Capstone — the cloud guardrail checklist

At a glance

Learning objectives

• Run the full cloud guardrail checklist on your own platform
• Turn each series lesson into a standing check with an owner
• Produce the four review outputs as evidence

What you need

• Your platform's IaC or an architecture description
• The series lessons 1-9 completed

Steps

1. Storage and query guardrails — an Athena workgroup with a per-query bytes-scanned limit, a nightly compaction job, and CloudWatch alarms on scanned bytes per hour. (from project-s3-glue-athena )
2. IaC baseline — S3 buckets with lifecycle + encryption, a Glue catalogue, IAM roles scoped to least privilege, and Athena workgroups with query limits. (from tpl-terraform-aws-data )
3. Compute guardrails — size Glue workers from data volume, not habit, use job bookmarks correctly, and avoid full-table reprocessing from catalogue mistakes. (from skill-aws-glue-reviewer )
4. Scan guardrails — read the scanned-bytes metric per query, apply partition projection for high-cardinality columns, and compact small files to cut per-request overhead. (from skill-athena-partition-advisor )
5. Warehouse guardrails — configure warehouses for different workloads, set up resource monitors for budget enforcement, and optimize auto-scaling for cost/performance. (from config-template-snowflake-warehouse )
6. Spend guardrails — attribute compute cost to a pipeline run, define a unit metric that resists regressions, and alert on cost-per-run rather than total spend. (from skill-cost-unit-economics )
7. Evidence — collect the four review outputs: architecture diagram (text), IAM findings, cost drivers, and reliability risks. (from agent-aws-architecture-reviewer )

Check yourself

• Every guardrail family has a live check — bytes-scanned limit and compaction on storage, task histograms on compute, credit caps and cost-per-run alarms on spend, least-privilege roles on IAM.
• The four review outputs (diagram, IAM findings, cost drivers, reliability risks) exist as artifacts from your last review pass.
• No agent or job in the account holds an admin role.

Worked example

- Athena workgroup with a per-query bytes-scanned limit
- A nightly compaction job
- CloudWatch alarms on scanned bytes per hour

Outputs:
- Architecture diagram (text)
- IAM findings
- Cost drivers
- Reliability risks

dev:        XSMALL, auto_suspend 60,  monitor_credits 100
staging:    MEDIUM, auto_suspend 300, monitor_credits 500
production: LARGE,  auto_suspend 600, monitor_credits 5000

Sourced from

• S3 → Glue → Athena
• Terraform AWS Data Platform
• AWS Glue Job Reviewer
• Athena Partition Advisor
• Snowflake Warehouse Configuration Template
• Cost Unit-Economics Reporter
• AWS Architecture Reviewer

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• A checklist without an owner rots — assign each guardrail family to a person or a pipeline.
• The reviewer never creates resources and requires human approval for any IAM recommendation — keep it that way.
• Guardrails are per environment — dev XSMALL with 100 credits is not a production config.

Production considerations

• Score each review against the 30-anti-pattern checklist so passes are comparable over time.
• Re-run the checklist quarterly and every time a new service joins the stack.

Diagram

cloud capstone checklist
   |
   |- storage: bytes-scanned workgroup limit, nightly compaction, alarms
   |
   |- compute: workers from data volume, bookmarks stable, catalog diffs
   |
   |- spend: env-sized warehouses, resource monitors, $/run alert
   |
   |- IAM: least privilege, short-lived SSO, no admin roles
   |
    --> evidence: diagram + IAM findings + cost drivers + reliability risks

Registry stats