Recommendations when using the Cloud (draft)

General

We recommend Cloud accounts be integrated with the centralized billing and management offered by the University. Some benefits include integration with Active Directory for managing access, billing discounts, and improved visibility to our Office of Information Assurance (IT security).
Most Cloud services and resources can be accessed and managed programmatically. As you gain proficiency consider how treating "architecture as code" could be beneficial, e.g. automation and version control.
UCSD domain names can be assigned to Cloud servers but a static IP address must be associated with the Cloud resource. AWS uses the term "elastic IP address".

If you have access to the root user for your Cloud account it should be protected by a complex password and multi-factor authentication. Do not use the root account unless necessary.
All user identities with access to your Cloud account should be configured with multi-factor authentication.
Use the principle of least privilege to limit users to only the resources they need. Policies and Roles can be used to control which services users can access. Cloud providers may offer builtin job-function roles such as Developer, DBA, etc.

Cloud costs are typically based on usage so shut down services when not in use and delete data that is no longer needed.
Unless there is an architectural reason to do otherwise deploy services and resources to a single geographic region. It can be easy to forget where services have been spun up and get an unexpected bill.
Costs may vary depending on geographic region. Consider a balance of cost and distance when selecting a geographic region to deploy resources.
Create budget alerts to notify you when expenses exceed projections.
Downloading data from the Cloud (a.k.a. egress) usually incurs a cost. If you need to distribute a lot of data then an on-campus service may be a better choice.