What it covers
- Least privilege — Instance roles, scoped policies, no static keys in repos or env files.
- Pipelines — Build → deploy → health check → rollback, with the check following redirects.
- Right-sizing — EC2/ECS, S3, SES, Parameter Store or Vercel — sized for what you run, not for a diagram.
- Runbooks — Numbered, click-by-click, with 'done when' checks — no secrets inside.
How we work
Infra changes are proposed in writing, applied in a maintenance window and verified with a behavioural test.
