CLOUD: Best Practices for Creating AWS Cloud Applications at St. Thomas

When building applications in AWS, it’s important to follow consistent practices that improve security, reliability, and maintainability. The following guidelines apply to all developers working with cloud resources in our environment.

Remember:

• If it’s not in Git, it doesn’t exist!
• Automation is Confidence. Anything else is just hope.

Following these practices ensures our cloud applications are secure, maintainable, and scalable.

1. Infrastructure as Code, Not ClickOps

• Do: Use GitOps workflows and Infrastructure as Code (IaC) tools such as AWS CDK, Terraform, or CloudFormation.
• Don’t: Manually create resources through the AWS Console (ClickOps) except for MINOR sandbox experimentation.
• Why: Code-driven infrastructure ensures environments are reproducible, version-controlled, and reviewable via pull requests.

2. GitOps Workflow

• All changes to AWS application infrastructure should go through Git.
  • Don't: upload Lambda code manually via ZIP, sam deploy, or through the AWS console.
• Use Pull Requests for review and automated pipelines for deployment.
• Enforce approvals to ensure changes are peer-reviewed and auditable.

3. Resource Naming Conventions

• Follow org-wide naming conventions for AWS resources (e.g., app-env-service-resource).
• Consistent names make it easier to search, automate, and troubleshoot.

4. Security First

• Always use least privilege IAM roles rather than permanent access keys or overly permissive policies such as Actions: lambda:* or Resource: *.
  • Application stacks should utilize scoped down service and execution roles and not AWS-managed policies.
• Store secrets in AWS Secrets Manager or SSM Parameter Store – never in code, Git, or environment variables.
• Enable encryption at rest (KMS) and in transit (TLS) by default.

5. Networking and Access

• Deploy applications into VPCs with properly segmented subnets.
• Restrict inbound/outbound rules in Security Groups to only what’s required.
• Utilize Amazon Cognito to provide SSO integrations.

6. Observability

• Enable structured logging and centralize logs with CloudWatch Logs.
• Set up metrics and alarms for critical resources.
• Use distributed tracing (e.g., AWS X-Ray) for debugging.

7. Cost Awareness

• Tag resources with Creator, Owner, CostCenter, Name, etc., as outlined in the St. Thomas tagging policy.
• Use budgets and cost anomaly detection where applicable.
• Choose right-sized instances and use managed services where possible.
• Use conditionals in templates to reduce the creation of unnecessary resources (such as CloudWatch Alarms and Dashboards) in non-production environments.

8. Deployment Best Practices

• Prefer managed services (Lambda, DynamoDB, CodeBuild, ECS/Fargate) over self-managed EC2 instances, Beanstalk, or containers.
• Automate deployments via CI/CD pipelines (CodePipeline, GitHub Actions, GitLab CI).
• Enable blue/green or canary deployments to minimize downtime.

9. Compliance & Governance

• Use AWS Organizations and Service Control Policies (SCPs) for guardrails.
• Run automated security checks with tools like AWS Config, Security Hub, and IAM Access Analyzer.
• Ensure compliance with organizational standards (e.g., data classification, logging retention).

10. Continuous Improvement

• Regularly review applications for security, cost, and reliability improvements.
• Keep IaC modules, CI/CD workflows, and dependencies up to date.
• Share learnings and reusable patterns in the St. Thomas developer community.

Ready-to-Use Templates

As mentioned at the top of this article, you do not need to start from scratch, as we have already done much of the work for you.

• St. Thomas provides an easy-to-install, easily configurable development environment that will quickly get you up and running with Node, Python, Git, AWS CLI, and more.
• We also utilize a feature-rich Serverless Application Model (SAM) framework with templates and starter code that implements security, monitoring, testing, pipelines, tagging, and advanced automation.

Resources and Assistance

For assistance in utilizing Ready-To-Use templates, implementation standards, and architectural reviews, please do not hesitate to contact the Enterprise Application and Cloud Development team using the Request a Service form on the Developer and Cloud Tools service page. We are happy to provide guidance and training for cloud development. 

• CLOUD: AWS Resource Tagging Policies at St. Thomas
• CLOUD: Principle of Least Privilege
• AWS Well-Architected Framework (Learn about architectural best practices for designing and running workloads on AWS)
• AWS Trust Center (Learn about Security, Compliance, Data protection, and more at AWS)
• AWS Infrastructure as Code (IaC) (AWS Documentation)
• AWS CloudFormation best practices (AWS Documentation)
• CLOUD: Continuous Integration/Continuous Deployment (CI/CD)
• GIT: GitOps for Workflow and Deployment Automation