AWS without traps: seven settings that matter from day one

A concise AWS configuration checklist: MFA/IAM security, budgets, CloudTrail logs, VPC networking, SSM access and backups. Concrete steps without the padding.

The full article is available below. Enable JavaScript to use quizzes and simulations.

AWS without traps: seven settings that matter from day one

When creating your first AWS resources, it is easy to make the classic mistake: launch the serviceand only then “sort out security, logs and costs”. That leads to unnecessary risk and bills.

Here is a short checklist of things I configure almost every time, even in small projects.

1) MFA and orderly accounts

  • Enable MFA for root.
  • Use root only for critical operations.
  • For yourself and the team: separate IAM accounts / IAM Identity Center.

Goal: no “root + password” logins.

2) IAM: least privilege

  • Create roles and policies granting only what is needed.
  • Avoid AdministratorAccess in everyday work.
  • Use application roles, for example for ECS/EC2/Lambda, instead of keys.

Goal: limit the damage even if something leaks.

3) Budgets and cost alerts

  • Configure AWS Budgets.
  • Enable email alerts at 50/80/100%.
  • Check forecasts and the biggest cost items in Cost Explorer.

Goal: cost control from day one.

4) CloudTrail and change logging

  • Enable CloudTrail for the account.
  • Send logs to S3 with retention, preferably with MFA delete.

Goal: know who changed what, even weeks later.

5) Networking: a sensible minimum VPC

  • Use public subnets only for components that must be public.
  • Keep everything else in private subnets.
  • Security groups: open as few ports as possible, not access “from anywhere”.

Goal: a secure foundation for growth.

6) Instance access without SSH: SSM

  • Instead of port 22/SSH: AWS Systems Manager (Session Manager).
  • Fewer open ports, fewer keys and more control.

Goal: simpler, safer administration.

7) Backups and retention

  • RDS: automated backups with sensible retention.
  • S3: versioning and lifecycle rules.
  • Snapshots of critical data.

Goal: a failure does not end the project.

A brief recap

These seven steps make your AWS environment safer, cheaper to maintain, easier to audit and ready to scale.

If you would like, I can prepare a PDF checklist and example Terraform for this configuration.