10 things they don't teach you about AWS

Sharing 10 AWS gotchas that I've picked up over the years.

1. Create SSL certificates in us-east-1. CloudFront's provisioning infrastructure is based there, so is only compatible with us-east-1 certificates.
2. IAM. May not be obvious to the newcomer: permissions are granted via statements in Policies, which are assigned to either Identities or Resources.
3. CloudFormation vs Terraform. CloudFormation features oddly sometimes lag behind Terraform, which uses AWS's API under the hood (not CloudFormation's).
4. Lambda deployment too big. Consider AWS Lambda Layers when your deployment package size has exceeded Lambda limits.
5. AWS Lambdas suffer from cold starts. Tackle it by reducing your package size. Also, you get at least the same amount of CPU in the init phase as in the handler. You get the init phase for very close to free, so move as much application code as possible outside of your handler function. Subsequent invocations can also reuse resources outside the handler.
6. SQS deliverability: Standard queues guarantee at least one delivery, FIFO queues attempt one delivery. Make sure your application code makes the correct assumptions/de-dupe as necessary.
7. AWS KMS is your friend. Use it to encrypt your keys.
8. AWS RedShift performance. RedShift queries perform a lot better with Distribution Keys. Set them up early.
9. AWS Cognito customisation. You can't customise AWS Cognito verification emails.
10. AWS Credits. Most accelerator programmes offer you AWS Credits. Join one and ask for them.