  Amazon Web Services (AWS) is a comprehensive and broadly adopted cloud
provider, offering over 200 fully featured services, including compute,
database, storage, networking and content delivery, machine learning, Internet
of Things and many others. AWS SDKs provide access to AWS services through API
endpoints. However, incorrect use of these APIs can lead to code defects,
crashes, performance issues, and other problems.
  This paper presents automated static analysis rules, developed in the context
of a commercial service for detection of code defects and security
vulnerabilities, to identify deviations from AWS best practices in Python
applications that use the AWS SDK. Such applications use the AWS SDK for
Python, called "Boto3", to access AWS cloud services. However, precise static
analysis of Python applications that use cloud SDKs requires robust type
inference for inferring the types of cloud service clients. The dynamic style
of Boto3 APIs poses unique challenges for type resolution, as does the
interprocedural style in which service clients are used in practice. In support
of our best-practices goal, we present a layered strategy for type inference
that combines multiple type-resolution and tracking strategies in a staged
manner. From our experiments across >3,000 popular Python GitHub repos that
make use of the AWS SDK, our layered type inference system achieves 85%
precision and 100% recall in inferring Boto3 clients in Python client code.
  Additionally, we present a representative sample of eight AWS best-practice
rules that detect a wide range of issues including pagination, polling, and
batch operations. We have assessed the efficacy of these rules based on
real-world developer feedback. Developers have accepted more than 85% of the
recommendations made by five out of eight Python rules, and almost 83% of all
recommendations.
