We moved everything to AWS — is there a DIY security checklist we can run through?

Three urgent things you need to do today: 1) Set up Billing Alerts; if there's an unauthorized cryptomining attempt, you'll know before your account racks up thousands of pounds in charges. 2) Verify that CloudTrail logging is enabled across all regions. 3) Confirm that automated database backups are turned on.

Since you store customer financial data under UK data protection regulations (UK GDPR), legal liability rests directly on company directors. Even if you don't commission a full-scale external penetration test, I strongly recommend documenting these security checks with dates and screenshots.

When we audited after a similar migration last year, we found that the external contractor had left an admin-level API key sitting on their local machine. That key was exposed for 4 whole months. Luckily, nothing leaked, but ever since then, we audit IAM keys on the first Monday of every month.

Head over to the IAM console and download the 'Credential Report'. That single file will show you in one table which users haven't enabled MFA, when each access key was last used, and how old passwords are. You'll catch your biggest blind spots within the first 10 minutes.

If we completely block public access on S3 will that affect customer invoice PDFs? They download documents through the app, so I wasnt sure if locking that down would throw errors for end users.

The general rule for S3 access is simple: files shouldn't be directly accessible to the public internet. When serving a file to a customer, your application generates temporary presigned URLs behind the scenes. That keeps your bucket completely closed to the outside world while giving the authenticated user a secure 5-minute download link.

Everyone talks about turning on security tools and logging, but no one mentions the cost. If you blindly enable security and monitoring services across all regions, you'll end up paying more for logs at the end of the month than for your actual production servers. Only enable them in the active regions you actually use.

First thing you should do is check the Trusted Advisor dashboard. Even the free tier raises red flags for core security gaps, open ports and root account MFA status. Just clearing out the red alerts there will eliminate the vast majority of your risk.

Quick summary for newcomers: If you scold false alarms nobody will report again.

I'm also curious if anyone does it differently.

Here's how it went for us. Everyone rushing into AWS security checklist gets stuck at the same point.

Don't rely on a single measure; go layer by layer. If you post the result here, it will help others too.

Sorry, but this doesn't apply in every case. Everyone rushing into AWS security checklist gets stuck at the same point.

Just leaving this note it might be useful.

Thanks this was very helpful.

I went through the same thing two years ago. Forgotten test environments are more often the entry point than live systems.

If you have questions, write them; I'll answer as best I can.

Let me clarify the technical side. Don't rely on a single measure; go layer by layer.

Good call starting this thread. The biggest time-waster for us was not knowing who had the final say.

Hasty decisions become decisions you have to fix six months later. This is my opinion I'm not claiming it's absolute truth.

Following.

The opposite happened to me that's why I'm writing. honestly solutions that work at a small scale collapse when you grow; I learned this late.

That's all sorry if I went on too long.

The most overlooked point about AWS security checklist is this: Just because everyone does it doesn't mean it's right.

This is my opinion, I'm not claiming it's absolute truth.