LOG-005 // DEVOPS
PUBLISHEDDEVOPS2025-04-08·7 min read
Deploying on AWS: Lessons Learned
AWSDevOpsCloudInfrastructure
I've deployed several production applications on AWS over the past year. Here are the lessons that cost me the most time (and money) to learn.
Right-Sizing EC2 Instances
My first instinct was to start with a large instance "just in case." Wrong. Start with the smallest viable instance (t3.micro or t3.small) and scale up based on actual metrics. CloudWatch CPU and memory alarms will tell you when it's time.
S3 + CloudFront for Static Assets
Serving static files from your application server is a rookie mistake. Set up:
This alone reduced our p95 load times by 60%.
1.An S3 bucket for static assets (images, fonts, JS bundles)
2.A CloudFront distribution in front of it
3.Cache-Control headers with appropriate TTLs
4.Origin Access Identity to keep the S3 bucket private
This alone reduced our p95 load times by 60%.
Database Decisions
For Kosh, I chose self-managed PostgreSQL on EC2 over RDS. Why?
The tradeoff is operational burden. You're responsible for backups, failover, and upgrades. For a solo developer, this is manageable. For a team, RDS might be worth the premium.
—Cost — RDS is 2-3x more expensive for equivalent specs
—Control — Custom pg_hba.conf, extensions, and backup strategies
—Learning — Understanding database operations deeply
The tradeoff is operational burden. You're responsible for backups, failover, and upgrades. For a solo developer, this is manageable. For a team, RDS might be worth the premium.
Cost Optimization
AWS bills can spiral out of control. My rules:
—Reserved Instances for predictable workloads (40% savings)
—Spot Instances for batch processing and CI/CD runners
—S3 Lifecycle Policies to move old logs to Glacier
—NAT Gateway audit — these are silently expensive
—Monthly budget alerts at 50%, 80%, and 100% thresholds
Security Baseline
Every deployment gets:
—VPC with public/private subnets
—Security groups following least-privilege
—IAM roles (never access keys in code)
—SSL certificates via ACM
—Secrets Manager for environment variables
Final Thought
AWS is incredibly powerful but also incredibly complex. Start simple, measure everything, and only add complexity when you have a clear reason to.
NODE: LOG-005 // TYPE: ARTICLEWORDS: ~322