14
Enforce MFA Everywhere, Retire Root Use Every human identity that can reach the cloud console — especially the root/organization account — should require multi-factor authentication. Lock the root account away (hardware MFA in a vault) and never use it day to day; create an admin IAM role instead.
15
Least-Privilege IAM & Short-Lived Credentials Grant only the specific actions and resources a role needs — never Action:"*" — and issue temporary, auto-expiring credentials via STS/SSO instead of long-lived access keys that can leak.
16
Secrets Manager With Automatic Rotation Database passwords, API keys, and service credentials live in a secrets manager (AWS Secrets Manager, Vault) with rotation scheduled automatically — not in .env files, Dockerfiles, or CI variables that outlive the person who set them.
17
Encrypt Data at Rest by Default Turn on KMS-backed encryption for every S3 bucket, EBS volume, and RDS instance by default — via account-level policy, not a per-resource checkbox someone might forget.
18
TLS Everywhere, No Exceptions Every connection — client-to-server, service-to-service, and service-to-database — runs over TLS 1.2+. Certificate validation is never disabled, even temporarily, even in a script that "just needs to run once."
19
Network Segmentation Put anything that isn't meant to be public in a private subnet, and use security groups as a default-deny allowlist between tiers — the database should only ever hear from the application layer, never the internet.
20
WAF & DDoS Protection at the Edge Put a Web Application Firewall (AWS WAF, Cloudflare) in front of public endpoints to block common attack patterns before they reach application code, and enable managed DDoS protection for anything public-facing and important.
21
Session Manager Instead of Open SSH Access EC2 instances through AWS Systems Manager Session Manager (or a bastion behind SSO+MFA) instead of exposing port 22 to the internet — every session is logged and requires no long-lived SSH key.
22
Centralized Logging & Real-Time Alerting Every account feeds CloudTrail, VPC Flow Logs, and application logs into a central SIEM, with GuardDuty/Security Hub findings routed to an on-call channel — logs nobody looks at are not a control.
23
Data Classification & Handling Policy Not all data needs the same protection — tag and classify data (public/internal/confidential/restricted) so encryption, retention, and access requirements scale with sensitivity instead of being applied uniformly or not at all.
24
Centralize Identity With SSO Federate every account through a single identity provider (Okta, Azure AD, AWS IAM Identity Center) instead of creating individual IAM users per account. Offboarding becomes one action instead of a checklist across a dozen systems.
25
Automated Patch Management OS and dependency patching runs on a schedule via Systems Manager Patch Manager (or equivalent), not as a manual quarterly task someone remembers eventually — critical patches roll out in days, not months.
26
Infrastructure as Code + Security Scanning Infrastructure is defined in Terraform/CloudFormation, version-controlled, and scanned by a policy tool (tfsec, Checkov) in CI before it's ever applied — catching a public bucket or open security group before it exists.
27
Container & Image Security Base container images come from a trusted, minimal source (distroless/alpine), are scanned for known CVEs before deploy, and run as a non-root user with a read-only filesystem where possible.
28
Tested Backups & Disaster Recovery Automated backups exist for every stateful service, and — critically — someone has actually restored from one recently. An untested backup is a hope, not a plan.
29
Multi-Account Strategy With Guardrails Separate prod, staging, and dev into different AWS accounts under an Organization, with Service Control Policies enforcing account-wide guardrails that even an admin in that account can't override.
30
Configuration Drift Detection & CSPM Scanning Continuously evaluate live infrastructure against your intended policy and known-bad patterns — public buckets, open security groups, disabled logging — using AWS Config/OPA for drift and a cloud security posture management (CSPM) tool for broader benchmark checks, so a manual console change gets flagged and reverted before an attacker finds it first.
31
Incident Response Plan & Game Days Have a written runbook for "what do we do when X happens" (leaked key, ransomware, data exposure) before it happens, and rehearse it at least annually — the first incident is a bad time to design the process.
