AWS Cloud Architecture for Startups

Choosing cloud infrastructure for a startup is a cost and complexity trade-off, not a technology preference. Here's the decision framework I use with early-stage teams.

1. A Single VPS Is Often the Right Starting Point

For most pre-product-market-fit startups, a single well-configured VPS environment (Hetzner, DigitalOcean, or a small AWS EC2 instance) running Docker Compose is enough:

• One server running app, database, and reverse proxy (Caddy or Nginx) with TLS
• Automated backups and a documented restore process
• Costs a fraction of a managed multi-service AWS setup
• No premature investment in infrastructure you don't yet need

A $20/month VPS that's actually monitored and backed up beats an elaborate AWS architecture nobody has time to operate properly at 2 AM.

2. When to Move to AWS (or Equivalent Managed Cloud)

• You need to scale horizontally across multiple instances behind a load balancer
• Compliance or enterprise customers require specific infrastructure guarantees
• You need managed databases (RDS), managed queues (SQS), or auto-scaling
• Your team has grown enough to own infrastructure as a dedicated concern

3. Core AWS Architecture Building Blocks

• ECS/Fargate for containerized services without managing raw EC2 fleets
• RDS (PostgreSQL) for managed database with automated backups and read replicas
• S3 + CloudFront for static assets and file storage with CDN delivery
• Application Load Balancer for traffic distribution and health checks
• CloudWatch for logs, metrics, and alerting

4. CI/CD: Build It Before You Need It

Regardless of VPS or AWS, a CI/CD pipeline should exist from the first production deploy — GitHub Actions running tests, building a Docker image, and deploying on merge to main. Manual deploys are the single biggest source of "it worked on my machine" production incidents.

on:
  push:
    branches: [main]
jobs:
  deploy:
    steps:
      - run: npm ci && npm test
      - run: docker build -t app:${{ github.sha }} .
      - run: ./deploy.sh

5. Security Baseline, Regardless of Scale

• Secrets in a secrets manager or environment variables — never committed to git
• Least-privilege IAM roles instead of broad admin credentials
• Cloudflare in front of any public-facing app for DDoS protection and WAF rules
• Automated OS and dependency patching on any self-managed VPS

Bringing It Together

Right-sized infrastructure is a competitive advantage for a startup — it means engineering time goes into the product, not into managing complexity you don't need yet. I help teams choose and build the infrastructure that matches where they actually are, with a clear path to what's next.

I'm Sandaruwan Jayasundara — Senior Software Engineer | Cloud & DevOps. See DevOps for full stack developers or get in touch about your infrastructure.