5.7 EC2 best practices

By Ravindra Bagale Last updated: 25 September 2026

Least privilege security groups: SSH (22) only from My IP; never open databases (3306, 27017) to 0.0.0.0/0.
Protect keys: chmod 400, one key per person/team, rotate when someone leaves. Never commit keys to Git.
Use IAM roles for instances instead of storing AWS access keys on the server.
Keep the OS patched: sudo yum update -y / sudo apt upgrade -y regularly.
Right-size: start small (t3.micro), monitor with CloudWatch, then scale up.
Tag everything: Name, Owner, Project, Environment — helps billing and clean-up.
Backups: EBS snapshots (automate with Amazon Data Lifecycle Manager) or AMIs.
Use Elastic IP or a DNS name for servers that need a fixed address.
High availability: production apps run in ≥ 2 AZs behind a load balancer.
Cost hygiene: stop idle instances; delete unattached volumes, old snapshots and unused EIPs; set AWS Budgets alerts.
Monitor: CloudWatch metrics and alarms (CPU, status check failures).