AWS Security Best Practices for Small Businesses

Attackers routinely scan for exposed AWS credentials, open storage buckets and unprotected management ports, and small organizations are not exempt. The good news is that a short list of well-understood controls blocks most real-world attacks on AWS. This guide covers those controls in priority order for small businesses and nonprofits. It aligns with the security pillar of the AWS Well-Architected Framework and the foundation work on our AWS consulting page.

What is the shared responsibility model on AWS?

AWS is responsible for security of the cloud, and you are responsible for security in the cloud. Most AWS security incidents result from customer-side configuration, not AWS infrastructure failures.

How do you secure identity and access on AWS?

Lock down the root user, give every person single sign-on with MFA, and replace long-lived keys with roles. Compromised credentials are the most common starting point for AWS breaches.

Identity checklist

• ☐Enable MFA on the root user of every account, store credentials securely and use root only for tasks that require it.
• ☐With AWS Organizations, consider centralized root access management to remove root credentials from member accounts.
• ☐Use IAM Identity Center for all human access, connected to Microsoft Entra ID, Google Workspace or another identity provider where possible.
• ☐Require MFA for every user, preferring phishing-resistant methods such as passkeys or security keys for administrators.
• ☐Assign permission sets by job function, starting from least privilege.
• ☐Delete IAM users with access keys, or rotate and restrict any that must remain.
• ☐Use IAM roles for EC2, Lambda and containers, never embedded access keys.
• ☐For CI/CD, use OpenID Connect federation, for example from GitHub Actions, instead of stored keys.
• ☐Review unused permissions and roles with IAM Access Analyzer.

How should you structure accounts and guardrails?

Use multiple accounts with preventive and detective guardrails applied centrally. Accounts are the strongest isolation boundary on AWS.

• Separate accounts for production, non-production, shared services, log archive and security tooling.
• Service control policies (SCPs) to prevent disabling CloudTrail or GuardDuty, restrict regions, and block root user actions in member accounts.
• AWS Control Tower to deploy a governed landing zone with preconfigured controls.
• Delegated administration of GuardDuty, Security Hub and Config to a dedicated security account.

Our AWS landing zone guide walks through the account structure step by step.

How do you detect threats and misconfigurations?

Enable organization-wide logging, threat detection and posture management, and route findings to someone who will act. Prevention eventually fails, so detection determines impact.

Send high and critical findings to email, chat or a ticketing system using Amazon EventBridge, and agree on who responds and how fast.

How do you protect data on AWS?

Block public access by default, encrypt everything and control who can use the keys. Exposed S3 buckets remain one of the most common causes of cloud data leaks.

Data protection checklist

• ☐Enable S3 Block Public Access at the account level, with documented exceptions only for intentionally public content served through CloudFront.
• ☐Turn on default encryption for EBS volumes in every region.
• ☐Encrypt RDS databases and snapshots, and keep databases in private subnets.
• ☐Use AWS KMS customer managed keys for sensitive data where you need control over key policies.
• ☐Store secrets in AWS Secrets Manager or Systems Manager Parameter Store, not in code or environment files.
• ☐Enable S3 versioning and consider Object Lock for critical data.
• ☐Use Amazon Macie where you need to discover sensitive data in S3.

How do you secure networks and workloads?

Keep servers and databases private, expose only what must be public, and manage instances without open admin ports.

• Place EC2 instances and databases in private subnets, with load balancers in public subnets.
• Never allow SSH (22) or RDP (3389) from the internet. Use AWS Systems Manager Session Manager instead.
• Write security groups that reference other security groups rather than broad IP ranges.
• Put AWS WAF in front of public web applications and APIs.
• Patch EC2 instances with Systems Manager Patch Manager on a schedule.
• Scan container images and dependencies in your pipeline, as described in our DevSecOps guide.

How do you prepare for incidents and recovery?

Have backups an attacker cannot delete and a simple, rehearsed response plan. Ransomware and credential theft target backups first.

• Use AWS Backup with backup vaults in a separate account and Vault Lock where appropriate.
• Test restores at least twice a year and document recovery times.
• Write a short incident response runbook: who to call, how to revoke credentials, how to isolate an instance, and how to contact AWS Support.
• Set billing alarms, since unexpected spend can be the first sign of compromised credentials used for crypto mining.

Security for nonprofits and regulated organizations

Nonprofits handling donor, client or health data and businesses subject to HIPAA or PCI DSS should map these controls to their obligations. AWS Artifact provides AWS's compliance reports, and Security Hub standards help track posture, but compliance still depends on your configuration and processes. For a broader checklist that includes endpoints and email, see our IT security checklist for small businesses.

Get an AWS security review

Desai InfoTech reviews AWS environments against these practices as part of an AWS Well-Architected review and delivers a prioritized fix list. If you also run Azure, see our Azure security assessment. To get started, request a free cloud assessment.