AWS SDK Rules & Best Practices Summary

This is the index for the SDK Rules section. It condenses every checklist into one review sheet.

Each best practice below is a one-line rule that links to the full enumerated page behind it. Keep this open during code review and jump to the checklist the change touches.

How to Use This List

• Read top to bottom for a fast refresher, or use it as a router: pick the category the change touches and open its checklist.
• Groups run roughly in order of impact, credentials and least privilege first, then errors, cost, cleanup, and cross-cutting habits.
• Every rule holds identically for boto3 and AWS SDK for JavaScript v3.
• If you only read two pages, read the authentication checklist and the error-handling checklist.

A - Credentials & Authentication

• Never hardcode credentials. Let the SDK's default chain resolve them from environment, config, or IAM roles so secrets stay out of code and history.
• Prefer roles over long-lived keys. Attach an IAM role on EC2, ECS, and Lambda for temporary, auto-rotated credentials.
• Keep credentials out of logs. Never print the credential object, the Authorization header, or secret values.
• Rotate leaked keys immediately. Treat any exposed key as compromised: deactivate, confirm, delete, investigate.

Full detail: Authentication & Credential Rules Checklist.

B - Error Handling & Retries

• Catch typed errors, not bare exceptions. Handle ClientError with a code in boto3 and typed exception classes in SDK v3.
• Classify retryable vs terminal. Retry throttling and transient 5xx; do not retry validation or access-denied errors.
• Retry only idempotent operations. Make writes idempotent with a client token before retrying them.
• Bound retries and log the request id. Cap max_attempts / maxAttempts, and capture the request id on every failure.

Full detail: Error Handling & Retry Rules Checklist.

C - Cost-Aware Usage

• Batch and paginate instead of looping. Prefer batch operations and built-in paginators over one call per item.
• Kill tight polling loops. Use waiters, events, and SQS long polling instead of busy-polling a status.
• Right-size data transfer. Filter server-side, project only needed fields, and stream large payloads.
• Measure and alarm on spend. Tag resources, watch request metrics, and set a budget alarm.

Full detail: Cost-Aware SDK Usage Rules.

D - Cleanup & Teardown

• Release response streams. Read or close body streams so sockets return to the connection pool.
• Manage client lifecycle. Reuse one client; call destroy() on a v3 client you are done with; init clients outside the Lambda handler.
• Tear down what you create. Delete resources in reverse dependency order and make teardown idempotent.
• Prefer automated teardown. Use lifecycle rules, TTLs, and IaC stack destroys over hoping code cleans up.

Full detail: Resource Cleanup & Teardown Rules.

E - Security

• Grant least privilege. Scope each role to the exact actions and resource ARNs the code calls, never a wildcard.
• Handle secrets safely. Keep non-role secrets in a secret manager, fetch at runtime, and rotate them.
• Secure the supply chain. Scan and pin dependencies, including the SDK, and keep it reasonably current.
• Protect data and validate input. Enforce TLS and encryption, and validate any user input that becomes a request parameter.

Full detail: Security Rules for SDK-Calling Services.

F - Where to Start

• Read the reasoning first. Why AWS SDK Rules Exist explains the cost, security, and reliability failure modes behind every rule.
• Use the map. The AWS SDK Rules Quickstart gives the five starter habits and points to each checklist.
• Apply one standard to both languages. Every rule holds for boto3 and AWS SDK v3, so a mixed Python and TypeScript codebase uses one review sheet.

FAQs

Related

• Why AWS SDK Rules Exist - the failure modes behind every rule.
• AWS SDK Rules Quickstart - the five starter habits and the reading order.
• Authentication & Credential Rules Checklist - the highest-impact checklist.
• Security Rules for SDK-Calling Services - least privilege, secrets, and dependency scanning.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).