Cloud
Guardrails

Creating IAM roles that have the necessary permissions, and then assigning those roles to the IAM users who require access to the resources allows you to centralize the management of permissions.

Always

Limit the creation of new IAM users, and prefer using IAM roles when possible.

Always

Rotate IAM access keys where IAM users are still required

To IAM users

Avoid using IAM users for popular services by creating a pattern to enable OIDC integrations.

Always

Restrict OIDC integrations so you don't have backdoor or rogue access.

Always

Limiting engineers' access to production environments by managing infrastructure through Infrastructure as Code (IaC), enforcing identity-based changes, multi-party approval, MFA, and security linting helps ensure accountability, consistency, and reduces security risks.

Applies when a robust IaC CI/CD workflow is in place

Set up baseline security services by default (logging, monitoring, IAM, etc.) and prevent them from being removed.

This best practice applies particularly when using AWS Organizations to centrally manage multiple AWS accounts as a single entity.