DEV Community: Aayush Bhadana

AWS IAM Security Best Practices: Enforcing Least Privilege via CLI

Aayush Bhadana — Mon, 24 Aug 2026 14:17:15 +0000

Identity and Access Management (IAM) is the backbone of AWS security. However, misconfigured IAM policies often grant excessive permissions, leading to potential data breaches and unauthorized resource access.
Adhering to the Principle of Least Privilege (PoLP) ensures that users, roles, and services only possess the exact permissions required to perform their tasks. In this guide, we will audit and enforce basic IAM security hardening using the AWS CLI.
Prerequisites
*AWS CLI installed and authenticated with administrative privileges.
*Basic understanding of JSON policy syntax.

Step 1: Enforcing Strong Password Policies for IAM Users

If your organization uses IAM users alongside AWS SSO, enforcing a strict password policy across the account is mandatory.
Run the following command to enforce minimum password length, symbol requirements, and password expiration:

aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters --allow-users-to-change-password --max-password-age 90 --password-reuse-prevention 5

To verify the updated account policy:

aws iam get-account-password-policy

Step 2: Auditing Unused Credentials and Access Keys

Stale access keys are a major vulnerability. AWS allows you to generate a Credential Report to audit inactive access keys and MFA status across all users.
Generate the report:

aws iam generate-credential-report

Fetch and decode the generated CSV report using standard Linux CLI tools:

aws iam get-credential-report --query 'Content' --output text | base64 -d

Review the output to identify users who haven't logged in recently or lack Multi-Factor Authentication (MFA).

Step 3: Deactivating and Deleting Unused Access Keys

Once an inactive access key is identified, deactivate it immediately before permanent deletion.

aws iam update-access-key --user-name dev-user-01 --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive

Delete the access key after verifying no services break:

aws iam delete-access-key --user-name dev-user-01 --access-key-id AKIAIOSFODNN7EXAMPLE

Summary

Securing AWS IAM is a continuous process. By regularly auditing credential reports, enforcing strong password rules, and removing stale access keys via the AWS CLI, you significantly shrink your cloud attack surface.

Hardening Arch Linux Cloud Servers using UFW and Fail2Ban: A Practical Guide

Aayush Bhadana — Mon, 24 Aug 2026 14:12:10 +0000

Deploying an Arch Linux server in the cloud gives you absolute control over your environment, but out-of-the-box minimal installations leave your SSH port exposed to automated brute-force botnets.
To secure a cloud instance effectively, implementing a network firewall combined with an automated intrusion prevention system is essential. In this guide, we will configure Uncomplicated Firewall (UFW) and Fail2Ban on Arch Linux to lock down non-essential ports and automatically ban malicious IP addresses.
Prerequisites
*A running Arch Linux instance with sudo privileges.
*Basic familiarity with Systemd services (systemctl).

Step 1: Installing and Configuring UFW (Uncomplicated Firewall)

While Arch Linux defaults to iptables or nftables, UFW provides a manageable CLI interface to handle packet filtering without syntax overhead.
First, update your package database and install UFW:

sudo pacman -Syy ufw

Before enabling the firewall, always explicitly allow SSH traffic, otherwise you will immediately lock yourself out of your remote server.
Set default policies to deny incoming and allow outgoing traffic

sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH traffic (Port 22 or your custom SSH port)

sudo ufw allow 22/tcp

(Optional) Allow standard web traffic if running Nginx/Apache

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Enable the UFW service and ensure it starts on system boot:

sudo ufw enable
sudo systemctl enable ufw

To verify active rules:

sudo ufw status verbose

Step 2: Preventing Brute-Force Attacks with Fail2Ban

While UFW restricts open ports, botnets can still spam your open SSH port with thousands of authentication attempts. Fail2Ban inspects log files (like journalctl) and alters UFW rules to dynamically ban offending IPs.
Install Fail2Ban via pacman:

sudo pacman -S fail2ban

Fail2Ban uses a local configuration file jail.local to override default settings safely. Create and edit this file:

sudo nano /etc/fail2ban/jail.local

Paste the following baseline security configuration:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 3
[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = systemd

Save the file, then enable and start the Fail2Ban service:

sudo systemctl enable --now fail2ban

Step 3: Monitoring Banned IPs and Testing

To verify that Fail2Ban is actively parsing logs and protecting your SSH daemon, check the status of the sshd jail:

sudo fail2ban-client status sshd

If an attacker fails 3 password attempts within 10 minutes, Fail2Ban automatically appends a temporary drop rule directly to your UFW engine. To manually unban an IP (e.g., if you accidentally lock yourself out from another network):

sudo fail2ban-client set sshd unbanip <TARGET_IP_ADDRESS>

Summary

Combining UFW's static packet filtering with Fail2Ban's dynamic log monitoring establishes a robust baseline defense for any Arch Linux cloud server. This layered approach stops port scanners and mitigates automated SSH attacks before they can consume system resources.

How to Secure AWS S3 Buckets Using AWS CLI on Linux: Step-by-Step

Aayush Bhadana — Mon, 24 Aug 2026 14:02:45 +0000

Exposed AWS S3 buckets are one of the most common vectors for cloud data breaches. While the AWS Management Console provides a GUI to configure bucket policies, using the AWS CLI on a Linux environment offers a faster, scriptable, and audit-friendly approach to security hardening.
In this guide, we will walk through restricting public access, enabling server-side encryption, and enforcing HTTPS-only traffic for S3 buckets using the AWS CLI.
Prerequisites
AWS CLI installed and configured with valid IAM credentials.
Basic familiarity with Linux terminal commands and JSON syntax.
Step 1: Block All Public Access
The first line of defense is ensuring public access to your bucket is completely blocked at the bucket level.
Run the following command to apply the PublicAccessBlock configuration:

aws s3api put-public-access-block --bucket your-secure-bucket-name --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

To verify the configuration:

aws s3api get-public-access-block --bucket your-secure-bucket-name

Step 2: Enable Default Server-Side Encryption (SSE-S3)
Encrypting data at rest is critical. You can enforce AES-256 encryption on all newly uploaded objects using this command:

aws s3api put-bucket-encryption --bucket your-secure-bucket-name --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

Step 3: Enforce HTTPS Transport (SSL Only) via Bucket Policy
To prevent man-in-the-middle (MitM) attacks, configure a bucket policy that denies any unencrypted HTTP requests

(aws:SecureTransport: false)

.
Create a policy with the following JSON structure:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSSLRequestsOnly",
"Effect": "Deny",
"Principal": "",
"Action": "s3:",
"Resource": [
"arn:aws:s3:::your-secure-bucket-name",
"arn:aws:s3:::your-secure-bucket-name/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}

Apply the policy using AWS CLI:

aws s3api put-bucket-policy --bucket your-secure-bucket-name --policy file://policy.json

Summary
By automating S3 security hardening via the AWS CLI, you significantly reduce human error and align with AWS cloud security best practices. Integrating these commands into deployment pipelines ensures that infrastructure remains secure by default.