Cloud best practices

1. The pillars #

A framework shared by all providers.

Overview #

These pillars are trade-offs to weigh, not boxes to tick: more resilience costs more, more security can slow down delivery. What matters is deciding consciously and documenting it.

2. Security and identity #

The shared responsibility model.

Least privilege and traceability #

aws sts get-caller-identity
aws iam generate-credential-report && aws iam get-credential-report --query Content --output text | base64 -d | head -3

# Politique minimale (exemple : lecture d'un seul bucket)
cat > policy.json <<'EOF'
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::rapports-prod/*" } ] }
EOF
aws iam create-policy --policy-name lecture-rapports --policy-document file://policy.json
aws cloudtrail lookup-events --max-results 5          # qui a fait quoi

• Mandatory MFA for humans, temporary roles for machines and CI.
• Encryption at rest (KMS) and in transit (TLS) by default; centralized, immutable audit logs.
• Private networks, restrictive security groups, no public object storage by default.

Common mistake: An access key published in a public repository is exploited within minutes. Enable secret scanning (gitleaks) and automatic rotation.

3. Resilience and Infrastructure as Code #

Everything is reproducible and backed up.

Infrastructure as Code #

terraform fmt -check && terraform validate
terraform plan -out=plan.tfplan && terraform apply plan.tfplan
tflint && checkov -d .                                  # qualité et sécurité de l'IaC

# État distant verrouillé
terraform {
  backend "s3" { bucket = "tfstate-prod"  key = "reseau/terraform.tfstate"  dynamodb_table = "tf-lock"  encrypt = true }
}

Resilience #

• Deploy across at least two availability zones; test the loss of a zone.
• Define the RTO (acceptable downtime) and RPO (acceptable data loss) and size backups and replication accordingly.
• Automate backups and test restores.

aws backup list-backup-plans
aws rds describe-db-instances --query 'DBInstances[].[DBInstanceIdentifier,MultiAZ,BackupRetentionPeriod]' --output table
aws ec2 describe-availability-zones --query 'AvailabilityZones[].ZoneName'

4. Costs and governance #

Staying in control over time.

Tagging and FinOps #

aws resourcegroupstaggingapi get-resources --tag-filters Key=env --query 'ResourceTagMappingList | length(@)'
aws budgets describe-budgets --account-id 123456789012
aws ce get-anomalies --date-interval StartDate=2026-10-01,EndDate=2026-10-18

Good practice: Set up automatic guardrails (policies, SCP, Azure Policy): forbid unauthorized regions, enforce encryption, block public resources.

Reference diagram and quick check #

Visualize the principle and check it from the command line.

Reference diagram #

aws elbv2 describe-target-health --target-group-arn <ARN> --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State]' --output table