Your site is down. It's 3am. Is it a bug, a bill, or a breach? You can't tell yet, and everyone is watching you find out. Matt Lea has spent fifteen years being the person companies call when an outage is costing them real money per hour, and his whole argument is that everything you'd want in that moment gets decided months earlier, on ordinary afternoons, when someone chose the convenient thing. We walk his top twelve dos and don'ts in AWS - infrastructure as code, IAM roles instead of access keys, private subnets, no wildcards, no public buckets - and I push on which of them actually matter if you're one person on a small VPS. Then we get to Cloud War Games, where Matt breaks things on purpose so your team's first real incident isn't their first incident. Let's get into it. 
 
Episode sponsors 
 
<a href='https://talkpython.fm/sentry'>Sentry Error Monitoring, Code talkpython26</a>
<a href='https://talkpython.fm/course-certifications'>Talk Python Courses</a>
<a href='https://talkpython.fm/training'>Talk Python Courses</a> 
 
<h2 class="links-heading mb-4">Links from the show</h2>
<div>Guest 
Matt Lea: <a href="https://www.linkedin.com/in/schematical/?featured_on=talkpython" target="_blank" >linkedin.com</a> 
 
Talk Python Certificates: <a href="https://training.talkpython.fm/certificates" target="_blank" >training.talkpython.fm/certificates</a> 
 
Schematical: <a href="https://schematical.com?featured_on=talkpython" target="_blank" >schematical.com</a> 
CloudWarGames.com: <a href="https://cloudwargames.com?featured_on=talkpython" target="_blank" >cloudwargames.com</a> 
Zero to Hero on AWS Security: <a href="https://www.oreilly.com/videos/zero-to-hero/0642572107789/?featured_on=talkpython" target="_blank" >www.oreilly.com</a> 
Repo: <a href="https://github.com/schematical/sc-terraform/tree/main/_course?featured_on=talkpython" target="_blank" >github.com</a> 
Custom Wheel Offset: <a href="https://customwheeloffset.com?featured_on=talkpython" target="_blank" >customwheeloffset.com</a> 
2012 TechCrunch Disrupt Hackathon: <a href="http://techcrunch.com/2012/09/09/meet-the-disrupt-sf-2012-hackathon-winners-livebolt-takes-grand-prize-auctopus-and-heatdata-are-runners-up/?featured_on=talkpython" target="_blank" >techcrunch.com</a> 
tech comics: <a href="https://schematical.com/comics?featured_on=talkpython" target="_blank" >schematical.com</a> 
shhgit: <a href="https://github.com/eth0izzle/shhgit?featured_on=talkpython" target="_blank" >github.com</a> 
Zero Trust in 200ms: Implementing Identity-Per-Transaction: <a href="https://us.pycon.org/2026/schedule/presentation/140/?featured_on=talkpython" target="_blank" >us.pycon.org</a> 
Coolify: <a href="https://coolify.io/?featured_on=talkpython" target="_blank" >coolify.io</a> 
returned to full GA Nov 2025: <a href="https://aws.amazon.com/blogs/devops/aws-codecommit-returns-to-general-availability?featured_on=talkpython" target="_blank" >aws.amazon.com</a> 
Signed URLs/cookies: <a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-overview.html?featured_on=talkpython" target="_blank" >docs.aws.amazon.com</a> 
Cloudflare: <a href="https://www.cloudflare.com/?featured_on=talkpython" target="_blank" >www.cloudflare.com</a> 
Bunny Shield: <a href="https://bunny.net/shield/?featured_on=talkpython" target="_blank" >bunny.net</a> 
Cloud War Games One: <a href="https://www.youtube.com/watch?v=91z1pn7fEjM" target="_blank" >www.youtube.com</a> 
Cloud War Games Two: <a href="https://www.youtube.com/watch?v=xHXjiTi4nCA" target="_blank" >www.youtube.com</a> 
LinkedIn: <a href="https://linkedin.com/in/schematical?featured_on=talkpython" target="_blank" >linkedin.com</a> 
YouTube: <a href="https://youtube.com/schematical" target="_blank" >youtube.com</a> 
KnocKnoc: <a href="https://knocknoc.io?featured_on=talkpython" target="_blank" >knocknoc.io</a> 
 
Watch this episode on YouTube: <a href="https://www.youtube.com/watch?v=NTedSITJyRo" target="_blank" >youtube.com</a> 
Episode #559 deep-dive: <a href="https://talkpython.fm/episodes/show/559/12-things-you-should-and-shouldnt-do-in-aws#takeaways-anchor" target="_blank" >talkpython.fm/559</a> 
Episode transcripts: <a href="https://talkpython.fm/episodes/transcript/559/12-things-you-should-and-shouldnt-do-in-aws" target="_blank" >talkpython.fm</a> 
 
Theme Song: Developer Rap 
🥁 Served in a Flask 🎸: <a href="https://talkpython.fm/flasksong" target="_blank" >talkpython.fm/flasksong</a> 
 
---== Don't be a stranger ==--- 
YouTube: <a href="https://talkpython.fm/youtube" target="_blank" > youtube.com/@talkpython</a> 
 
Bluesky: <a href="https://bsky.app/profile/talkpython.fm" target="_blank" >@talkpython.fm</a> 
Mastodon: <a href="https://fosstodon.org/web/@talkpython" target="_blank" > @talkpython@fosstodon.org</a> 
X.com: <a href="https://x.com/talkpython" target="_blank" > @talkpython</a> 
 
Michael on Bluesky: <a href="https://bsky.app/profile/mkennedy.codes?featured_on=talkpython" target="_blank" >@mkennedy.codes</a> 
Michael on Mastodon: <a href="https://fosstodon.org/web/@mkennedy" target="_blank" > @mkennedy@fosstodon.org</a> 
Michael on X.com: <a href="https://x.com/mkennedy?featured_on=talkpython" target="_blank" > @mkennedy</a> </div>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

#559: 12 Things You Should (and Shouldn't) Do in AWS

Talk Python To Me

AI Chapters

AI Insights

Reviews