AWS got safer by default. Your old accounts did not.

AWS has spent the last few years changing defaults in the right direction. The catch is in the fine print: most of those changes apply to new resources. A bucket created in 2019 still has 2019’s settings, and that’s where most surprises live.

S3: the defaults changed in 2023

• Encryption. Since January 2023, S3 encrypts every new object with SSE-S3 by default.
• Block Public Access and ACLs. Since April 2023, new buckets come with Block Public Access turned on and ACLs disabled (Object Ownership set to “bucket owner enforced”).

Older buckets didn’t change. Check them:

• Turn on Block Public Access at the account level, not only per bucket. Any bucket that really needs to be public should be the documented exception, ideally served through CloudFront instead.
• Set Object Ownership to bucket owner enforced. Anything that still depends on ACLs will show up quickly, and it’s worth knowing what that is.
• Look for bucket policies with "Principal": "*" that have no condition attached.

EC2: require IMDSv2

The instance metadata service hands out credentials for the instance role. IMDSv1 answers simple GET requests, which is what made server-side request forgery bugs so damaging. IMDSv2 requires a session token first.

You can set an account-level default per region so that new instances require IMDSv2, and newer instance types are moving to IMDSv2 only. For existing instances, the CloudWatch metric MetadataNoToken tells you whether anything still calls IMDSv1. When it stays at zero, require tokens and move on.

EBS: encryption is an account setting

EBS encryption by default is still something you turn on, per region. Turn it on everywhere, including regions you don’t use, because that’s exactly where an attacker would launch resources.

Root and identity

AWS has been rolling out mandatory MFA for root users since 2024. Check that every root user has MFA, that no root access keys exist, and that root email addresses go to a mailbox a team monitors, not to someone who left. In an AWS Organization, member accounts can use centralized root access management, so they don’t need standing root credentials at all.

Turn on the things that only work if they’re on

Some protections can’t help after the fact:

• CloudTrail keeps 90 days of management events by default. An organization trail writing to a locked-down bucket keeps them as long as you need, including for accounts you forgot about.
• GuardDuty and Security Hub have to be enabled per account and region, ideally from the organization’s delegated administrator account.
• IAM Access Analyzer finds resources shared outside your organization. Run it once and you’ll learn something.

Write it down as policy

Fixing settings once is a cleanup. Keeping them fixed takes service control policies: deny turning off Block Public Access, deny launching instances without IMDSv2, deny disabling CloudTrail. The new defaults protect new resources. Policies protect you from the next exception someone files.