Understand the shared responsibility model
AWS secures the underlying cloud infrastructure. You remain responsible for how your accounts, servers, data and network access are configured.
Protect the root account and enable MFA
Do not use the root account for daily work. Enable multi-factor authentication on the root account and on every IAM user, and store root credentials securely.
Use least-privilege access
Give each person and application only the permissions they need. Prefer IAM roles over long-lived access keys, and remove access promptly when people leave.
Restrict network exposure
Review security groups regularly. Avoid opening SSH, RDP or database ports to the whole internet. Use a VPN or bastion host for administrative access.
Turn on logging and cost alerts
Enable CloudTrail and keep logs for investigation. Set up billing alerts, since an unexpected cost spike is often the first sign of a compromised account.
Is Your IT Infrastructure Ready?
Get a basic IT Infrastructure Health Check and identify potential risks across servers, backup, security, monitoring and cloud infrastructure.
Request an IT Health Check