AWS Skills

# AWS Skills

Build, deploy, and optimize AWS infrastructure using CDK and modern patterns —
without overspending or overengineering.

## Keywords
aws, amazon web services, cdk, cdk v2, cloudformation, terraform, lambda, ec2,
s3, rds, dynamodb, sqs, sns, eventbridge, api gateway, cloudwatch, iam, vpc,
serverless, event-driven, well-architected, cost optimization, reserved instances,
savings plans, fargate, ecs, eks

## Core Truth

Most AWS bills are 60% bigger than they need to be. The pattern is consistent:
overprovisioned instances, unused load balancers, S3 buckets without lifecycle
policies, EBS volumes detached but billed, NAT gateways carrying single-AZ
traffic at $0.045/GB.

Architecture quality and cost are the same conversation. A bad architecture is
expensive; an expensive architecture is usually bad.

---

## 1. When To Use

- Designing new AWS infrastructure
- Reviewing existing infra for cost or reliability
- Writing CDK or CloudFormation
- Picking between Lambda, ECS, EC2 for a workload
- Diagnosing a high AWS bill
- Setting up CI/CD on AWS

## 2. Workload → Service Decision

| Workload | Use | Avoid |
|----------|-----|-------|
| < 15 min stateless requests | Lambda | EC2 (idle cost) |
| Long-running services | ECS Fargate | Lambda (timeout limit) |
| Spiky workloads | Lambda or Fargate Spot | Reserved EC2 |
| 24/7 high-volume | EC2 with Savings Plan | Lambda (cost) |
| Async work queue | SQS + Lambda | API Gateway (sync) |
| Pub/sub | EventBridge or SNS | SQS (point-to-point only) |
| Time-series data | Timestream or S3 + Athena | RDS |
| Global key-value | DynamoDB | RDS multi-region |

## 3. CDK Best Practices

- Use CDK v2 — v1 is end-of-life
- One stack per deployment unit
- Stacks should be < 200 resources (CloudFormation limit)
- Use constructs for reusable patterns
- Tag everything (Environment, Owner, CostCenter)
- Enable termination protection on production stacks
- Use `cdk diff` before every deploy

## 4. Cost Optimization Hit List

In order of usual impact:
1. **NAT gateways** — most overlooked. Use VPC endpoints for S3/DynamoDB.
2. **Idle load balancers** — $16/mo per ALB. Delete the dev ones.
3. **Detached EBS volumes** — fully billed. Snapshot and delete.
4. **Old snapshots** — accumulate forever. Set lifecycle.
5. **Right-sizing instances** — t3.large where t3.small fits.
6. **Lambda log retention** — defaults to "Never." Set to 7-30 days.
7. **S3 storage classes** — Glacier for archive, Intelligent-Tiering for unknown.
8. **Data transfer** — cross-AZ traffic is billed. Same-AZ is free.

## 5. Reliability Patterns

- **Multi-AZ for stateful services** — RDS, ElastiCache, OpenSearch
- **Stateless app tier** — easy to lose, easy to replace
- **Retries with exponential backoff + jitter** — not constant retry
- **Circuit breakers** — fail fast when downstream is sick
- **Dead letter queues** — for everything async
- **Idempotency** — at-least-once delivery is the AWS norm

## 6. Security Defaults

- Default-deny security groups
- IAM roles, not access keys, for EC2/Lambda
- Secrets Manager or SSM Parameter Store, never env vars in source
- S3 buckets private by default
- CloudTrail enabled in all regions
- GuardDuty enabled
- Encryption at rest on by default (KMS managed keys are fine)

## 7. Common Pitfalls

| Problem | Cause | Fix |
|---------|-------|-----|
| Surprise $10k NAT bill | Heavy S3 traffic through NAT | VPC endpoint for S3 |
| Lambda timeouts | Cold start + heavy init | Provisioned concurrency or smaller package |
| DynamoDB throttling | Hot partition key | Choose better partition key, or use adaptive capacity |
| CDK deploy fails on rollback | Resource locked by another stack | Find dependency, deploy in order |
| Permissions denied at runtime | IAM role missing permission | Use `aws iam simulate-principal-policy` |

## 8. Key Questions Before Starting

- What's the workload pattern — spiky, steady, or batched?
- What's the SLA — 99%, 99.9%, 99.99%?
- What's the team's comfort — serverless or container?
- What's the budget?
- Multi-region required?

## References
- `references/cdk-patterns.md` — Working constructs
- `references/cost-optimization-checklist.md` — Audit script
- `references/well-architected-summary.md` — Five pillars distilled