Production Security Checklist
A practical checklist to harden your deployment before real users arrive.
Before you call a deployment production-ready, walk this checklist. Security is layered — no single item is enough alone.
Identity & access
- Use IAM roles, never long-lived access keys, on servers and pipelines.
- Grant least privilege — the minimum permissions each role needs.
- Require MFA on human accounts and lock away the root user.
Network & data
- Keep databases in private subnets, never publicly reachable.
- Open only required ports in security groups; restrict SSH to known IPs.
- Enforce HTTPS everywhere and encrypt data at rest.
Operations
- Store secrets in SSM / Secrets Manager, never in code.
- Turn on CloudTrail for an audit log of every API call.
- Set alarms and backups, and rehearse rollback and recovery.
Example
# Turn on CloudTrail so every API call is logged and auditable
aws cloudtrail create-trail \
--name org-audit \
--s3-bucket-name myorg-cloudtrail-logs \
--is-multi-region-trail
aws cloudtrail start-logging --name org-audit
# Confirm no IAM users have stale, unused access keys
aws iam generate-credential-reportWhen to use it
- A team runs AWS Trusted Advisor before going live and discovers three security groups with 0.0.0.0/0 on port 22 that must be locked down.
- An ops engineer enables CloudTrail in all regions before a security audit so every API call is logged for compliance purposes.
- A developer enables S3 block public access at the account level to prevent any bucket from accidentally being made publicly readable.
More examples
Block public S3 access account-wide
Blocks all public access to S3 at the account level, preventing any individual bucket from being made public.
aws s3control put-public-access-block \
--account-id 123456789012 \
--public-access-block-configuration \
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=trueEnable CloudTrail for all regions
Creates a multi-region CloudTrail that logs all API calls with file integrity validation for tamper detection.
aws cloudtrail create-trail \
--name org-audit-trail \
--s3-bucket-name my-cloudtrail-logs \
--is-multi-region-trail \
--enable-log-file-validation
aws cloudtrail start-logging --name org-audit-trailRestrict SSH to bastion IP only
Removes open-world SSH access and restricts port 22 to a single known bastion IP, reducing the attack surface.
# Remove broad SSH access
aws ec2 revoke-security-group-ingress \
--group-id sg-0abc123 \
--protocol tcp --port 22 --cidr 0.0.0.0/0
# Allow only the bastion host IP
aws ec2 authorize-security-group-ingress \
--group-id sg-0abc123 \
--protocol tcp --port 22 --cidr 203.0.113.5/32
Discussion