Checklists & Discovery Questions

Checklists & Discovery Questions

Things MCP documentation doesn't tell you - context-dependent questions, trade-offs, and validation points.

Architecture Discovery Questions

Ask these before designing:

Tech Stack Context

• What language/runtime does the team prefer? (Node, Python, Go, Java, etc.)
• What IaC tool is the team using? (Terraform, CDK, Serverless, SAM, etc.)
• Is there an existing project to integrate with?
• What's the deployment pipeline? (GitHub Actions, GitLab CI, CodePipeline, etc.)
• Any framework preferences? (Express, FastAPI, NestJS, etc.)

Business Context

• What problem are we solving?
• Who are the users? (internal, external, B2B, B2C)
• What's the expected timeline?
• What's the budget range?
• Are there existing systems to integrate with?

Non-Functional Requirements

• Availability target? (99.9%? 99.99%?)
• Latency requirements? (p50, p99)
• Throughput expectations? (RPS, concurrent users)
• Data retention requirements?
• Disaster recovery requirements? (RTO, RPO)

Constraints

• Regulatory compliance? (HIPAA, PCI-DSS, GDPR, LGPD)
• Data residency requirements? (specific regions)
• Existing technology mandates?
• Team skills and experience?
• Vendor lock-in concerns?

Growth & Scale

• Expected growth rate?
• Peak vs average load ratio?
• Seasonal patterns?
• Multi-region needs now or future?

Pre-Production Checklist

Before going live:

Security

• All secrets in Secrets Manager or Parameter Store
• IAM roles follow least privilege
• No hardcoded credentials anywhere
• Encryption at rest enabled (S3, RDS, EBS, DynamoDB)
• Encryption in transit (TLS 1.2+)
• VPC endpoints for AWS services (if private)
• Security groups reviewed (no 0.0.0.0/0 on sensitive ports)
• WAF configured (if public-facing)
• CloudTrail enabled
• GuardDuty enabled

Observability

• CloudWatch alarms on key metrics
• Dashboards for operations team
• Log aggregation configured
• X-Ray tracing enabled (if applicable)
• Error alerting to on-call

Reliability

• Multi-AZ deployment
• Auto-scaling configured
• Health checks defined
• Backups automated and tested
• Runbooks documented
• Incident response plan exists

Cost

• Budget alerts configured
• Cost allocation tags applied
• Right-sizing reviewed
• Reserved capacity evaluated (if steady-state)
• Unused resources cleaned up

Operations

• CI/CD pipeline tested
• Rollback procedure documented
• Database migration strategy defined
• Feature flags for risky changes
• Load testing completed

Security Review Checklist

IAM

• No * in resource ARNs (be specific)
• No * in actions (use specific actions)
• Conditions used where possible (IP, MFA, tags)
• Service roles scoped to specific resources
• Cross-account access uses external ID
• Permission boundaries for delegated admins

Network

• Private subnets for databases and app servers
• NAT Gateway for outbound from private subnets
• VPC Flow Logs enabled
• Security groups: ingress from specific sources only
• NACLs as backup layer (if needed)
• No public IPs unless required

Data

• PII identified and protected
• Encryption keys customer-managed (if required)
• Backup encryption enabled
• Cross-region replication encrypted
• S3 Block Public Access enabled
• S3 bucket policies reviewed

Application

• Input validation on all user input
• Output encoding for XSS prevention
• CORS configured correctly
• Rate limiting implemented
• Authentication tokens validated properly
• Session management secure

Logging & Monitoring

• No sensitive data in logs
• Log retention configured
• Security events trigger alerts
• Failed login attempts monitored
• API throttling monitored

Cost Optimization Review

Compute

• Right-sized instances (CPU, memory utilization <70%?)
• Spot instances for fault-tolerant workloads
• Savings Plans or Reserved Instances for steady-state
• Lambda memory optimized (power tuning)
• Graviton (ARM) considered for compatible workloads

Storage

• S3 lifecycle policies (transition to IA, Glacier)
• EBS volumes right-sized
• Unused EBS snapshots cleaned
• S3 Intelligent-Tiering for unknown access patterns

Database

• Right-sized instance class
• Reserved capacity for production
• Aurora Serverless v2 for variable workloads
• DynamoDB on-demand vs provisioned evaluated
• Read replicas only if needed

Network

• NAT Gateway usage minimized (expensive!)
• VPC endpoints for high-volume AWS API calls
• CloudFront for static content (reduce origin load)
• Data transfer between regions minimized

General

• Unused resources identified and removed
• Cost anomaly detection enabled
• Tagging strategy for cost allocation
• Regular cost reviews scheduled

Trade-offs to Discuss

IaC Tool Selection

Serverless vs Containers

SQL vs NoSQL

Single-Region vs Multi-Region

Managed vs Self-Managed

Common Pitfalls

Architecture

• Designing for scale you don't have yet (over-engineering)
• Not designing for the scale you will have (under-engineering)
• Ignoring operational complexity
• Choosing technology based on hype, not fit

Security

• Overly permissive IAM policies "to make it work"
• Forgetting to rotate credentials
• Not enabling encryption "because it's internal"
• Security groups with 0.0.0.0/0 "temporarily"

Cost

• Leaving dev/test resources running
• Not using Savings Plans for production
• NAT Gateway for everything (expensive!)
• Oversized instances "just in case"

Operations

• No runbooks before production
• No alerting until something breaks
• No load testing until launch
• No rollback plan