AWS Infrastructure
Setup Guide

AWS is the world's largest cloud platform — offering over 200 services across compute, storage, networking, databases, security, and AI. The flexibility that makes AWS powerful also makes it easy to build insecure, over-engineered, or unnecessarily expensive infrastructure if you do not follow a deliberate design process.

This guide walks through building a production-ready AWS environment using the Well-Architected Framework principles — security, reliability, performance efficiency, cost optimization, and operational excellence built in from day one, not bolted on afterwards.

1 Account Setup & Root Security

The AWS root account has unrestricted access to every resource and service in your account — including the ability to close the account, change billing details, and bypass all IAM policies. It must be treated like the most sensitive credential in your organization.

Root Account Hardening — Non-Negotiable Steps

1. Enable MFA on root account immediately — use a hardware MFA key (YubiKey) or TOTP authenticator app, not SMS
2. Create a strong root password (32+ characters) — store in a dedicated password vault, not a personal manager
3. Delete root access keys if they exist — go to IAM → Security Credentials → Delete Access Keys under root
4. Enable AWS Organizations — even for single accounts. Creates a management boundary and enables Service Control Policies (SCPs)
5. Create a separate admin IAM user for daily operations — never use root for routine tasks
6. Set billing alerts: go to Billing → Budgets → Create Budget — alert at 50%, 80%, and 100% of monthly budget
7. Enable AWS CloudTrail in all regions — logs every API call made in your account for audit and incident response
8. Enable AWS Config — tracks resource configuration changes and compliance over time

Multi-Account Strategy

2 VPC Design & Subnets

The VPC (Virtual Private Cloud) is your private network within AWS — defining IP address ranges, subnets, routing, and network access controls. A well-designed VPC is the foundation of everything that runs inside it.

Recommended VPC CIDR Design

Internet Gateway, NAT Gateway & Routing

Security Groups vs NACLs

• Security Groups: Stateful firewall at the instance level — preferred method. Allow rules only, deny is implicit. Changes apply instantly without disrupting existing connections
• Network ACLs: Stateless firewall at the subnet level — both allow and deny rules, evaluated in order. Requires explicit rules for both inbound and outbound (stateless)
• Recommendation: Use Security Groups as your primary control — they are more intuitive and cover 95% of use cases. Use NACLs only for broad subnet-level blocks (e.g., blocking an entire country IP range)

3 IAM Roles & Least Privilege

AWS Identity and Access Management (IAM) controls who can do what to which resources. Every access to AWS — human or machine — should follow the principle of least privilege: grant only the minimum permissions required to perform the task.

IAM Best Practices

• No long-lived access keys: Use IAM roles for EC2, Lambda, ECS tasks — the instance gets temporary credentials automatically via Instance Metadata Service
• Groups, not individual users: Attach policies to IAM Groups (Developers, DevOps, ReadOnly) and add users to groups — never attach policies directly to individual users
• MFA enforcement: Create an SCP or IAM policy that denies all actions except MFA management if MFA is not enrolled
• Permission boundaries: Set maximum permission boundaries on developer IAM roles to prevent privilege escalation
• Access Analyzer: Enable IAM Access Analyzer to identify resources shared externally and unused permissions

EC2 Instance Role Example

4 EC2 Instances & AMI Hardening

EC2 instances are the compute backbone of most AWS architectures. Selecting the right instance type, hardening the OS, and managing access securely are critical for both security and cost efficiency.

Instance Type Selection

EC2 Security Hardening Checklist

1. Disable root SSH login: PermitRootLogin no in /etc/ssh/sshd_config
2. Disable password SSH authentication — key pairs only: PasswordAuthentication no
3. Change SSH port from 22 to a non-standard port in Security Group and sshd_config
4. Enable automatic security updates: sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades
5. Install and enable UFW or firewalld as host-based firewall in addition to Security Groups
6. Enable AWS Systems Manager Session Manager — replace SSH with SSM for all admin access, no inbound ports needed
7. Enable CloudWatch Agent — collect system metrics (memory, disk) and application logs
8. Enable Amazon Inspector — automated vulnerability scanning of EC2 instances

5 RDS Database Setup

Amazon RDS provides managed relational databases — handling backups, patching, replication, and failover automatically. Proper configuration ensures high availability, security, and performance.

