AWS Quick Checklist

A 21-point pass over IAM and security groups — the fastest way to find the highest-severity misconfigurations in any AWS account.

This is the master template. Per-account status for each of our AWS accounts is tracked in AWS Quick Checklist.xlsx, which stays the source of truth for who has resolved what. Tick items here to work through an account; progress is saved in this browser only.

For the wider cloud picture, see the Infrastructure checklist — 18 account-level practices with examples.

Progress summary

Total items	Not resolved	Resolved	% complete
21	21	0	0%

Severity key

Severity	Items	What it means here
Critical	7	Directly exploitable exposure — root access, a public database port, or a key an outsider could already hold. Fix before anything else.
High	9	A missing control that turns a single mistake or leaked credential into a full account compromise.
Medium	5	Hardening and hygiene — narrows the blast radius and removes standing access nobody needs.

IAM

0 of 16 complete

	Severity	Item
	Critical	MFA enabled on root account
	Critical	Root access keys deleted
	Critical	Enable MFA for all IAM users
	Critical	Confirm no access keys are hard-coded in code, scripts, or config files
	High	Enable AWS CloudTrail + CloudWatch Alarms
	High	Remove unused IAM users
	High	Ensure no shared user accounts (one user per person)
	High	Remove unnecessary “AdministratorAccess” from users
	High	Review policies and remove wildcards (Action: "", Resource: "") where not needed
	High	Verify least privilege: each user/role has only what they truly need
	High	Remove unused access keys
	High	Rotate active access keys regularly (≤ 90 days)
	High	Prefer roles and temporary credentials over long-lived keys
	Medium	Enforce strong password policy (length, complexity, rotation)
	Medium	Attach permissions to groups/roles, not directly to users (where possible)
	Medium	Restrict access key usage with IAM conditions

Security Group

0 of 4 complete

	Severity	Item
	Critical	Remove overly permissive rules (0.0.0.0/0)
	Critical	Restrict SSH (22) and RDP (3389) access to specific IPs only
	Critical	Restrict database ports (3306, 5432, 1433, etc.) to application security groups only
	Medium	Use security group referencing instead of CIDR blocks

General

0 of 1 complete

	Severity	Item
	Medium	AWS trusted advisor is turned on

Last updated: September 2026 · Source: AWS Quick Checklist.xlsx (Template sheet)

Contents

AWS Quick Checklist

Progress summary

Severity key

IAM

Security Group

General