Well, that was disappointing. Almost all 5 can be combined into one point: 'not configuring your security groups and firewall rules properly'.

I was hoping it had more about using EBS vs Instance Volumes, distributing instances properly across availability zones, proper way to do backups and launch new instances etc...