1. Devs don&#x27;t have to worry about security groups with `convox install &amp;&amp; convox deploy &amp;&amp; convox ssh`. But security groups are created with CloudFormation and you can use your AWS keys to introspect and change them.<p>2. Currently every app gets a Kinesis stream and we tail all Docker logs and put them into Kinesis. Then `convox logs` can stream logs from Kinesis, and `convox services add papertrail` adds a Lambda &#x2F; Kinesis event source mapping to emit the stream as syslog to Papertrail.<p>I&#x27;m pretty happy with this setup and think it represents a good default infrastructure that is still extensible.<p>Would Kinesis -&gt; Lambda -&gt; Sensu make sense too? It&#x27;s a pretty new pattern but this seems a lot saner to me than per-container log agents, or even bothering with custom logging drivers.<p>That said, one user has been using logstash by bringing a custom AMI with his logstash agent and creds baked in.<p>3. It&#x27;s one VPC per rack, but I could see modifying that. We&#x27;ve already started to parameterize some VPC settings like the CIDR block to help integrating with your existing VPC usage.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;convox&#x2F;rack&#x2F;blob&#x2F;master&#x2F;api&#x2F;dist&#x2F;kernel.json#L371" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;convox&#x2F;rack&#x2F;blob&#x2F;master&#x2F;api&#x2F;dist&#x2F;kernel.j...</a>