Security best practices
A control catalogue for AWS workloads, organised by security domain. Each entry states what the control is, why it matters, and the AWS service that implements it.
01 — Security governance
Role-based access control
Permissions are defined by job function, not by person. In IAM this means policies per role, attached to groups, granted at the least privilege necessary.
The limitation of pure RBAC is that policies must be updated when new resources
appear. Attribute-based conditions — tagging, aws:PrincipalTag, resource tags —
reduce that maintenance and are preferred where the pattern is stable.
Permission sets as code
Permission sets, groups and assignments are deployed as Terraform from a reviewed repository:
- Define groups, policies and group-to-policy links in
var-*files. - Apply to a single account or across the organisation.
- Link permission sets to the accounts and groups that need them.
- Verify by signing in as a test user in each role.
- Change by pull request — only the changed policy is reapplied.
This makes access review a diff, not an audit.
02 — Security assurance
AWS Audit Manager
Audit Manager continuously collects evidence against a framework — CIS, PCI DSS, SOC 2, GDPR, HIPAA, ISO 27001 — and produces audit-ready reports. Use it where the customer has a recurring audit obligation and the manual evidence pack is costing more than the service.
The framework is selected once; controls are mapped; evidence collection is automatic; stakeholder review happens in the tool rather than in email.
03 — Identity and access management
Access key rotation
Where long-lived keys cannot be eliminated:
| Day | Action |
|---|---|
| 0 | Key created |
| 90 | New key generated, stored in Secrets Manager, owner notified |
| 100 | Old key deactivated |
| 110 | Old key deleted |
Automated with EventBridge and Lambda. Manual rotation processes decay; this one does not depend on anyone remembering.
IAM user creation notification
A CloudWatch Events rule on CreateUser triggers a Lambda that notifies the
security channel and records the event in Security Hub. In an organisation where
users should be created only through federation, any CreateUser is an anomaly
worth knowing about immediately.
Compromised credentials
GuardDuty finding (credential misuse)
→ EventBridge rule
→ SNS notification to security on-call
→ Lambda: deactivate the access key / attach deny policy to the role
→ Incident opened
The automated step is containment, not resolution. A human investigates.
Role credential exfiltration
An instance compromise followed by metadata-service credential theft is detected by GuardDuty. The response attaches a policy that revokes all active sessions for the role, within minutes, then notifies.
Prevention complements detection: IMDSv2 required by SCP, and instance roles scoped so that a stolen credential is worth less.
04 — Threat detection
Security operations
| Signal | Source | Response |
|---|---|---|
| Unusual API activity | GuardDuty | Investigate principal and source |
| Malicious IP communication | GuardDuty with threat intel | Isolate the instance |
| Crypto-mining | GuardDuty | Terminate, investigate entry point |
| Unauthorised API calls | CloudTrail metric filter | Assess identity and intent |
| Root login | CloudTrail alarm | Incident — root should not be used |
| Config drift | Config | Revert, investigate access |
| Posture finding | Security Hub | Triage against severity and exposure |
Guardrails
Control Tower preventive and detective controls, described in Control Tower.
Security Hub
Aggregates findings from GuardDuty, Inspector, Config, IAM Access Analyzer, Firewall Manager, Macie and third-party tools into one view, scored against enabled standards.
05 — Vulnerability management
Amazon Inspector
Continuous scanning of EC2 instances, container images in ECR, and Lambda functions. Findings are prioritised by exploitability and network reachability, which is more useful than raw CVE count.
| Asset | Scan trigger |
|---|---|
| EC2 | On launch and continuously |
| ECR image | On push and continuously |
| Lambda | On deploy and continuously |
Findings route to the owning team and into the deployment readiness checklist.
06 — Infrastructure protection
| Control | Service | Purpose |
|---|---|---|
| DDoS protection | AWS Shield Standard / Advanced | Absorb volumetric attacks |
| Web application firewall | AWS WAF | Block injection, bot and abuse patterns |
| Network firewall | AWS Network Firewall | Egress filtering and domain allow-lists |
| Central policy | AWS Firewall Manager | Apply WAF and Shield policy across accounts |
| Host-level rules | Security groups and NACLs | Segmentation |
| Patch state | Systems Manager | Inventory and patch compliance |
See Infrastructure protection.
07 — Data protection
KMS
- Separate keys per data classification and per service boundary.
- Key policy restricts administration and use separately.
- Automatic rotation enabled where the service supports it.
- Grants for cross-account access, not broad key policies.
- Deletion requires a waiting period and an alarm.
Secrets Manager
- Secrets never in code, environment files or images.
- Automatic rotation for database credentials where supported.
- Resource policy restricts retrieval to specific roles.
- Access logged in CloudTrail.
- Parameter Store for non-secret configuration.
08 — Application security
WAF automations
Managed rule groups for common threats, plus custom rules for the application's own abuse patterns:
- IP reputation and anonymous proxy lists.
- SQL injection and cross-site scripting rules.
- Rate limiting per IP and per session.
- Bot control on endpoints that should not be automated.
- Geo restrictions where the customer's user base justifies them.
09 — Incident response
Security Hub automation
Findings above a severity threshold create a ticket and notify the on-call channel automatically. Below the threshold, they aggregate into a daily digest.
GuardDuty finding response
Finding → EventBridge → Lambda
├── tag the resource for investigation
├── isolate the instance (replace security group)
├── snapshot volumes for forensics
└── notify security on-call
AWS Detective
Used after a finding to build the behaviour graph: which principals, which resources, which IPs, over what time. Detective answers "what else did this identity touch?" — the question that determines incident scope.
Appendix — RBAC model
| Category | Service | Description | Roles |
|---|---|---|---|
| Platform | IAM, Organizations, Control Tower | Identity and account governance | Platform admin, Security auditor |
| Network | VPC, Route 53, CloudFront, WAF | Connectivity and edge | Network admin |
| Compute | EC2, ECS, EKS, Lambda | Workload runtime | Developer, Platform operator |
| Data | RDS, DynamoDB, S3, ElastiCache | Persistence | DBA, Data engineer |
| Security | GuardDuty, Security Hub, Config, Inspector | Detection and compliance | Security analyst |
| Observability | CloudWatch, X-Ray, QuickSight | Monitoring | SRE, Developer |
| Finance | Budgets, Cost Explorer, CUR | Cost | FinOps analyst |