Security tooling is easy to buy and easy to ignore. The controls that change outcomes are unglamorous and mostly free. Before you have a security budget, put these five in place. On AWS, each one is roughly an afternoon of work.
The five controls
- MFA on the root account and on every person. The root user gets a hardware key and stays locked away. Everyone else signs in through IAM Identity Center with MFA, not through a shared IAM user. If you do only one thing on this list, do this.
- No long-lived access keys. Keys copied into laptops, CI variables, and wikis are hard to track and slow to revoke. Replace them with roles and short-lived credentials: OIDC federation for CI, instance and task roles for workloads.
- CloudTrail everywhere, stored in a separate account. Turn on an organisation-wide trail and send the logs to an archive account that nothing else can write to. When something odd happens, "what changed?" needs an answer nobody could have edited.
- Backups you have restored, and patching nobody does by hand. A backup is a hope until you restore it once under time pressure. Automate the backup and a scheduled restore test. Let the platform patch operating systems on a schedule, and read the report instead of the servers.
- One page that says who to call. A single document that states how to declare an incident, who is accountable, which outside parties to notify, and how to reach them. Write it before anything happens, with the people who would be woken up.
To find the keys to remove for control 2, start with a credential report:
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 -d
Every row with an active access key is a migration task.
Why this order
The first two close the front door, because stolen credentials are the simplest way into a cloud account. The third gives you a record. The fourth covers you when prevention fails. The fifth turns a bad night into a managed one.
Then build a cadence
Once the five are in place, security becomes a rhythm rather than a project:
- Monthly: review IAM changes and any new public endpoints.
- Quarterly: rerun the restore test and update the call sheet.
When that rhythm starts to feel slow, tooling starts to help, and you know which of the five it should speed up.
If you want to walk through these controls against your own accounts, book a short call with us.