AWS’s default VPC is ready out of the box, but none of its defaults are suitable for production. All IPs are interconnected, key pairs can be downloaded freely, and public IPs are assigned casually — failing to change these is equivalent to having no security groups at all.
This page serves as the execution checklist for Cloud Server Maintenance during the environment setup phase.
Network Design
| Item | Recommended Configuration | Description |
|---|---|---|
| Region & Availability Zones | Select based on user distribution; use at least 2 AZs | If users are in mainland China, choose a China region or Hong Kong/Singapore; if targeting overseas, select the nearest region. |
| VPC | Segment by business; use independent VPCs for different services | Do not cram all services into a single default VPC. |
| Subnets | Separate public and private subnets | Only place load balancers, gateways, and NATs in public subnets; keep applications and databases in private subnets. |
| Route Tables | Associate route tables with specific subnets; ensure clear traffic paths | The most common vulnerability is having all default routes point to the Internet Gateway (IGW). |
| NAT Gateway | Use for outbound traffic from private subnets; pay-per-use billing | Billed by data transfer volume; calculate costs for high-traffic scenarios. Watch out for Elastic IP fees when idle. |
Security Group Configuration Principles
Default Deny Inbound
Security group rules deny all inbound traffic by default; allow only what is necessary. Do not open port 22 to 0.0.0.0/0 just to save time — this is one of the most common entry points for intrusions.
Restrict SSH to Fixed IPs
If your office IP is static, configure the security group to allow only those IPs. If it is dynamic, use Session Manager or a bastion host instead of exposing port 22 directly.
No Public Access for Databases
Configure RDS security groups to allow access only from the security groups of application servers. Do not allow 3306 from 0.0.0.0/0.
Manage via Tags
Tag all resources with Environment, Service, and Owner. This significantly simplifies troubleshooting and automated operations later.
Keep Keys Off Disk
Use EC2 Instance Profiles or Secrets Manager to distribute credentials. Never write them into images or scripts. Once credentials enter an AMI, they are exposed to everyone.
Delivery Checklist
- VPC, subnets, and route tables implemented according to design
- Security groups configured with least privilege; ports minimized
- Key pairs and login methods properly configured (Session Manager recommended)
- Tagging system established
- Basic CloudWatch monitoring and alerts (CPU, memory, disk, network)
- Budget alerts and cost dashboards
- CloudTrail audit logging enabled
- Backup strategy and recovery verification
- Time synchronization (NTP) and basic security baseline
Frequently Asked Questions
Should we do everything at once or incrementally?
You can implement only what is currently needed, but there are two recommendations you should not skip: tightening security groups and setting up monitoring/alerts. These two areas have the highest rate of issues.
Can you help us with architecture design?
Yes, this is included in AWS Technical Support. The design will include cost estimates — AWS architectural decisions often impact the bill more than performance does.