Cloud
Guardrails

Require lifecycle policy on S3 buckets for things like logs (1 yr deletion recommended)

Always

Require replication to another account for disaster recovery

When effective DR is required

Enforce a bucket pattern with versioning to prevent malicious tampering and facilitate recovery

All important data

Require S3 bucket replication to another account and region

When recovery is necessary

Configure automatic daily snapshots of RDS databases for backup purposes.

Always

Create a Cold account for copying in data that can't be deleted.

Applies if you have data that has to persist for business operation, regulatory or legal reasons.

Block delete calls on persistent data resources by default on IAM roles to avoid accidentally deleting all your data.

Always

Require DynamoDB to have a backup enabled for DR.

To all important data in DynamoDB