Discuss your project
Buyer guide

Questions to ask before an AWS deployment

Before deploying on AWS, settle what data the workload holds, its region, availability, access, cost, backups and who looks after it afterwards. Most cloud surprises come from one of those left open.

Published by Promatics Technologies Published Last reviewed 4 min read

The short answer

AWS secures its infrastructure; your share, once a hosting company's job, depends on the services you choose (shared responsibility). Settle seven questions:

  1. Data: what, how sensitive.
  2. Region: where it runs; do data or backups leave Nigeria?
  3. Availability: tolerable downtime and data loss.
  4. Identity: who gets access, how.
  5. Budget: expected cost; spotting overruns.
  6. Backups: what, where; restores tested?
  7. Ownership: who runs, patches, monitors, pays.

1. Data

  • Which records: customer, financial, health, documents, logs?
  • Personal data? The Nigeria Data Protection Act 2023 (NDPA) applies, and health data is sensitive personal data. Sector rules too, for example the Central Bank of Nigeria's for banks and payment service providers.
  • Customer, funder or regulator terms on storage location or access?
  • Volume today, growth and retention period?
  • Which logs hold personal data, readable by whom?

2. Region choice and data residency

AWS has no public cloud region in Nigeria. Options are a local data centre in Lagos or Abuja, or a region abroad: the nearest large ones are Africa (Cape Town), af-south-1, an opt-in region you must enable before use, and the European regions (AWS Regions). Check the current list before deciding. A region choice is about transfers, latency and cost; it does not, by itself, settle compliance:

Service availability

Is every service you plan to use available in that region?

Add-on tools

Monitoring, email delivery, content delivery or support tooling may process data in yet another country.

Backup copies

Do recovery copies go to another region, and in which country?

Hosting in Nigeria

NITDA guidelines, the Nigeria Cloud Computing Policy or CBN rules may require local hosting: then a local data centre.

Latency

Test from your offices and, for customer-facing systems, from mobile networks.

Processing outside Nigeria? Tell people, put contractual protections in place and check the NDPA's transfer rules. The NDPC publishes the Act and its implementation directive; organisations remain accountable for data transferred for processing. General information, not legal advice.

3. Availability

  • What does an hour, a day or a week down cost the business?
  • Recovery time objective (how long until it must be back) and recovery point objective (how much recent data you could lose)?
  • Multiple Availability Zones enough, or recovery in a second region?
  • Single points of failure: one database, one server, one person with the password?
  • The path to the cloud: grid outages or a single office internet link take users offline while AWS is healthy. Plan power backup and a second link.
  • Will you know it is down before customers tell you?

Higher availability costs more: set it from business impact, not habit.

4. Identity and access

Baseline: AWS's IAM best practices.

  • Federation with your identity provider (such as Microsoft 365 or Google Workspace) and temporary credentials, not long-lived IAM users?
  • MFA required, ideally phishing-resistant (passkeys, security keys)?
  • Root user: who holds it, how protected, when used?
  • Least privilege, with unused access reviewed and removed?
  • Separate accounts for production, testing and development, with guardrails?
  • Offboarding: AWS access removed when staff or contractors leave?

5. Budget

  • Monthly cost as estimates in US dollars with the naira equivalent, with assumptions (usage, storage growth, data transfer)? AWS bills in dollars, so exchange-rate movement is part of the budget.
  • Who gets budget alerts? AWS Budgets warns on actual or forecast spend, but AWS notes notifications can lag charges: not a hard cap.
  • Resources tagged by project, environment and owner?
  • A monthly bill review by someone who can switch things off?
  • Commitments or reserved capacity only once usage is stable?
  • How is the dollar invoice paid, and who in finance owns that?

Ongoing control: how growing companies cut cloud costs.

6. Backups and recovery

  • What is backed up, how often, for how long?
  • Managed centrally, for example with AWS Backup: backup plans, cross-Region and cross-account copies, a vault lock against deletion or retention changes?
  • Copies out of reach of a compromised administrator account?
  • Last restore test, and how long it took?
  • Configuration, infrastructure definitions and secrets recoverable too?

A backup never restored is an assumption; see backup and disaster recovery.

7. Ongoing ownership

  • Who owns the AWS account and billing relationship?
  • Who applies operating system, database and application updates?
  • Who watches alerts outside business hours, and what do they do?
  • Environment defined as code, so it can be rebuilt and reviewed?
  • Documentation: architecture, access, runbooks, recovery steps?
  • Design review date? The AWS Well-Architected Framework review covers reliable, secure, efficient, cost-effective and sustainable workloads.

Pre-deployment checklist

  • Data types, sensitivity and applicable data protection obligations documented.
  • Region chosen; every service and third-party tool checked for processing location.
  • Backup and disaster recovery locations confirmed, including which countries hold copies.
  • Recovery time and recovery point objectives agreed with the business.
  • Sign-in through federation, with MFA required; root user secured.
  • Separate accounts or environments for production and non-production.
  • Monthly cost estimate in US dollars and naira, budget alerts and tagging in place.
  • Backup plan configured and a test restore completed.
  • Monitoring and alert recipients defined, including outside business hours.
  • Named owners for the account, billing, updates and incident response.
  • Documentation and runbooks stored somewhere the team can reach during an outage.

Limitations

Not a full architecture review: regulated workloads, such as those of banks, payment service providers, insurers or health data custodians, have further requirements. Comparing options? The same questions work for other providers and local data centres.

Next step

Help answering these or reviewing an existing environment: AWS deployment and cloud engineering. Migration planning across providers: cloud services and migration.

Sources and further reading

Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.

  1. AWS Regions, Amazon Web Services documentation
  2. Shared Responsibility Model, Amazon Web Services
  3. Security best practices in IAM, Amazon Web Services documentation
  4. Managing your costs with AWS Budgets, Amazon Web Services documentation
  5. What is AWS Backup?, Amazon Web Services documentation
  6. AWS Well-Architected Framework, Amazon Web Services documentation
  7. Nigeria Data Protection Act, GAID 2025 and guidance, Nigeria Data Protection Commission

This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.

Talk to Promatics

Get a straight answer for your situation

General advice only goes so far. Tell us about your environment and we will tell you what we would do, what it would cost and what to watch out for.

  • A named specialist who owns the outcome, not a chat window
  • Advice checked against your actual systems, contracts and risks
  • Written scope and costs in NGN before any work starts
Talk to a specialist

Or call +234 702 509 0040

Guide

How to cut cloud costs

Cut cloud costs through visibility, waste removal, rightsizing, commitment discounts and better negotiations.