Ask yourself the following questions, answer honestly, and make it a priority to resolve any questions where the answer is no:
- Do you have Business Support or greater enabled on all production accounts?
- Do you use IAM users or federated users instead of the root user login for routine access to your account?
- Do you have IAM users or some sort of user federation in place?
- Have you enabled Multi-Factor Authentication (MFA) on the root account?
- Have you enabled AWS CloudTrail on all accounts and in all regions?
- Are you storing all CloudTrail logs in a separate administrative domain (a separate AWS account or equivalent)?
- Is the CloudTrail log storage tamper-resistant?
- Have you enabled MFA on all interactive IAM accounts?
- Are you rotating all IAM user credentials regularly?
- Have you configured a strong password policy for your users?
- Does each user have their own dedicated IAM or federated user account?
- Are IAM policies for users and applications scoped down to the least privilege?
- Do you have any hardcoded credentials?
- Are all stored credentials encrypted at rest?
- Are you regularly backing up your data?
- Are you testing data recovery on a regular schedule, and after any significant application changes?
- Do you have a Recovery Point Objective (RPO) and Recovery Time Objective (RTO) defined for your services?
- Is your RTO less than 1 day for all critical services?
- Is your Disaster Recovery (DR) plan tested regularly, and after all significant application changes?
- If any of your S3 buckets have public access, has this access been reviewed to make sure it is necessary, and are controls in place to limit access to data that should not be public?
- Are your buckets that should not be public configured correctly to prevent public access?
- Do you have monitoring in place to alert you if a bucket is made public?
- If you require access to customer accounts, do you use cross-account roles instead of IAM users?
Did you answer no to any of those questions? If so, you could be placing your business and your customers at risk.