Building a Compliance-First Web Application in af-south-1

The first decision on this engagement wasn't EC2 versus Lambda — it was which AWS region. af-south-1 (Cape Town) over a US or EU region, driven by data residency and latency for African users rather than a technical preference.

Encrypt everything, then justify why

KMS encryption on both EBS and RDS was a default I brought to the table, not a line-item the client asked for. For a workload handling customer data in a region with tightening data protection expectations, encryption at rest is cheap insurance against a much more expensive conversation later. The honest cost is more key management and a slightly larger IAM policy surface to get right.

Why ElastiCache sits where it does

Session and lookup data caching was added because, during the assessment, the same replicated data getting hit by every EC2 instance across both AZs was the actual bottleneck — not the web tier itself. The cache went in because the numbers said so, not because it's a default I reach for on every build.

Detection, not just prevention

AWS WAF and Shield stop known bad traffic at the edge. GuardDuty, CloudTrail, and AWS Config exist because prevention eventually fails, and the real question becomes how fast you notice. Continuous configuration monitoring through Config catches drift — a security group opened "temporarily" and never closed — that a one-time review would miss entirely.

A security group is a policy decision. AWS Config is the thing that notices when someone quietly changes it.

What the assessment actually validated

The infrastructure assessment before this build wasn't a formality — it's where both the region choice and the ElastiCache decision came from. That's the part of the Well-Architected Framework that's easiest to skip under deadline pressure, and the most expensive to skip in practice.