AWS Account Security Checklist

Chapter 2 of 8 · 5 checks · 3 min

Human access

Checks that people sign in through a central identity, get temporary credentials, use strong MFA and hold only the permissions they use.

Show
  1. People sign in through IAM Identity Center or another identity providerMust

    Why it matters and how to check

    AWS's first IAM best practice is to require human users to use federation with an identity provider and temporary credentials, and it recommends IAM Identity Center for central access across accounts. Each person then has one identity, access ends when it is disabled, and nobody holds long-lived AWS passwords or keys.

    To verify: list IAM users with aws iam list-users. In an account using federation, the list should contain no people, only documented exceptions such as a third-party tool that cannot assume roles. Confirm that disabling a test user in your identity provider removes their AWS access.

  2. Every remaining IAM user with a console password has MFAMust

    Why it matters and how to check

    Where IAM users with console access still exist, AWS recommends requiring MFA and prefers phishing-resistant MFA such as passkeys and security keys. If you use Identity Center with its own identity store, turn on MFA there too.

    To verify: generate the credential report and look for rows where password_enabled is true and mfa_active is false. There should be none. In Identity Center, check under Settings that MFA is required on every sign-in, or at least on context change, and which MFA types are allowed.

    Example

    Shell
    aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 --decode \
  | awk -F, 'NR==1 || ($4=="true" && $8=="false")' | cut -d, -f1,4,8
  3. Developers use the CLI with temporary credentials, not personal access keysShould

    Why it matters and how to check

    Personal access keys end up in dotfiles, scripts and laptops, and they work until someone remembers to delete them. With Identity Center, aws configure sso and aws sso login give the CLI short-lived credentials for each session. AWS recommends temporary credentials wherever possible and long-term access keys only for use cases that truly need them.

    To verify: in the credential report, list users with access_key_1_active or access_key_2_active set to true. Each one should be a documented workload exception with an owner, not a person. Check access_key_1_last_used_date to find keys that can be deleted.

  4. Unused users, roles, keys and permissions are reviewed and removedShould

    Why it matters and how to check

    Every unused credential is something that can leak without anyone noticing. AWS recommends regularly reviewing and removing unused users, roles, permissions, policies and credentials, using the last accessed information that IAM provides for each.

    To verify: in the credential report, find passwords and keys not used in 90 days (or your own threshold). In the IAM console, open a role's Last accessed tab to see which services it actually used. IAM Access Analyzer can also produce unused access findings across the account. Remove what is unused, and record the review date.

  5. Permissions are narrowed from broad managed policies toward least privilegeShould

    Why it matters and how to check

    AWS suggests starting with AWS managed policies and then reducing permissions with customer managed policies, because managed policies are written for every customer and are rarely least privilege for you. IAM Access Analyzer can generate a policy from a role's actual CloudTrail activity, and its policy validation runs more than 100 checks on policies as you write them.

    To verify: list who has AdministratorAccess with aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess and check every entry is intended. Run policy validation on your custom policies and fix security warnings. Look for "Action": "*" or "Resource": "*" in custom policies and narrow them.

    Example

    Shell
    aws iam list-entities-for-policy \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY \
  --policy-document file://policy.json