Hardening an AWS Organization in 30 days: a practical checklist

This post is the boring, deliberate version of what I usually do in the first month on an AWS engagement when the answer to "how is access managed?" involves the words shared spreadsheet. Nothing here is novel — but the order matters, and so does ruthlessly skipping nice-to-haves until the basics are in place.

Week 1 — Stop the bleeding

Before touching architecture, kill the obvious risks. Most of these are one-evening fixes.

• Rotate the root credentials on every account; lock the root user with a hardware MFA and a password nobody knows.
• Enable aws-organizations if it isn't on. You don't have to move accounts yet — just stop creating new ones outside it.
• Enable CloudTrail org-trail to a dedicated logging account, with object-lock S3 and a delete-protection SCP. If you only do one thing this week, do this.
• Enable Security Hub + GuardDuty across all regions you use. Yes, all of them. Attackers don't respect your "we only use eu-north-1" diagram.
• Inventory IAM Users with long-lived access keys. Tag each with an owner. Anything without an owner in 7 days gets disabled.

At the end of the week you should have: a tamper-evident audit log, a baseline of detection, and a list of every human and machine identity. That's the floor.

Week 2 — Identity

This is where you trade convenience for a system you can actually reason about. IAM Users for humans is the original sin of AWS — fix it once.

• Stand up IAM Identity Center (formerly SSO) in the management account, attached to your existing IdP (Okta, Entra ID, Google Workspace, whatever).
• Design permission sets by job, not by person. Developer, SRE, SecurityAuditor, BillingAdmin. Resist the urge to create one per team — that path leads to drift.
• Replace human IAM users with SSO assignments. Deprecate the old users — first deny console, then deny all, then delete after 14 days.
• For workloads: switch GitHub Actions (and similar) from long-lived AKIA… keys to OIDC federation. The diff is small; the risk reduction is enormous.

Quick SCP — block IAM users in member accounts

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyIamUsers",
    "Effect": "Deny",
    "Action": ["iam:CreateUser", "iam:CreateAccessKey"],
    "Resource": "*"
  }]
}

Attach to every OU except the management account. Future-you, scanning for fresh IAM users two years from now, will thank present-you.

Week 3 — Network and data

The "secure defaults" most teams skip because nothing is currently broken.

• Public S3 buckets: enable account-level block public access. Override only with a written exception per bucket.
• Default VPCs in every region: delete unless used. They are flat, internet-facing and forgotten.
• EBS encryption by default: turn it on per region. Costs nothing, prevents one of the easier mistakes.
• VPC Flow Logs to the logging account. Sample at first if cost matters, full later.
• If you have RDS / EKS / OpenSearch: confirm they're in private subnets, scanning is on, and snapshots are encrypted.

Week 4 — Guardrails and handover

You now have audit, identity and a baseline. Make it sticky.

• Define your final OU structure (e.g. Workloads/Prod, Workloads/Dev, Sandbox, Suspended) and move accounts into it.
• Apply a small set of SCPs at the OU level. My rule: no SCP that nobody on the team can explain in 30 seconds.
• Bake the baseline into Terraform (or Control Tower customizations) so the next account is born hardened.
• Write a short runbook: how to provision a new account, how to add a permission set, how to break-glass into root. Keep it under one page.
• Schedule a "what changed" review every quarter. Drift always wins if you don't.

What I'd cut

If you only have two weeks, drop weeks 3 and 4. Identity + audit logs is 80% of the value. Network and OU polish can wait — what cannot wait is "who is currently logged into prod, and how would we know".

The point isn't to be impressive. It's to make the next year less surprising than the last.

If this rings true for your environment — or you'd rather not do it alone — say hello.