AWS Security Hardening Checklist: The Practical Version

Day 21: AWS Security Hardening Practice

Here's the hardening script I run on every new AWS account. It catches the misconfigurations that show up in 90% of security audits.

Audit IAM Users for Console Access Without MFA

Before touching infrastructure, check identity:

aws iam generate-credential-report > /dev/null 2>&1
sleep 5
aws iam get-credential-report --query 'Content' --output text | \
  base64 -d | \
  awk -F',' 'NR>1 && $4=="true" && $8=="false" {print "NO MFA:", $1}'

This pulls the credential report and finds every IAM user who has console access but no MFA enabled. These accounts are one phished password away from full compromise.

Detect Unused Access Keys

Access keys that haven't been used in 90+ days are a liability:

import boto3
from datetime import datetime, timezone, timedelta

iam = boto3.client('iam')
threshold = datetime.now(timezone.utc) - timedelta(days=90)

for user in iam.list_users()['Users']:
    keys = iam.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
    for key in keys:
        if key['Status'] == 'Active':
            last_used = iam.get_access_key_last_used(
                AccessKeyId=key['AccessKeyId']
            )['AccessKeyLastUsed']
            used_date = last_used.get('LastUsedDate')
            if not used_date or used_date < threshold:
                print(f"STALE: {user['UserName']} - {key['AccessKeyId']}")

Deactivate stale keys immediately. If nobody complains within a week, delete them.

These two checks plus the S3 and IMDSv2 hardening from the full post cover the top four AWS attack vectors.