RDS Production Configuration

• Multi-AZ deployment: Always enable for production — automatic failover to standby in 60–120 seconds with no data loss
• Private subnets only: RDS instances must be in DB subnets with no route to internet gateway — never assign a public IP
• Encryption at rest: Enable KMS encryption at creation — cannot be enabled after the fact without snapshot restore
• Encryption in transit: Force SSL connections — set rds.force_ssl=1 parameter for PostgreSQL/MySQL
• Automated backups: Set retention to 7 days minimum, 35 days for compliance-sensitive data
• Parameter groups: Create custom parameter groups — never use default parameter groups in production
• Read replicas: Create read replicas for heavy reporting/analytics queries — offload from primary

RDS Security Group Configuration

6 S3 Buckets & Storage

Amazon S3 is the most versatile AWS storage service — used for static assets, application data, backups, log archives, and static website hosting. S3 misconfigurations have caused some of the largest data breaches in cloud history.

S3 Security Non-Negotiables

• Block All Public Access: Enable at the account level — go to S3 → Block Public Access settings for this account → Block all. This prevents any bucket from becoming public even if misconfigured
• Bucket versioning: Enable on all buckets containing important data — protects against accidental deletion and ransomware
• Server-Side Encryption: Enable SSE-S3 or SSE-KMS on all buckets — data encrypted at rest by default
• S3 Access Logs: Enable access logging on sensitive buckets — logs who accessed what and when
• Object Lock: Enable for compliance/backup buckets — prevents deletion for defined retention period even by admins
• Lifecycle policies: Automatically transition infrequently accessed data to S3 Glacier to reduce costs

S3 Lifecycle Policy Example

7 Load Balancer & Auto Scaling

Application Load Balancers (ALB) and Auto Scaling Groups (ASG) together provide the horizontal scalability and high availability that makes cloud infrastructure fundamentally different from on-premises servers.

Application Load Balancer Setup

1. Create ALB in public subnets across all AZs — set scheme to "internet-facing"
2. Create HTTPS listener on port 443 — attach SSL certificate from AWS Certificate Manager (free)
3. Create HTTP listener on port 80 — redirect to HTTPS with 301 permanent redirect
4. Create Target Group pointing to EC2 instances in private subnets
5. Configure health check path: /health — application must return HTTP 200
6. Enable access logs to S3 — essential for debugging and security analysis
7. Enable AWS WAF on ALB — protects against OWASP Top 10 attacks

Auto Scaling Group Configuration

8 Monitoring & Cost Optimization

AWS provides exceptional visibility into infrastructure health and costs — but only if you configure it. Default monitoring covers the basics; production environments need custom metrics, composite alarms, and cost allocation tags from day one.

CloudWatch Essential Alarms

• EC2 CPU Utilization: Alert at >85% sustained for 5 minutes — indicates under-provisioning
• RDS Free Storage Space: Alert when below 20% — databases that run out of storage crash immediately
• RDS CPU: Alert at >80% — indicates query optimization or instance upgrade needed
• ALB 5xx Error Rate: Alert when >1% of responses are 5xx — indicates application errors
• ALB Target Response Time: Alert when P99 latency >2 seconds — user experience degradation
• Billing: Alert at 50%, 80%, 100% of monthly budget — catch runaway costs early

Cost Optimization Quick Wins

• Reserved Instances / Savings Plans: Commit to 1-year for production workloads — saves 30–40% vs On-Demand pricing
• Graviton instances: Switch to ARM-based Graviton3 instances (m7g, c7g, r7g) — 20% cheaper AND faster than x86 equivalents
• S3 Lifecycle policies: Move old logs and backups to Glacier — typically saves 70–80% vs STANDARD storage class
• Right-sizing: Use AWS Compute Optimizer recommendations — many EC2 instances are significantly over-provisioned
• Delete unattached EBS volumes: Snapshots and unattached volumes silently accumulate costs — audit monthly
• Spot Instances: Use for stateless, fault-tolerant workloads (batch jobs, dev environments) — 70–90% cheaper than On-Demand