AWS Account Security Checklist

What this checklist is

An AWS account security checklist for teams that run real workloads on AWS without a dedicated security team. It covers the root user, human and workload access, multi-account guardrails, CloudTrail and threat detection, S3 and data protection, EC2 and network exposure, and readiness for a leaked key, with an AWS CLI command or console check for each item.

It has 8 chapters and 38 checks, each with how to verify it and how much it matters. For developers and small teams running on AWS.

Chapter by chapter

1. The root user (6 checks)

Checks that the one identity with unlimited power over the account is locked away, protected by MFA and watched.

2. Human access (5 checks)

Checks that people sign in through a central identity, get temporary credentials, use strong MFA and hold only the permissions they use.

3. Workload and pipeline access (4 checks)

Checks that applications and CI/CD get temporary credentials from roles, scoped to what they do, instead of stored access keys.

4. Accounts and guardrails (4 checks)

Checks that production is separated from everything else and that organization-wide guardrails stop the most dangerous changes.

5. Logging and threat detection (6 checks)

Checks that every API call is recorded somewhere it cannot be erased, and that suspicious activity reaches a person.

6. S3 and data protection (5 checks)

Checks that storage is private by default, encrypted, never exposed to the internet by accident, and backed up somewhere safe.

7. EC2, metadata and network exposure (5 checks)

Checks that instances cannot leak their role credentials, and that nothing administrative is open to the whole internet.

8. Cost alerts and incident readiness (3 checks)

Checks that you hear about abuse quickly, AWS can reach the right people, and the team knows what to do when a key leaks.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (8 cited).