Account security baseline checklist

What “good enough” looks like on day one.

In short. A secure-enough AWS account on day one is a checklist, not a feeling. This lesson consolidates the course into an actionable baseline you can apply to every new account before workloads land.

A secure-enough AWS account on day one is a checklist, not a feeling. This lesson consolidates the course into an actionable baseline you can apply to every new account before workloads land. Skip items only with a written exception.

You already covered IAM, federation, SCPs, network, KMS, S3, detection, SSM, and IR. Baseline is the packaging: what "done" means when platform opens a new account.

Account baseline checklist

- Org trail + local trail backups; log file validation on
- GuardDuty enabled; Security Hub + FSBP; Config recorder on
- S3 Block Public Access account defaults
- No IAM users with AKIA for apps; OIDC/roles only
- Break-glass role with MFA + alarm on assume
- Default VPCs reviewed or deleted; SG 0.0.0.0/0 audited
- EBS/S3 default encryption with CMK where required
- IMDSv2 required on launch templates
- Budgets + Root MFA + root unused
- SCP deny on disable-security-services / leave-org

printf '%s\n' 'Root MFA?' 'Trail multi-region?' 'GuardDuty detector?' 'Hub standards?' 'Account BPA?' 'Break-glass alarm?'

Root MFA?
Trail multi-region?
GuardDuty detector?
Hub standards?
Account BPA?
Break-glass alarm?

Prove it

Automate evidence: Config conformance packs, Security Hub scores, and a CI pipeline that fails if a new account lacks detectors. Re-run after every landing-zone change. Tabletop the key-compromise IR quarterly.

Going deeper

Encode the checklist in Terraform or Control Tower/AFT blueprints so every account gets the same detectors and locks. Manual checklist adherence collapses after the third account.

Include cost guardrails (budgets, denied expensive instance types via SCP in sandbox OUs) — security and finance share the blast radius of crypto mining abuse.

Re-certify baselines quarterly: sample five accounts, diff against the blueprint, fix drift. Drift is the default; detection must be continuous.

Publish the baseline as a living doc linked from account vending PRs. When someone asks for an exception to skip GuardDuty "for a demo," the answer is a dated exception object — not a quiet skip.

Finally, test restore of the baseline itself: can you recreate detectors and trails from code in a fresh account in under an hour? If not, your baseline is a wiki, not a factory.

Include Evidence links: Config snapshot ARNs, Hub score screenshots, and trail ARNs attached to the account vending ticket. Auditors ask; having links beats archaeology.

Add a post-vend canary: a synthetic finding or Config rule you expect to be compliant within an hour. If the canary fails, the account factory regressed — stop vending until fixed.

Store the checklist results as Config conformance pack compliance percentage and trend it — baselines that are not measured drift.

Try this

Score one non-prod account against the checklist above; open tickets for every gap with owners.

echo "gaps=$(wc -l < gaps.txt 2>/dev/null || echo 0)"

gaps=7

Takeaway

Baseline turns this course into muscle memory: identity, org guardrails, encryption, private networks, detection, SSM access, and rehearsed IR — applied the same way every time.

When you need multi-account depth across clouds, continue into the advanced cloud security track.

Related