Troubleshooting and Operational Best Practices
Troubleshooting is systematic: identify the layer (instance, network, storage, identity, application) and use the right tool. For connectivity, check security groups, route tables, NAT/SNAT, and SLB health checks in order. For performance, check CloudMonitor metrics, disk IOPS limits, and instance type. For access, check RAM policies and STS tokens. Logs from SLS and Cloud Assistant command output narrow the cause.
Best practices: least privilege, tagging for cost and ownership, snapshot/backup policies, monitoring and alerting with verified contacts, and IaC for reproducibility. Change management - test, stage, roll back - prevents incidents. Cost optimization (right-sizing, storage class lifecycle, reserved instances) is an operational concern.
Traps: jumping to a fix without isolating the layer; assuming a reboot fixes everything; ignoring that security group changes are near-instant but DNS changes have TTL; forgetting that a deleted resource may be unrecoverable (snapshots help). Also, an alarm without a runbook is incomplete.
Rule of thumb: "cannot connect" → check security group → route table → NAT/EIP → SLB health check → application port. Work outside-in.
Worked example: An app is unreachable from the internet: the ECS has no EIP, the route table lacks an internet gateway route, and the security group blocks port 443 - fix all three; each alone is insufficient.