AWS Security Hardening Checklist: The Practical Version
Day 21: AWS Security Hardening Practice Here's the hardening script I run on every new AWS account. It catches the misconfigurations that show up in 90% of security audits. Audit IAM Users for Console Access
Day 21: AWS Security Hardening Practice
Here's the hardening script I run on every new AWS account. It catches the misconfigurations that show up in 90% of security audits.
Audit IAM Users for Console Access Without MFA
Before touching infrastructure, check identity:
aws iam generate-credential-report > /dev/null 2>&1
sleep 5
aws iam get-credential-report --query 'Content' --output text | \
base64 -d | \
awk -F',' 'NR>1 && $4=="true" && $8=="false" {print "NO MFA:", $1}'
This pulls the credential report and finds every IAM user who has console access but no MFA enabled. These accounts are one phished password away from full compromise.
Detect Unused Access Keys
Access keys that haven't been used in 90+ days are a liability:
import boto3
from datetime import datetime, timezone, timedelta
iam = boto3.client('iam')
threshold = datetime.now(timezone.utc) - timedelta(days=90)
for user in iam.list_users()['Users']:
keys = iam.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
for key in keys:
if key['Status'] == 'Active':
last_used = iam.get_access_key_last_used(
AccessKeyId=key['AccessKeyId']
)['AccessKeyLastUsed']
used_date = last_used.get('LastUsedDate')
if not used_date or used_date < threshold:
print(f"STALE: {user['UserName']} - {key['AccessKeyId']}")
Deactivate stale keys immediately. If nobody complains within a week, delete them.
These two checks plus the S3 and IMDSv2 hardening from the full post cover the top four AWS attack vectors.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.