AWS gives you building blocks with secure defaults in many places, but it's easy to loosen them for convenience and forget. These are the issues we find most often in AWS security assessments.

1. IAM: too much power, too many places

  • Users and roles with AdministratorAccess or "Action": "*" policies "just to get it working"
  • Long-lived access keys for IAM users, sometimes years old, sometimes committed to Git
  • Root account used for daily work, or without MFA
  • Roles that can pass or assume more powerful roles, creating hidden paths to admin

Fix: least-privilege policies, IAM Identity Center (SSO) instead of IAM users, MFA everywhere, and regular reviews with IAM Access Analyzer.

2. S3 buckets and data exposure

S3 Block Public Access is on by default for new buckets, but older buckets, bucket policies and object ACLs still cause leaks of backups, exports and logs. Fix: enforce Block Public Access at the account level and encrypt buckets by default.

3. Instance metadata (IMDSv1)

EC2 instances still allowing IMDSv1 are vulnerable to credential theft through SSRF bugs in the applications running on them: one request to the metadata service can return the instance role's credentials. Fix: require IMDSv2 on all instances and launch templates.

4. Security groups open to the world

SSH (22), RDP (3389) and database ports open to 0.0.0.0/0. Fix: use Systems Manager Session Manager instead of open SSH, and keep databases in private subnets.

5. Secrets in the wrong places

Credentials in Lambda environment variables, EC2 user data, CloudFormation templates or container images. Fix: AWS Secrets Manager or Parameter Store, with access granted by role.

6. Logging and detection switched off

CloudTrail not enabled in every region, GuardDuty off, or logs nobody reads. Fix: organisation-wide CloudTrail, GuardDuty and Security Hub, with alerts that reach a person.

Quick self-check: run IAM Access Analyzer and the IAM credential report today. How many access keys are older than 90 days? How many principals have admin rights?

How we test AWS

We combine a configuration review against best practice with hands-on testing of attack paths: starting from a leaked key, a compromised workload or an external view, how far can an attacker get? We also review Terraform and CloudFormation before it's deployed. Running on Azure instead? See our Azure guide.

Request a cloud security assessment.