Security Best Practices

A short checklist of habits that prevent the most common and damaging AWS security mistakes.

Most AWS security incidents come from a handful of avoidable mistakes. Building these habits early protects you as your usage grows.

Identity

  • Lock away the root user. Enable MFA on it and use it only for the rare tasks that require it.
  • Create individual IAM users or SSO identities for people; give applications roles, not access keys.
  • Apply least privilege and review permissions regularly.

Data

  • Encrypt data at rest (S3, EBS, RDS all support it) and in transit (TLS).
  • Block public access on S3 buckets unless you truly need it.
  • Enable versioning and backups for important data.

Network & detection

  • Keep databases and app servers in private subnets.
  • Restrict security groups to the ports and sources you actually need.
  • Turn on CloudTrail to log every API call, and use GuardDuty to detect threats automatically.

Example

Example · bash
# Block all public access on an S3 bucket
aws s3api put-public-access-block --bucket my-app-assets \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Turn on an account-wide CloudTrail trail
aws cloudtrail create-trail --name org-trail \
  --s3-bucket-name my-cloudtrail-logs --is-multi-region-trail
aws cloudtrail start-logging --name org-trail

When to use it

  • A security engineer enables GuardDuty in all regions and routes findings to a central Security Hub account for organization-wide threat visibility.
  • A team runs AWS Trusted Advisor to identify S3 buckets with public read access and IAM users with no activity in 90 days.
  • A company enables AWS Config with conformance packs to continuously audit all resources against CIS Benchmarks and get non-compliance reports.

More examples

Enable GuardDuty for Threat Detection

Enables AWS GuardDuty in the current region to start analyzing VPC Flow Logs, DNS logs, and CloudTrail for threats.

Example · bash
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES \
  --query 'DetectorId' \
  --output text

Enable CloudTrail for All Regions

Creates a multi-region CloudTrail trail with log file validation enabled so every API call in every region is recorded.

Example · bash
aws cloudtrail create-trail \
  --name org-audit-trail \
  --s3-bucket-name my-cloudtrail-bucket \
  --is-multi-region-trail \
  --include-global-service-events \
  --enable-log-file-validation

aws cloudtrail start-logging \
  --name org-audit-trail

Check for Public S3 Buckets

Checks the public access block setting for every bucket in the account, revealing which buckets may be publicly exposed.

Example · bash
aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | while read bucket; do
  STATUS=$(aws s3api get-public-access-block --bucket $bucket \
    --query 'PublicAccessBlockConfiguration.BlockPublicPolicy' \
    --output text 2>/dev/null || echo NONE)
  echo "$bucket: $STATUS"
done

Related

aws iam mfa least privilegeaws shared responsibility

Discussion

  • Be the first to comment on this lesson.