Security Setup Checklist

• Turn on IAM Identity CenterOpen the IAM Identity Center console and choose Enable. This becomes your single sign-on front door for all users.
• Require MFA for everyoneIn the IAM Identity Center console, go to Settings > Authentication and set 'Prompt users for MFA' to 'Every time they sign in'.
• Allow only strong MFA typesUnder Settings > Authentication > MFA, choose 'Security keys and built-in authenticators' so only FIDO2 passkeys and security keys are accepted.
• Register each user's keyHave each person plug in their FIDO2 security key or set up a passkey when prompted at their next sign-in.
• Protect the root user tooOpen the IAM console, choose 'My Security Credentials' for the root account, and under Multi-factor authentication choose 'Assign MFA device' > Passkey or Security Key.
• Remove weak fallback optionsIn Settings > Authentication, turn off SMS text-message and email codes so no one can use easy-to-phish methods.
• Test a full loginSign out and sign back in with a security key to confirm the password-plus-key flow works before rolling out to the team.

Evidence to keep: Identity Center authentication settings screenshot · List of users with registered FIDO2 devices · Root account MFA-enabled proof

• Map jobs to rolesList the tasks each team does, then plan an IAM role for each job type instead of one big shared account.
• Create roles with tight policiesIn the IAM console, choose Roles > Create role, then attach a policy that allows only the actions that job needs.
• Assign roles in Identity CenterOpen IAM Identity Center, go to Permission sets, and match each group of people to the smallest permission set that fits.
• Add guardrails with SCPsIn the AWS Organizations console, go to Policies > Service control policies and block risky actions (like turning off logging) for all accounts.
• Set permission boundariesIn IAM, attach a permission boundary to roles so even a mistaken policy cannot grant more than the ceiling you set.
• Review access with Access AnalyzerIn the IAM console, open Access Analyzer to find unused permissions and resources shared too widely, then trim them.
• Remove old access regularlyCheck IAM 'Last accessed' data every quarter and delete roles, users, or permissions no one is using.

Evidence to keep: IAM role and policy list · Service control policy documents · Access Analyzer unused-access report

• Turn on AWS ConfigOpen the AWS Config console and choose 'Set up AWS Config' to start recording every resource and its settings over time.
• Record across all accountsIn AWS Organizations, enable Config as an organization-wide recorder so no account is missed.
• Enable Resource ExplorerOpen the AWS Resource Explorer console, turn it on, and create an aggregator index so you can search resources across all Regions from one place.
• Turn on Systems Manager InventoryIn the AWS Systems Manager console, use Quick Setup to collect software and OS details from your EC2 servers.
• Tag every resourceAdd tags like Owner, System, and Environment so you can group and find resources quickly later.
• Build a resource dashboardUse Resource Explorer search plus Config's resource inventory page to see one combined view of everything you run.
• Schedule a monthly reviewOnce a month, check for untagged or unknown resources and remove anything that should not be there.

Evidence to keep: AWS Config recorder status · Resource Explorer aggregator index confirmation · Exported resource inventory list

• Create an organization CloudTrailOpen the CloudTrail console, choose Create trail, and enable it for all accounts and Regions to record every API action.
• Store logs in a locked S3 bucketPoint the trail to an S3 bucket with encryption and 'Object Lock' so logs cannot be edited or deleted.
• Send logs to CloudWatchIn the CloudTrail trail settings, forward events to Amazon CloudWatch Logs so you can search and set alarms.
• Turn on GuardDutyOpen the Amazon GuardDuty console and choose Enable GuardDuty to automatically watch for threats in your logs.
• Enable Security Hub CSPMOpen the AWS Security Hub CSPM console and choose Enable to gather GuardDuty and other findings into one dashboard.
• Set alarms for key eventsIn CloudWatch, create alarms for risky actions like disabling logging or root-user sign-ins, and send them to email or a chat channel.
• Review findings weeklyCheck the Security Hub CSPM findings list each week and assign someone to fix or dismiss each item.

Evidence to keep: CloudTrail 'all Regions' trail configuration · GuardDuty enabled status · Security Hub CSPM findings and alarm history

• Design a VPC layoutIn the Amazon VPC console, create a VPC with separate public subnets for web servers and private subnets for databases.
• Keep sensitive data privatePlace databases and CUI systems in private subnets that have no direct route to the internet.
• Set tight security groupsIn the VPC console under Security Groups, allow only the exact ports and sources each server needs, and deny the rest.
• Add NACL backup rulesUse Network ACLs at the subnet level as a second layer to block traffic you never want, like unused ports.
• Control outbound trafficRoute private subnets through a NAT gateway and review egress rules so servers cannot phone home to bad sites.
• Protect web apps with WAFOpen the AWS WAF console, create a web ACL, and attach managed rule groups to block common attacks on your public apps.
• Test the boundariesTry to reach a private database from the public internet and confirm it is blocked before going live.

