Security groups should describe relationships, not addresses
A rule written against a CIDR block encodes an accident of your current network. A rule written against another security group encodes what you actually meant.
Writing / tag
#aws
Articles carrying this tag.
Least privilege is a scheduling problem
Nobody argues against least privilege. It loses anyway, because a broad policy works in thirty seconds and a narrow one takes an afternoon, and the afternoon is never available.
Multi-AZ RDS is not automatically correct
It roughly doubles your database cost to buy a synchronous standby. Sometimes that is exactly the right purchase. Deciding it by default is how architecture reviews stop being reviews.