AWS Recommended Best Practices

Require human users to use temporary credentials when accessing AWS. For centralized access management, AWS recommends IAM Identity Center to manage access to accounts and permissions within them.

On AWS compute (EC2, Lambda), AWS delivers temporary role credentials automatically — there is no need to distribute long-lived IAM user keys. Workloads outside AWS can still use temporary credentials via IAM Roles Anywhere, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity.

For scenarios that still need an IAM user or the root user, require MFA. AWS recommends phishing-resistant MFA such as passkeys and security keys wherever possible.

AWS managed policies are a fast starting point but might not grant least privilege, because they are written for all AWS customers. AWS recommends reducing permissions further by defining customer managed policies specific to your use case.

Access Analyzer analyzes the services and actions your roles actually used (from CloudTrail logs) and generates a fine-grained policy you can review and deploy.

Access Analyzer provides more than 100 policy checks and actionable recommendations. AWS recommends reviewing and validating all existing policies, not just new ones.

Access Analyzer continuously monitors supported resource types and generates findings for resources that allow public or cross-account access. You set a zone of trust (account or organization); anything outside it that has access produces a finding.

AWS recommends SCPs to establish permissions guardrails for all principals across accounts, and RCPs for resources. Critically: "No permissions are granted by SCPs and RCPs." You must still attach identity-based or resource-based policies to actually grant access.

When you let developers create and manage roles for their own workloads, use permissions boundaries to set the maximum permissions they can delegate. A permissions boundary does not grant permissions on its own.

IAM provides last accessed information to identify what you no longer need. Use it both to remove stale principals and to refine policies toward least privilege.

Grant access only when the request meets specific conditions — for example requiring that all requests be sent over TLS, or that an action is only performed through a specific service such as CloudFormation.

AWS recommends disabling ACLs except where you must control access per object. Apply the bucket owner enforced setting for S3 Object Ownership; ACLs are disabled by default for new buckets. Access is then governed by IAM policies, bucket policies, VPC endpoint policies, SCPs and RCPs.

All S3 buckets have encryption configured by default, and every new object is automatically encrypted at rest, with SSE-S3 as the default configuration. To use a different type, set the default encryption configuration on the bucket rather than policing uploads with a policy.

Block Public Access gives centralized controls that are enforced regardless of how resources are created. For multi-account setups, AWS Organizations can now centrally manage Block Public Access across the whole organization with a single policy, which removes the need for complex SCPs for this purpose.

AWS recommends keeping SSE-C disabled unless a workload specifically requires it. SSE-C requires supplying the key on every request, cannot be natively decrypted by AWS managed services, and makes sharing impractical. SSE-S3 or SSE-KMS give equivalent protection with far more flexibility.

AWS recommends allowing only encrypted HTTPS connections by using an aws:SecureTransport condition in bucket policies, and pairing it with the s3-bucket-ssl-requests-only AWS Config rule as a detective control.

AWS recommends not storing AWS credentials in an application or on an EC2 instance. These are long-term credentials that are not automatically rotated and could have significant business impact if compromised.

Versioning lets you recover from both unintended user actions and application failures. Object Lock stores objects using a write-once-read-many model and can help protect artifacts such as CloudTrail logs from deletion.

A VPC endpoint for S3 allows connectivity only to S3 and helps prevent traffic from traversing the open internet. Combined with a VPC that has no internet gateway, it helps prevent data exfiltration.

Group resources that share a lifecycle and an owning team. Owners can then change their own resources on their own schedule without affecting others — the reasoning behind separating, say, a website stack from a database stack.

Hardcoding values or passing resource names as parameters makes templates hard to reuse and increases overhead. Use Fn::ImportValue to import values another stack exported — CloudFormation then prevents deleting the exporting stack while other stacks depend on it.

StackSets create, update or delete stacks across accounts and Regions in a single operation. AWS recommends service-managed permissions with AWS Organizations so you do not have to manually configure IAM roles in each account.

AWS recommends dynamic references to values stored in Secrets Manager or SSM Parameter Store. CloudFormation retrieves the value when needed during stack operations and never stores the actual reference value.

Change sets show how proposed changes will impact running resources before you execute them. The classic example: renaming an RDS instance causes CloudFormation to create a new database and delete the old one — a change set surfaces that replacement before you lose data.

