Security Guardrails: MFA, CloudTrail, GuardDuty
Lock down the root account with MFA, record every API call with CloudTrail, and let GuardDuty and Security Hub watch for trouble so you do not have to stare at logs all day.
Good security on AWS is less about heroics and more about turning on the right always-on services and then leaving them on. Here is the baseline every serious account should have.
MFA, starting at the root
The root user can do anything, so it gets a hardware or virtual MFA device, and then you lock it in a drawer and never use it for daily work. Require MFA for every human identity too — you can even enforce it with a policy condition.
CloudTrail: the flight recorder
CloudTrail logs every API call — who did what, when, from where. Turn on a multi-Region trail that ships to a locked-down S3 bucket. When something goes wrong (or an auditor asks), this is the difference between an answer and a shrug.
Let the robots watch
- GuardDuty — continuously analyses CloudTrail, VPC Flow Logs and DNS for threats (crypto-mining, credential exfiltration, weird API calls). One click to enable, findings within minutes.
- Security Hub — aggregates findings and scores you against the AWS Foundational Security Best Practices and CIS benchmarks.
- IAM Access Analyzer — flags resources shared outside your account or organization.
Example
# Multi-Region CloudTrail that captures management events everywhere
aws cloudtrail create-trail \
--name org-audit-trail \
--s3-bucket-name acme-cloudtrail-logs \
--is-multi-region-trail \
--enable-log-file-validation
aws cloudtrail start-logging --name org-audit-trail
# Turn on GuardDuty in this Region (findings begin flowing immediately)
aws guardduty create-detector --enable
# Switch on Security Hub with the AWS best-practices standard
aws securityhub enable-security-hub \
--enable-default-standardsWhen to use it
- A company enables CloudTrail in all regions with S3 log file validation so any tampering with audit logs is detectable and attributable.
- GuardDuty automatically detects an IAM access key being used from an unusual country and sends a finding to Security Hub for triage.
- Security Hub aggregates findings from GuardDuty, Macie, and AWS Config across all accounts so the security team has a single compliance dashboard.
More examples
Enable CloudTrail Multi-Region
Creates a multi-region CloudTrail with tamper-evident log file validation so every AWS API call across all regions is audited.
aws cloudtrail create-trail \
--name org-trail \
--s3-bucket-name audit-logs-bucket-123 \
--is-multi-region-trail \
--include-global-service-events \
--enable-log-file-validation
aws cloudtrail start-logging --name org-trailEnable GuardDuty and Get Findings
Enables GuardDuty and queries for high-severity threat findings (score 7+) that need immediate investigation.
DETECTOR=$(aws guardduty create-detector \
--enable --query DetectorId --output text)
# After some time, list high-severity findings
aws guardduty list-findings \
--detector-id $DETECTOR \
--finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \
--query 'FindingIds' --output tableEnable Security Hub Standards
Enables Security Hub with default standards and adds the CIS AWS Foundations Benchmark for continuous compliance checking.
aws securityhub enable-security-hub \
--enable-default-standards
# Enable CIS AWS Foundations Benchmark
aws securityhub batch-enable-standards \
--standards-subscription-requests \
'[{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"}]'
Discussion