Evidence to keep: VPC and subnet diagram · Security group and NACL rule export · WAF web ACL configuration

• Turn on Amazon InspectorOpen the Amazon Inspector console and choose Activate to start continuous scanning of EC2 servers, containers, and functions.
• Make servers manageableConfirm the SSM Agent is installed and instances show up in Systems Manager > Fleet Manager as 'Managed nodes'.
• Review the findingsIn the Inspector console, sort findings by severity so you fix Critical and High weaknesses first.
• Create a patch policyOpen Systems Manager, choose Quick Setup, and on the Patch Manager card choose Create to schedule automatic patching.
• Set scan and install windowsIn Patch Manager, pick a maintenance window (for example, weekly at 2 a.m.) so patches install without disturbing work.
• Check patch complianceIn the Systems Manager Patch Manager console, view the compliance dashboard to see which nodes are missing patches.
• Track fixes to closureConfirm Inspector marks fixed findings as Closed after patches install, and follow up on anything still open.

Evidence to keep: Inspector findings report by severity · Patch Manager compliance dashboard · Maintenance window and patch policy settings

• Create your own KMS keysOpen the AWS KMS console, choose Create key, and make customer managed keys so you control who can use them.
• Encrypt S3 bucketsIn the Amazon S3 console, open each bucket's Properties and set default encryption to SSE-KMS with your key.
• Block public S3 accessIn S3, turn on 'Block all public access' at the account level so encrypted data is not accidentally shared.
• Turn on EBS encryption by defaultIn the EC2 console under Account Attributes, enable 'Always encrypt new EBS volumes' so every disk is protected.
• Require TLS in transitUse AWS Certificate Manager to issue certificates and set load balancers to accept only HTTPS/TLS connections.
• Restrict key useIn KMS, edit each key policy so only the roles that truly need it can encrypt or decrypt.
• Enable key rotationIn the KMS console, turn on automatic yearly key rotation for your customer managed keys.

Evidence to keep: KMS key list with rotation enabled · S3 default-encryption settings · Load balancer TLS/HTTPS configuration

• Open AWS BackupOpen the AWS Backup console and choose Create backup plan to define what gets backed up and how often.
• Set schedule and retentionIn the backup plan, pick a frequency (like daily) and how long to keep copies (like 35 days or more).
• Assign resources by tagUse 'Assign resources' and select tags like Backup=Yes so the plan automatically covers the right servers and databases.
• Add a cross-Region copyIn the backup plan's 'Copy to destination' setting, choose a second AWS Region and a vault there for off-site copies.
• Lock the backup vaultIn AWS Backup, turn on Vault Lock so backups cannot be deleted early, even by an admin, which stops ransomware tampering.
• Centralize across accountsUse AWS Organizations to apply the backup plan across all member accounts from one place.
• Test a restoreEvery quarter, restore a backup into a test spot and confirm the data actually works.

Evidence to keep: AWS Backup plan and schedule · Cross-Region copy job history · Successful restore test record

• Enable Security Hub CSPMOpen the AWS Security Hub CSPM console and choose Enable to start automated best-practice checks.
• Turn on the FSBP standardIn Security Hub CSPM, go to Standards and choose Enable on the 'AWS Foundational Security Best Practices' standard.
• Add the CIS benchmarkIn the same Standards page, enable the 'CIS AWS Foundations Benchmark' if you need CIS attestation.
• Set up Config rulesIn AWS Config, add managed rules (or conformance packs) that alarm when resources drift from your baseline.
• Use Control Tower for new accountsOpen the AWS Control Tower console and set up a landing zone so every new account starts with guardrails already on.
• Track your security scoreWatch the Security Hub CSPM security score and work down the list of failed controls over time.
• Fix and re-check driftWhen a control fails, fix the setting and confirm Security Hub CSPM flips it to 'Passed' on the next check.

Evidence to keep: Security Hub CSPM standards and score · AWS Config conformance pack results · Control Tower landing zone summary

• Create a Bedrock guardrailOpen the Amazon Bedrock console, choose Guardrails > Create guardrail, and name your safety rule set.
• Block harmful and off-limits topicsIn the guardrail wizard, set content filters and add denied topics so the AI refuses unsafe or out-of-scope requests.
• Turn on PII redactionIn the guardrail's sensitive-information settings, have it mask personal data like names, SSNs, and emails in prompts and answers.
• Attach the guardrail to your appPublish a guardrail version and connect it to your Bedrock model or agent so every request runs through it.
• Enable Amazon MacieOpen the Amazon Macie console and choose Enable, then turn on 'Automated sensitive data discovery' in Settings.
• Scan S3 for sensitive dataIn Macie, review findings that show which buckets hold PII or credentials, and lock down or move that data.
• Restrict who can use AIUse IAM policies to allow only approved roles to call Bedrock, so AI is not open to everyone.

Evidence to keep: Bedrock guardrail policy configuration · Macie sensitive-data findings report · IAM policies limiting Bedrock access