? Because a junior dev\u2014who shall remain nameless to protect the guilty\u2014decided that "restricting traffic is hard" and opened up a security group to `0.0.0.0\/0` on our primary RDS instance to "test a connection." Then they pushed a "simple" Terraform change that nuked the state file because they didn't understand how S3 locking works.\n\nI\u2019m writing this because if I have to fix another "oopsie" at 3 AM involving a NAT Gateway billing spike or a circular dependency in CloudFormation, I\u2019m going to delete my Slack account and go live in a cave. This is the raw, unedited survival guide for our AWS infrastructure. Read it. Memorize it. Don't talk to me about it until I've slept for a week.\n\n## 1. The IAM Policy That Will Get Us Hacked\n\nStop using `AdministratorAccess`. Just stop. I don't care if it's "just for dev." Dev is where the credentials get leaked first. Every time you attach a policy with `Resource: "*"` and `Action: "*"`, a piece of my soul dies. You think you\u2019re being productive; you\u2019re actually just building a playground for crypto-miners.\n\nDoing things the **aws best** way usually means ignoring the default settings and actually thinking about what your service needs to do. If a Lambda function only needs to read from one S3 bucket, don't give it `AmazonS3FullAccess`. Give it a scoped-down policy.\n\nHere is what a real policy looks like. Not that garbage the console generates:\n\n```json\n{\n    "Version": "2012-10-17",\n    "Statement": [\n        {\n            "Sid": "AllowScopedS3Access",\n            "Effect": "Allow",\n            "Action": [\n                "s3:GetObject",\n                "s3:ListBucket"\n            ],\n            "Resource": [\n                "arn:aws:s3:::prod-customer-data-app-01",\n                "arn:aws:s3:::prod-customer-data-app-01\/*"\n            ],\n            "Condition": {\n                "StringEquals": {\n                    "aws:PrincipalOrgID": "o-xxxxxxxxxx"\n                }\n            }\n        },\n        {\n            "Sid": "EnforceKMSForS3",\n            "Effect": "Allow",\n            "Action": [\n                "kms:Decrypt",\n                "kms:GenerateDataKey"\n            ],\n            "Resource": "arn:aws:kms:us-east-1:123456789012:key\/mrk-xxxxxxxxxxxxxxxxxxxxxxxx",\n            "Condition": {\n                "StringLike": {\n                    "kms:ViaService": "s3.us-east-1.amazonaws.com"\n                }\n            }\n        }\n    ]\n}\n<\/code><\/pre>\n
Notice the Condition<\/code> block? That\u2019s the difference between an engineer and a script kiddie. We use aws:PrincipalOrgID<\/code> to ensure that even if someone messes up the principal, the access is locked to our Organization. <\/p>\n
And for the love of everything holy, use Service Control Policies (SCPs) at the root level to prevent people from disabling CloudTrail or leaving the Organization. If I find out someone deleted the audit logs again, I’m revoking your console access and making you use the CLI for everything.<\/p>\n
{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "DenyDisablingCloudTrail",\n      "Effect": "Deny",\n      "Action": [\n        "cloudtrail:StopLogging",\n        "cloudtrail:DeleteTrail",\n        "cloudtrail:UpdateTrail"\n      ],\n      "Resource": "*"\n    }\n  ]\n}\n<\/code><\/pre>\n
\n
Table of Contents<\/p>\n