In using a self-signed certificate, you essentially face the same risks as a certificate authority. Mainly, you need to make sure your private key is kept secure. This is ensured using a number of methods.
Firsty, use a HSM (hardware security module) to store your private keys and perform encryption. Your cloud hosting provider may provide this service.
Secondly, the certificate you use for TLS encryption will typically be at the third level in a certificate chain. This stackexchange page, for example has a certificate chain like this:
DigiCert Root CA (25 years before expiry)
|
DigiCert Server CA (15 years before expiry)
|
*.stackexchange.com (1 year before expiry)
This makes it easy to rotate keys, before they get leaked or cracked, without having to regularly update the certificate store. Of course, since you have control over the certificate store, you can change the certificates as often as you like without need for such a chain.
Also, make sure you're always using the latest version of TLS.