Command Palette

Search for a command to run...

Hectal
Phase 7Advanced8 of 9 in AWS

Production AWS

Secrets and encryption, DNS and CDN at the edge, a multi-account security baseline, and keeping the bill and the blast radius under control.

Everything so far builds a working system. This phase is about running it responsibly: keeping secrets out of code and data encrypted under keys you control, serving users fast and safely from the edge, structuring accounts so one mistake can't take down everything, detecting threats automatically, and knowing what your architecture costs and how it recovers when a whole region has a bad day.

0/4 · 0%
4 topics ~53 min 10 code blocks & diagrams
Start with the first topic
1
7.1

Secrets Manager, Parameter Store & KMS

Secrets belong in Secrets Manager or SSM Parameter Store, fetched at runtime through IAM — and KMS provides the encryption keys behind them and behind S3, EBS, and RDS, with key policies deciding who can decrypt.

13 min 1 diagram 2 code practice

2
7.2

Route 53, ACM & CloudFront

Route 53 turns your domain into the right endpoint with health-checked routing; ACM provides free, auto-renewing TLS certificates; CloudFront caches and serves content from edge locations near users while shielding your origins.

13 min 1 diagram 1 code practice

3
7.3

Multi-Account Strategy & Security Baseline

Production AWS uses many accounts under AWS Organizations as hard isolation boundaries, with SCP guardrails, centralized identity and logging, and threat detection from GuardDuty, Security Hub, and Config running everywhere by default.

13 min 1 diagram 2 code practice

4
7.4

Cost Optimization & Disaster Recovery

Controlling cost means visibility (tags, budgets, Cost Explorer), right-sizing, and buying compute the right way; resilience means choosing a disaster-recovery strategy by RTO and RPO — and actually testing it.

14 min 1 diagram 1 code practice