After one of my AWS accounts (with 2fa and an email I basically never used) was compromised I'm incredibly careful to expose services like this onto the public internet. What steps did you take to ensure the pipeline of your app to server endpoints was secure and in theory not vulnerable to someone traulling open ssh ports etc?