Amazon Web Services

AWS from a self-hoster’s point of view: the few services worth using for a VPS, off-site backups, DNS and cost control, and the pitfalls that generate surprise bills. For generic CLI usage see AWS CLI; to compare providers see Cloud-Provider Comparison.

Documentation: AWS CLI Command Reference · AWS Free Tier · Terraform AWS provider (see Terraform)

Verification: flag names were checked against the AWS CLI reference pages and prices against the AWS pricing pages (November 2026). No command was run against an account. Prices and free-tier terms change often, so check the pricing pages before relying on a figure. Items marked (unverified) were not confirmed.

Services a Self-Hoster Uses #

Free Tier #

• New accounts get a Free plan: $100 of credits, with up to $100 more for exploring services. It ends after 6 months or when the credits run out. The Paid plan gets up to $200 of credits. Source: AWS Free Tier.
• Older accounts may still be on the previous 12-month model. Check the Billing console for which applies.
• Always set a budget (below) even on the Free plan.

EC2 #

Security Groups #

Never open SSH or admin ports to 0.0.0.0/0. Use a VPN such as WireGuard or Tailscale instead.

Snapshots and Backups #

S3 #

Lifecycle rule moving backups to Glacier Instant Retrieval after 30 days and deleting after a year (lifecycle.json):

{
  "Rules": [
    {
      "ID": "age-out-backups",
      "Status": "Enabled",
      "Filter": { "Prefix": "backups/" },
      "Transitions": [{ "Days": 30, "StorageClass": "GLACIER_IR" }],
      "Expiration": { "Days": 365 }
    }
  ]
}

Use S3 as a backup target with restic or rclone.

IAM for a Backup User #

Create one user per purpose with only the access it needs. A policy limited to one bucket (BUCKET is a placeholder), adapted from the AWS S3 example policies:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::BUCKET"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::BUCKET/*"
    }
  ]
}

To stop a backup tool deleting its own history, omit s3:DeleteObject and rely on lifecycle rules.

DNS (Route 53) #

Cost Control #

Pitfalls #

See Also #

• AWS CLI
• Cloud-Provider Comparison
• What is Cloud-Computing?
• Terraform
• restic