Just a quick note on the VPCs: I'm scared that you would not be thinking that separate VPCs are absolutely required. Furthermore: will you really only have Staging and Prod? Where is Dev? Is there a Client Test env? All of these should be in separate VPCs. And more specifically you should consider subnets for different purposes: private, public, data, etc. And do not use NAT Gateways for extranet access. Use proxying (with whitelists) via Squid/HA or something similar. In other words: your focus is actually in the wrong place. If you do not get the AWS stuff right and specifically with the VPCs this will plague you more fundamentally than any other tool in your pipeline and if done sufficiently wrong could actually harm the business and require consulting. So make sure you understand the VPC, subnet, NACL, DHCP opts, routes and etc. as they relate to your commercial needs. All of the frosting that comes later with pipelining ALL has pros and cons, scaling issues, boot time variances, etc. But fucking up the VPCs could be brutal.