Hi,

When I look inside an AWS account for the first time, I rarely find anything exotic.

I find the same three IAM mistakes. Over and over. And none of them needs a security team to fix. Each one takes less than an hour.

1. Daily work as the root user.
Root is the email you signed up with. It can close the account, change billing and remove every safeguard. One phished password and it's all gone.

Turn on MFA for root, delete any root access keys, and do your daily work through a role (IAM Identity Center is the cleanest way). Use root only for the few tasks that need it, then log out.

2. Admin rights for everyone.
"Just give them AdministratorAccess so nothing breaks" works until one developer laptop is compromised and the attacker gets the whole account.

Make read-only the default. Create small, specific roles for real jobs, like deploying one app. When someone needs more, they ask, and the request becomes the record of why.

3. No audit trail.
When something goes wrong, the first question is "who did what, and when?" Without CloudTrail you can't answer it.

Turn on a multi-region trail to your own S3 bucket. The first trail of management events is free. Then add one alert: anyone signing in as root. In a healthy account that almost never happens.

Root locked. Read-only by default. Everything logged.

If you only have one afternoon for AWS security this month, spend it on these three.

The full post, with the Terraform for each fix and a one-hour checklist: 3 AWS IAM mistakes I find in almost every account

Ship safely,
Umar

P.S. Not sure which of these your account has? Hit reply, or grab a Free AWS Review and I'll check for you.