Most of the developers and system admins start with the AWS one-year free tier account.
There have been many hacking incidents involving such accounts that resulted in huge monthly bills (e.g., Bitcoin miners). This happens for many reasons.
For example, if you accidentally commit code to a public repository that contains your AWS access keys and secret keys, a hacker could gain access to your account and launch high-capacity instances for their own computing needs.
This would result in a huge monthly usage bill. However, you can prevent your account from being hacked by implementing a few security policies and following AWS security best practices.
This article will explain 18 best practices you can follow to use and securely build applications on the AWS cloud.
18 Ways To Secure Your AWS Account
#1: Create an IAM user with the required privileges for you, even if you have root access. Do not use your root account except for billing purposes. Also, make use of AWS ARNs to restrict permissions at a granular level.
#2: Use a strong password of more than 10 characters for your root account.
#3: Enable a strong password policy with password expiration for IAM users.
#4: Enable MFA (Multi-Factor Authentication) for your root account and all IAM user accounts.
#5: Do not create AWS access keys unless needed. Instead, make the existing keys inactive when not used.
#6: Never hard-code your access keys in your code, as they could be committed to a public repository.
#7: Never store your access keys and secret key in EC2 instances or any other cloud storage. If you need to access AWS resources from an EC2 instance, use an IAM role for EC2.
#8: Never allow all ports in security groups for your instances. Allow only required ports for your applications. While doing POCs, you can apply your public IP as a source rather than 0.0.0.0/0. If you choose my IP, it automatically detects your public IP.
#9: When launching instances for testing or POCs, always review all configurations and don't rely on default settings. Especially security groups.
#10: Use VPC NACLs to add an additional layer of security.
#11: Never send your AWS credentials over email. If you do, change the password as soon as possible.
#12: If you plan to host your website on a Windows server, install a good antivirus.
#13: If you have more instances in a VPC, use a Jump Server to connect to those machines or use Virtual VPN appliances like OpenVPN.
#14: Do not launch instances in the public subnet unless required.
#15: Use NAT instances to patch your private instances rather than attaching an internet gateway to the private subnet.
#16: Set billing alerts and resource monitoring using CloudWatch and SNS.
#17: Enable the CloudTrail service, which logs all activities for your AWS account, including API requests. You can use CloudWatch in conjunction with CloudTrail to receive notifications about suspicious activity. (For example, data transfer of more than 10 GB).
#18: Make use of AWS Well-Architected tool that describes the key concepts, design principles, and architectural best practices for designing and running workloads in the cloud.
I have listed out all the preliminary security measures you should take to secure your AWS accounts.
If you are going to use your AWS account for any production workloads, you should go through all the AWS security whitepapers and follow the AWS Well-Architected Framework.
Let me know if there is anything I missed in the comment section that would enhance the security of the AWS account.