--- title: 12 Things You Should (and Shouldn't) Do in AWS | daily.dev description: An AWS consultant who has spent fifteen years fixing outages walks through twelve practical dos and don'ts for running production workloads on AWS: use... canonical: https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 12 Things You Should (and Shouldn't) Do in AWS | daily.dev og:description: An AWS consultant who has spent fifteen years fixing outages walks through twelve practical dos and don'ts for running production workloads on AWS: use... og:url: https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b og:image: https://api.daily.dev/og/posts/cWtX45y7b.png og:image:alt: 12 Things You Should (and Shouldn't) Do in AWS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 12 Things You Should (and Shouldn't) Do in AWS **[Planet Python](https://daily.dev/sources/planetpython)** · [@mkennedy](https://daily.dev/mkennedy) · 112 min read · 0 upvotes · 0 comments ## Summary An AWS consultant who has spent fifteen years fixing outages walks through twelve practical dos and don'ts for running production workloads on AWS: use infrastructure as code instead of hand-provisioning, always review Terraform plans before applying, prefer IAM roles over access keys, avoid wildcard permissions, assume leaked credentials are compromised immediately, keep backend resources in private subnets, segment security groups, use SSM Session Manager instead of a bastion host, treat servers as disposable containers rather than hand-tuned pets, learn CloudWatch cost-consciously, build a deployment pipeline, keep S3 private behind CloudFront with signed URLs, and use Cost Explorer with budgets and tagging. The conversation also covers safely giving AI agents access to infrastructure and databases (read-only tool calls, human-approved writes, pointing agents at a data lake instead of production), WAF strategies against DDoS and bots, and the guest's Cloud War Games platform for simulating outages so teams practice incident response before a real 3am crisis. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Should I use AWS access keys or IAM roles for my EC2 instances and Lambda functions? IAM roles are recommended over access keys. Roles get attached directly to the service (an EC2 instance or a Lambda), so when the service runs it automatically has the permissions the role grants, eliminating key material that can leak or get committed accidentally. Access keys, by contrast, are long-lived secrets often mishandled in .env files or public repos, which has led to real incidents like thousands of dollars in fraudulent usage within minutes of a leak. _Developers hardening AWS permission models can find practical IAM guidance summarized on daily.dev._ ### Why shouldn't I let an AI coding agent have direct write access to my production database? Because an agent optimizing narrowly for 'solve the task' can take destructive shortcuts, such as renaming a database column by having Terraform delete the old database and spin up a new one in its place, wiping production data. The safer pattern is giving agents a read-only tool call, requiring human approval for any write, and pointing analytical queries at a separate data lake rather than the live production database to avoid both performance degradation and PII exposure. _Teams designing safe AI-agent workflows around databases track these guardrails on daily.dev._ ### What happened when AWS introduced an end-of-life fee for outdated database versions? In March, AWS began charging a past-end-of-life fee for database versions that customers had not upgraded, and clients who had not migrated were unexpectedly billed around four thousand dollars a month with no immediate explanation. The charge could be traced back to the specific outdated resource using AWS Cost Explorer, which lets you pivot across services, usage types, and tags to identify the source of a cost spike. _Engineers tracking unexpected AWS billing changes follow cost-management insights like this on daily.dev._ ## Similar posts on daily.dev - [10 Production Mistakes Developers Make When Building AI Apps on AWS](https://daily.dev/posts/10-production-mistakes-developers-make-when-building-ai-apps-on-aws-vc6i7ud8s) · Medium · 0 upvotes · 0 comments - [AI Coding Agent Horror Stories: The 13-Hour AWS Outage](https://daily.dev/posts/ai-coding-agent-horror-stories-the-13-hour-aws-outage-zosxjzyng) · Docker · 17 upvotes · 5 comments - [Learn Cloud Security Fundamentals in AWS – A Guide for Beginners](https://daily.dev/posts/learn-cloud-security-fundamentals-in-aws-a-guide-for-beginners-p744hpjg5) · freeCodeCamp · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#terraform](https://daily.dev/tags/terraform), [#iac](https://daily.dev/tags/iac), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"12 Things You Should (and Shouldn't) Do in AWS","url":"https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b"},"datePublished":"2026-08-19T19:50:20.787Z","dateModified":"2026-09-13T20:00:17.715Z","description":"An AWS consultant who has spent fifteen years fixing outages walks through twelve practical dos and don'ts for running production workloads on AWS: use...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ddd3f851354bc4a982d71e4771e8fd18?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ddd3f851354bc4a982d71e4771e8fd18?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Planet Python","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Person","name":"Michael Kennedy","url":"https://daily.dev/mkennedy","image":"https://media.daily.dev/image/upload/s--CAIUuwxP--/f_auto,q_auto/v1701901463/avatars/avatar_5Q1yteeM08cxesQG2actL","description":"Python enthusiast. Host of @talkpython and @pythonbytes podcasts, founder of Talk Python Training.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":30}},"commentCount":0,"discussionUrl":"https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,terraform,iac,iam","timeRequired":"PT112M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet Python","item":"https://daily.dev/sources/planetpython"},{"@type":"ListItem","position":3,"name":"12 Things You Should (and Shouldn't) Do in AWS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/12-things-you-should-and-shouldn-t-do-in-aws-cwtx45y7b#faq","mainEntity":[{"@type":"Question","name":"Should I use AWS access keys or IAM roles for my EC2 instances and Lambda functions?","acceptedAnswer":{"@type":"Answer","text":"IAM roles are recommended over access keys. Roles get attached directly to the service (an EC2 instance or a Lambda), so when the service runs it automatically has the permissions the role grants, eliminating key material that can leak or get committed accidentally. Access keys, by contrast, are long-lived secrets often mishandled in .env files or public repos, which has led to real incidents like thousands of dollars in fraudulent usage within minutes of a leak. Developers hardening AWS permission models can find practical IAM guidance summarized on daily.dev."}},{"@type":"Question","name":"Why shouldn't I let an AI coding agent have direct write access to my production database?","acceptedAnswer":{"@type":"Answer","text":"Because an agent optimizing narrowly for 'solve the task' can take destructive shortcuts, such as renaming a database column by having Terraform delete the old database and spin up a new one in its place, wiping production data. The safer pattern is giving agents a read-only tool call, requiring human approval for any write, and pointing analytical queries at a separate data lake rather than the live production database to avoid both performance degradation and PII exposure. Teams designing safe AI-agent workflows around databases track these guardrails on daily.dev."}},{"@type":"Question","name":"What happened when AWS introduced an end-of-life fee for outdated database versions?","acceptedAnswer":{"@type":"Answer","text":"In March, AWS began charging a past-end-of-life fee for database versions that customers had not upgraded, and clients who had not migrated were unexpectedly billed around four thousand dollars a month with no immediate explanation. The charge could be traced back to the specific outdated resource using AWS Cost Explorer, which lets you pivot across services, usage types, and tags to identify the source of a cost spike. Engineers tracking unexpected AWS billing changes follow cost-management insights like this on daily.dev."}}]} ```