Access control is also something that gets overlooked, network security and centralized metrics, logging, alerting (personally not a fan of cloudwatch*, but it can get the job done).