Best Practices Library
A curated collection of frameworks, methodologies, and principles for modern software engineering and migration.
A set of cloud design principles and check-lists for building secure, high-performing, resilient, and efficient workloads on AWS.
Microsoft’s five-pillar guidance (reliability, security, cost, performance, ops) for designing and operating workloads on Azure.
Prescriptive guidance covering reliability, cost, performance, security, and operational excellence for GCP workloads.
The CNCF’s formal definition of cloud-native computing and core principles for micro-services, containers, and dynamic orchestration.
Twelve practical guidelines for building modern, portable, cloud-ready web applications.
Codified principles (error budgets, toil elimination, SLIs/SLOs) for operating large-scale services reliably.
Research-backed metrics (deployment frequency, lead time, MTTR, change failure rate) for high-performing software teams.
Framework emphasising Culture, Automation, Lean, Measurement, and Sharing as pillars of DevOps success.
Declarative, verifiable and automated operations — using Git as the single source of truth for infra and apps.
Incrementally replacing legacy systems by routing new functionality to a new service while ‘strangling’ the old.
Operating two identical production environments to achieve zero-downtime releases and quick rollbacks.
Progressively rolling out new software to a small subset of users to minimise risk before full release.
The ten most critical web application security risks; updated community consensus.
Guidelines for secure software development practices across the SDLC (SP 800-218).
End-to-end integrity guarantees for software supply-chain; defines levels 1-4.
Lightweight Bill-of-Materials standard for software components, vulnerabilities, and licenses.
Best practices for securing Terraform, CloudFormation, and ARM templates in CI/CD pipelines.
Baseline, restricted, and privileged policy levels for securing pod workloads.
Guidance on building, shipping, and running secure cloud-native applications.
Best practices for generating consistent traces, metrics, and logs using OpenTelemetry.
Standard approaches for selecting golden signals (Rate-Errors-Duration / Utilisation-Saturation-Errors).
Core performance metrics (LCP, FID, CLS, INP) for measuring real-world user experience.
A checklist covering operability, reliability, deployability, and observability of micro-services.
Domain-oriented, self-serve data infrastructure principles promoting product thinking for data.
Community conventions for naming, structuring, and documenting dbt transformation projects.
Opinionated REST and gRPC design rules: resource-oriented URIs, plural nouns, pagination, errors.
Cross-company REST consistency rules (nouns, verbs, versioning, errors).
Backwards-compatible evolution strategy and pinned versions for API consumers.
Consistent MAJOR.MINOR.PATCH versioning rules for APIs and packages.
Machine-readable Git commit messages enabling automated changelogs and semantic releases.
Branching strategy promoting short-lived branches, frequent commits to trunk, and feature flags.
Operational guidelines for creating, managing, and retiring feature toggles safely.
Encourages earlier testing (unit, security, performance) in the SDLC to catch defects sooner.
Consumer-driven contract testing methodology to ensure micro-service compatibility.
Run controlled experiments to build confidence in system resilience under turbulent conditions.
Shared responsibility model for cloud spend: Inform, Optimize, Operate phases.
End-to-end practices merging agile, DevOps, and design thinking for cloud transformation.
Scaled Agile Framework’s model for continuous exploration, integration, deployment, and release on demand.
Industry baseline for information-security policies and management controls.
Guidelines to integrate trustworthiness considerations into the design, development, and deployment of AI systems.
First comprehensive regulatory framework for trustworthy AI in the European Union.
Seven commitments guiding the ethical development and deployment of AI at Google.
Company-wide governance framework translating principles into measurable requirements.
Mitigation strategies (RLHF, red-teaming, tiered access) for large language model deployment.
Guidelines for writing reusable, versioned, and documented Terraform modules.
Recommendations for structure, naming, versioning, and values of Helm charts.
Steps to build minimal, non-root, signed container images with SBOMs.
Conceptual zero-trust model: continuous verification, least privilege, assume breach.
Framework embedding privacy into systems engineering from the outset.
Iterative roadmap for refactoring, re-platforming, and replacing legacy systems using automation and AI.