AWS Hardening Checklist
IAM 10 controls
Enable MFA on the root account.
How to verify / fix
In IAM → Security recommendations (or sign in as root → My Security Credentials), confirm MFA is registered. Add a hardware or virtual MFA device; the root credentials should never be usable with a password alone.
Ensure no access keys exist on the root account.
How to verify / fix
Sign in as root → My Security Credentials → Access keys, or run aws iam get-account-summary and check AccountAccessKeysPresent = 0. Delete any root access keys — root should be API-inaccessible.
Do not use the root account for day-to-day work.
How to verify / fix
Review the IAM credential report (aws iam generate-credential-report) for recent root password_last_used. Lock root away and operate through least-privilege IAM users/roles or Identity Center.
Require MFA for every IAM user with console access.
How to verify / fix
In the credential report, find users where password_enabled = true but mfa_active = false. Enforce MFA with an IAM policy that denies actions unless aws:MultiFactorAuthPresent is true.
Set a password policy requiring at least 14 characters.
How to verify / fix
IAM → Account settings → Password policy. Set Minimum password length to 14 (or run aws iam update-account-password-policy --minimum-password-length 14).
Prevent reuse of the last 24 passwords.
How to verify / fix
In the same password policy, enable Prevent password reuse and set it to 24 (--password-reuse-prevention 24).
An IAM user should have console access or access keys — not both.
How to verify / fix
In the credential report, flag users with password_enabled = true and an active access key. Remove whichever credential isn't required to reduce the user's attack surface.
Rotate active access keys at least every 90 days.
How to verify / fix
Check access_key_1_last_rotated in the credential report. Issue a new key, update applications, then deactivate and delete the old key under IAM → Users → Security credentials.
Disable or delete access keys unused for 90+ days.
How to verify / fix
Compare access_key_last_used_date against today in the credential report. Set unused keys to Inactive, confirm nothing breaks, then delete them.
Disable console access for IAM users inactive 90+ days.
How to verify / fix
Use password_last_used in the credential report to find dormant users. Remove their login profile (aws iam delete-login-profile) or disable the user.
85 more controls — unlock the full checklist
The full AWS Hardening Checklist has 95 controls with the interactive self-assessment tool (track Pass / Fail / Partial, see your readiness score, and export a PDF report). One-time purchase, instant access.
Not ready to buy? Try the free Cyber Insurance Readiness Score.