I'm doing just that (for a SaaS). 1. Build an AMI with Packer that contains Ubuntu + Docker + aws-cli. 2. Build and publish docker images for all the services

I'm doing just that (for a SaaS). 1. Build an AMI with Packer that contains Ubuntu + Docker + aws-cli. 2. Build and publish docker images for all the services that will run on the instances. (one image per service, not per environment like you suggested) 3. Configure the EC2 instance or AutoScaling Groups with userdata. The userdata usually just contains a `docker run ...` instruction. I used to have Chef, run test kitchen, bake AMIs, cycle all the machines. Now I have a single AMI and do most of the testing on the docker side and then some on staging. In both cases I am using terraform to manage the overall infrastructure (and userdata scripts). The only issue is how to manage secrets as userdata are readable with the DescribeInstance ACL. The best solution that I found is to upload the secrets on S3+KMS and use IAM Role on the machine to retrieve them. Or use Hashicorp Vault.