A stack policy describes what update actions may be performed on designated resources. AWS recommends specifying a stack policy whenever you create a stack with critical resources. During an update you must explicitly specify protected resources you intend to change.

Out-of-band changes create drift, a mismatch between the template and reality. If a resource is changed outside the template and you then update the stack, those changes are discarded and the resource reverts to the template configuration.

Rollback triggers let you name CloudWatch alarms that CloudFormation monitors during create and update operations. If any alarm enters ALARM state, CloudFormation automatically rolls back the entire stack operation.

Managing a stack normally requires permissions on every resource inside it. To separate permissions between a user and the service, use a service role — CloudFormation then uses the service role policy to make calls instead of the user policy.

cfn-lint catches syntax and configuration issues early. CloudFormation Guard is a policy-as-code tool for enforcing organizational rules — for example, ensuring users always create encrypted S3 buckets — and can stop deployment of non-compliant resources from within a pipeline.

AWS notes YAML is generally recommended for manual template authoring because of its readability and comment support, which helps in complex templates. JSON is advantageous in automated workflows or when a tool requires it.

AWS warns that secrets entered directly in an action configuration, in pipeline-level variable defaults, or in CloudFormation configuration will display in logs. Store them in Secrets Manager and reference the secret instead.

For pipelines using an S3 source bucket, configure server-side encryption for artifacts by managing AWS KMS keys.

When using Jenkins for a build or test action, install it on an EC2 instance with a separate instance profile that grants only the AWS permissions required for the project, such as retrieving files from S3.

AWS recommends storing templates in version control, implementing code reviews, and using automated testing to validate changes, then building CI/CD pipelines for infrastructure with CodePipeline, CodeBuild and CodeDeploy.

Session Manager provides secure node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. Leaving inbound SSH or RDP ports open greatly increases the risk of unauthorized commands being run on your nodes.

Administrators get a single place to grant and revoke access. Because permissions come from IAM rather than SSH keys, you can also grant temporary access — for example giving an on-call engineer production access only for the duration of their rotation.

Setting up VPC endpoints for Systems Manager limits all network traffic between your managed nodes, Systems Manager and EC2 to the Amazon network.

Session Manager integrates with CloudTrail, S3 and CloudWatch Logs for session records. You can create an EventBridge rule that detects when a user starts or stops a session and notify through SNS.

Connecting to non-EC2 nodes with Session Manager requires activating the advanced-instances tier, which carries a charge. There is no additional charge to connect to EC2 instances.

An organization is a security boundary that lets you maintain consistency across accounts. Consistent policies, central visibility and programmatic controls across a multi-account environment are best achieved within a single organization.

AWS recommends isolating production workloads under top-level workload-oriented OUs based on a common set of controls, rather than mirroring your company reporting structure, plus one or more non-production OUs for development and test.

AWS recommends enabling or disabling trusted access using the target service own console or API/CLI, so the service can perform its required initialization and cleanup steps. AWS Account Management is the only service that requires the Organizations console.

Root access management lets you monitor and remove root user credentials for member accounts and prevents their recovery. Newly created member accounts are then secure by default with no root credentials, eliminating the need for extra steps such as adding MFA after provisioning.

Use a business-managed address that forwards to a group, so that if AWS must contact the account owner the message reaches multiple people — reducing the risk of delays when individuals are away.

For most cases AWS recommends the aws/secretsmanager AWS managed key, which has no cost. Use a customer managed key when you need to access the secret from another account or apply a key policy to the encryption key.

In the key policy, set kms:ViaService to secretsmanager.<region>.amazonaws.com. This limits use of the key to requests coming from Secrets Manager only. Encryption context can narrow it further.

AWS recommends using a supported caching component to cache secrets and update them only when required — client-side caching libraries for Java, Python, .NET, Go and Rust, the AWS Parameters and Secrets Lambda Extension, or the Secrets Manager Agent.

Secrets that never change become more likely to be compromised. Secrets Manager supports automatic rotation as often as every four hours, with two strategies: single user, and alternating users.

In identity policies that allow secretsmanager:PutResourcePolicy, AWS recommends a Bool condition on secretsmanager:BlockPublicPolicy set to true, so users can only attach resource policies that do not allow broad access. Secrets Manager uses Zelkova automated reasoning to detect broad access.

