AWS Security Hardening Checklist for Startups and Growing Businesses

Most cloud security incidents come from a short list of mistakes: leaked credentials, over-permissive access and public resources nobody meant to expose. This checklist tackles them in priority order.

1. Protect the account itself

• Enable MFA on the root user, then stop using root for daily work.
• Use AWS IAM Identity Center (SSO) for people, so nobody needs long-lived access keys.
• Separate production from development with AWS Organizations and multiple accounts.
• Turn on AWS CloudTrail in all regions and send logs to a locked-down S3 bucket.

2. Apply least privilege

• Grant permissions to roles, not individual users, and scope policies to specific resources.
• Use IAM Access Analyzer to find unused permissions and resources shared outside your account.
• Rotate or remove any remaining access keys; prefer instance roles, task roles and OIDC for CI.

3. Lock down the network

• Keep databases and internal services in private subnets with no public IP.
• Restrict security groups to the ports and sources that are actually required — never open SSH or database ports to 0.0.0.0/0.
• Use Systems Manager Session Manager instead of SSH bastions.
• Put AWS WAF in front of public applications to filter common web attacks and bad bots.

4. Encrypt everywhere

• Enable S3 Block Public Access at the account level and encrypt buckets by default.
• Encrypt RDS, EBS and backups with AWS KMS keys.
• Serve everything over HTTPS with certificates from AWS Certificate Manager.

5. Detect and respond

• Enable Amazon GuardDuty for threat detection and AWS Security Hub for posture checks against benchmarks such as CIS.
• Route high-severity findings to email, Slack or your on-call tool.
• Write a simple incident runbook: who is contacted, how credentials are revoked, how evidence is preserved.

6. Secure the software supply chain

• Scan container images with Amazon Inspector or your registry's scanner.
• Keep dependencies patched and run automated dependency checks in CI.
• Store application secrets in Secrets Manager, never in environment files committed to Git.

7. Practise recovery

Back up with AWS Backup, keep copies in a separate account, and test restores. A backup you have never restored is only a hope.

Security is a continuous process, not a one-time project. If you would like an AWS security review against this checklist, our certified architects can help.