Is your AWS account secure? A plain-English checklist
Sooner or later, someone asks the question. It might be an insurance renewal form, a large customer's security questionnaire, or a board member who has read one too many headlines. "Is our AWS account secure?"
For a small team without a dedicated security person, that can be an uncomfortable question. The honest answer is usually "mostly, probably". This checklist will help you turn that into a confident yes, or at least a clear list of what to fix.
It isn't exhaustive. Formal standards such as the CIS AWS Foundations Benchmark have more than fifty checks. But the items below cover the problems we find most often, and the ones that cause the most damage when they go wrong.
Accounts and logins
1. The root user has multi-factor authentication (MFA), and nobody uses it day to day. The root user is the master key to your AWS account. It can do anything, including closing the account. It should have MFA turned on, its password should be stored somewhere safe, and it should almost never be used. Check the IAM dashboard: AWS shows a warning if root MFA is missing.
2. Every person has their own login, with MFA. Shared logins make it impossible to know who did what, and impossible to remove one person's access without disrupting everyone. Each person should have their own identity, ideally through IAM Identity Center, with MFA required.
3. People only have the access they need. It's common for everyone to be an administrator because it was easier at the time. Ask who really needs to change production systems. Most people need much less.
4. Old access keys are gone. Access keys are long-lived passwords for scripts and tools. In the IAM console, look at the "last used" column. Keys that haven't been used in months, or belong to people who've left, should be deleted today.
Data and storage
5. No storage bucket is public unless it's meant to be. Accidentally public S3 buckets are behind many well-known data leaks. Turn on S3 Block Public Access at the account level. If a website genuinely needs public files, serve them through CloudFront instead.
6. Data is encrypted at rest. Encryption for S3, EBS disks and RDS databases is usually a checkbox, and on newer resources it's often on by default. Check older resources, which were created before those defaults existed.
7. Backups exist, and you've tested restoring one. A backup you've never restored is a hope, not a plan. Confirm that your databases have automated backups enabled, and try restoring one to a test environment at least once a year.
Network
8. Databases and admin ports aren't open to the whole internet.
Look at your security groups for rules allowing traffic from 0.0.0.0/0 (meaning "anywhere"). That's fine for a public website on ports 80 and 443. It's not fine for a database port, or for remote administration ports like SSH (22) and RDP (3389).
9. Servers are patched. If your servers run operating systems you manage, someone needs to apply security updates regularly. AWS Systems Manager can report what's missing and apply patches on a schedule.
Visibility
10. CloudTrail is on in every region. CloudTrail records who did what in your account. Without it, you can't investigate an incident. Make sure a trail covers all regions, not just the one you usually work in, because attackers like the regions you never look at.
11. Someone gets alerted when something unusual happens. GuardDuty watches for suspicious activity, such as logins from unusual places or servers talking to known bad addresses. It's inexpensive and takes minutes to enable. Pair it with an email alert that a real person reads.
12. There's a budget alert. A sudden spike in spending is often the first visible sign that something has been compromised, such as someone using your account for cryptocurrency mining. A simple AWS Budget alert doubles as a security alarm.
Making it stick
If you found gaps, prioritize in this order: root MFA and old access keys first (they take minutes), then anything public that shouldn't be, then logging and alerts. The rest can be planned over the next few months.
Write down what you checked and when. When the next questionnaire arrives, you'll have the answer ready.
Want a formal answer? Our AWS Health Check scores your account against the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices, ranks every finding by risk, and includes a plain-English summary you can hand to leadership or an insurer.