Security groups should describe relationships, not addresses
A rule written against a CIDR block encodes an accident of your current network. A rule written against another security group encodes what you actually meant.
Writing / tag
#architecture
Articles carrying this tag.
Multi-AZ RDS is not automatically correct
It roughly doubles your database cost to buy a synchronous standby. Sometimes that is exactly the right purchase. Deciding it by default is how architecture reviews stop being reviews.