Stop Paying Me to Secure your AWS Account

Boyd Hemphill, a fractional engineering executive who cleans up AWS accounts for small and mid-sized companies, argues that securing a cloud account is ordinary work that leaders must budget time for. He points to the AWS Well-Architected security pillar as the reference material and stresses writing down decisions, including decisions not to act. He explains regions and availability zones as a basis for later choices, and advises against defaulting new workloads to us-east-1, where new services tend to launch first.

The middle of the talk is a checklist for a new account. Set a billing alert sized to the business so a hijacked account shows up quickly, and send it to a shared inbox and chat channel rather than one person. Use Cost Explorer to find waste; one development database instance that ran around the clock was scheduled to switch off overnight, cutting its cost by about 60 percent. CloudTrail should be searched to trace which person made which API call. The root account should get a long password kept offline, MFA, and an alert on any root login, with a separate administrator user doing daily work. MFA for IAM users needs a custom policy, roles replace long-lived access keys for applications, and Secrets Manager with namespaced names keeps secrets manageable.

The closing message is that most AWS problems are people problems. He recommends a small set of groups such as administrators, developers and senior developers, attaching policies to groups rather than individual users because each group has a ten-policy limit, and announcing changes before enforcing them. When bringing in an outside consultant, he advises asking for documentation and knowledge transfer so the client can maintain the account afterward.