AWS warns that IP-based conditions break services acting on your behalf: a rotation Lambda calls Secrets Manager from an AWS-internal address space and will fail the filter. aws:SourceIp is also less effective when requests come through a VPC endpoint. Use aws:SourceVpc or aws:SourceVpce instead.

AWS recommends running as much infrastructure as possible on private networks not accessible from the public internet, establishing a private connection between your VPC and Secrets Manager with an interface VPC endpoint.

CodeGuru Reviewer integrates with Secrets Manager to run a secrets detector that finds hardcoded passwords, database connection strings and user names in your code. Amazon Q can also scan a codebase for security issues.

ECR offers two basic scanning versions. AWS native basic scanning is GA and recommended, and all new registries are opted into it by default. The older Clair-based basic scanning is deprecated, is not supported in Regions added after September 2024, and is no longer supported anywhere as of October 1, 2025.

Remove extraneous binaries from container images. Distroless images contain only your application and its runtime dependencies — no package managers or shells — which improves scanner signal-to-noise and reduces attack surface. Multi-stage builds keep build tooling out of the final image.

Containers run as root by default unless the Dockerfile includes a USER directive. AWS suggests linting Dockerfiles in your CI/CD pipeline for the USER directive and failing the build when it is missing.

A container root file system is writable by default. Configuring it read-only forces you to define explicitly where data may be persisted and reduces attack surface. Test first — some OS packages expect to write to the filesystem.

Immutable tags prevent pushing an altered version of an image over an existing tag, protecting against an attacker replacing an image with a compromised build under the same tag. It forces a new tag for every change.

A privileged container inherits all Linux capabilities assigned to root on the host. AWS advises setting the ECS container agent variable ECS_DISABLE_PRIVILEGED to true where privileged mode is not needed, or scanning task definitions for the parameter with Lambda.

Without limits, tasks have access to the host CPU and memory, so one task on a shared host can starve others. Fargate requires CPU and memory values because it uses them for billing, and each Fargate task runs on its own dedicated instance.

Create a set of vetted images for the application stacks in your organization so developers do not each compose their own Dockerfiles. AWS explicitly advises avoiding pulling images from Docker Hub, because you do not always know what is in them.

Images pushed to ECR are automatically encrypted at rest with an AWS KMS managed key. If you need control over the key, ECR supports server-side encryption with a customer managed key.

Both are preferred ways to deliver temporary AWS credentials to pods, but AWS states: "Unless you have specific usecases for IRSA, we recommend you use EKS Pod Identities when using EKS." Pod Identity needs no OIDC provider per cluster, sets session tags for ABAC, and does not consume your account STS quota.

Even with IRSA or Pod Identity, a pod can still inherit the rights of the instance profile assigned to the worker node. Require IMDSv2 and set the PUT response hop limit to 1. Do NOT disable instance metadata entirely — components such as the node termination handler depend on it.

By default aws-node uses the EC2 instance role, which includes managed policies such as AmazonEKS_CNI_Policy and EC2ContainerRegistryReadOnly. That effectively lets all pods on the node attach/detach ENIs, assign IPs, or pull from ECR — a risk AWS recommends removing by moving aws-node to IRSA or Pod Identity.

The first EC2 security best practice AWS lists is to manage access to AWS resources and APIs using identity federation with an identity provider and IAM roles, rather than static credentials.

Security groups should grant only the access actually required. Combined with Session Manager, this lets you close inbound SSH and RDP entirely.

Inspector automatically discovers and scans EC2 instances for software vulnerabilities and unintended network exposure. Security Hub CSPM controls monitor EC2 resources against security standards.

Keep data on its own volume and ensure it persists after instance termination. Use instance store only for temporary data — it is deleted when you stop, hibernate or terminate the instance.

AWS lists encrypting EBS volumes and snapshots among its core EC2 storage best practices.

Replicate data appropriately, design applications to handle dynamic IP addressing on restart, and use EC2 Auto Scaling for automated failover rather than manually reattaching an ENI or Elastic IP.

Trusted Advisor inspects your environment and recommends where you can save money, improve system availability and performance, or close security gaps. Also check service quotas in advance of needing them.