Recommended Free Tools
There is no official AWS list of 12 universally insecure defaults. The phrase “defaults” here means settings teams may leave unchanged or misconfigure—not a claim that AWS ships every service insecurely. For example, Amazon S3 encrypts new objects at rest with S3-managed keys by default, and CloudTrail encrypts delivered trail log files with SSE-KMS by default. The checks below focus on decisions that can expose data or leave gaps in protection and audit coverage.
Each fix is scoped to a service or setting. Some are commands or policy changes; others are choices that need to be made in the right account, Region, or identity system. Treat the examples as changes to assess and test in your environment, not as a universal one-line security guarantee.
As an Amazon Associate I earn from qualifying purchases.
Which AWS settings should you check before production?
Start with controls that can expose data, then confirm encryption and audit coverage. Public access and snapshot sharing are resource-level risks; EBS encryption by default is an account-and-Region setting; CloudTrail coverage depends on what you configure it to record.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →1. S3 public access: block it unless the bucket must be public
Public access is a configuration choice, not a universal S3 default. AWS recommends blocking public access unless a workload intentionally serves public content. Review bucket policies for broad principals such as "Principal": "*", overly broad actions, and permissive access control lists.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Fix: Enable the relevant S3 Block Public Access controls at the account or bucket scope. The account-level setting is broader; bucket-level controls address an individual bucket. If the bucket intentionally hosts public content, document that exception and check that the exposure is limited to the intended content.
2. S3 transport security: deny HTTP requests
Encryption at rest does not ensure that requests to a bucket use HTTPS. A bucket policy can deny requests when the aws:SecureTransport condition is false.
Fix: Add a bucket-policy deny for requests where aws:SecureTransport is false. Apply it to the intended bucket and objects, and test legitimate access paths—including integrations and older clients—before enforcing it broadly. A transport-policy change can break clients that still use HTTP.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. S3 encryption at rest: keep the default, or require KMS for a specific reason
S3 applies server-side encryption with S3-managed keys (SSE-S3) to new objects by default. Do not treat missing at-rest encryption as an S3 default problem. Some organizations require SSE-KMS for customer-managed key control, governance, or key-use auditing; that is a distinct requirement, not evidence that SSE-S3 is absent.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Fix: If your requirement calls for KMS control, configure the bucket’s default encryption for SSE-KMS and ensure the relevant principals can use the key. Otherwise, keep the S3 default and verify that it meets your policy.
4. EBS encryption by default: enable it in every required Region
Amazon EBS encryption by default is an account-and-Region setting. When enabled, it encrypts new volumes and snapshot copies in that Region. It does not retroactively encrypt every existing volume.
Fix: Enable EBS encryption by default in each Region where you launch workloads. Separately inventory existing volumes and snapshots, then plan any needed migration or replacement; do not assume enabling the setting changes existing resources.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors5. EBS snapshots: remove public sharing
An EBS snapshot contains the volume’s data. Making it public can let other AWS accounts access that data. Keep snapshots private unless sharing is deliberate and the contents are appropriate to disclose.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Fix: Review snapshot permissions and remove public sharing. If another account needs a snapshot, grant access only to the intended account and verify that the snapshot contains no data it should not receive.
6. RDS snapshots: keep manual snapshots private
A publicly shared RDS snapshot can make its data available to all AWS accounts. This is not a safe shortcut for transferring a database backup.
Fix: Keep manual snapshots private. Share only with explicitly intended accounts, and only when the snapshot contents are suitable for that recipient.
7. CloudTrail: configure an ongoing trail with the coverage you need
CloudTrail’s recent event visibility is not the same thing as configuring an ongoing trail. A trail records events to a destination you configure; audit coverage also depends on the accounts, Regions, and event categories included. “CloudTrail is on” alone does not establish that your organization’s activity is being recorded as required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Fix: Create or validate an account or organization trail, and check its Region and account coverage and event configuration against your audit requirements. Decide which management events to record and confirm that the trail is delivering logs to its configured destination.
8. CloudTrail: enable S3 object-level data events when needed
CloudTrail management-event coverage does not automatically mean that object-level activity in S3 is recorded. Data events, such as object-level access, require trail configuration and can produce substantially different event volumes from management events.
Fix: Configure S3 data-event selectors for the buckets or resources whose object activity you need to audit. Choose scope deliberately, then confirm the events appear in the trail’s destination and account for the operational impact of the selected coverage.
9. CloudTrail log bucket: restrict access to logs
Trail logs can contain sensitive details about account activity. AWS recommends a dedicated S3 bucket and least-privilege access. A partial policy copied without adapting it to the trail and account can block delivery or grant the wrong access.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Fix: Use a dedicated destination bucket and restrict its policy to CloudTrail delivery and authorized audit roles. Validate that log delivery succeeds and that other users and workloads cannot read or alter the logs without a defined need.
10. CloudTrail log retention: set a lifecycle period deliberately
CloudTrail’s S3 log bucket does not impose a default expiration period on delivered logs; retention is indefinite unless you configure lifecycle management or otherwise remove them. That may exceed some policies, while deleting logs too soon may undermine audit or incident-response needs.
Fix: Set an S3 lifecycle rule only after choosing a retention period that meets legal, audit, and incident-response requirements. Ensure the rule applies to the intended log objects and review it alongside any archival or deletion obligations.
11. Account access: require MFA through the identity system you use
A single IAM-user setting does not cover every way people may access AWS. AWS recommends MFA, but the enforcement approach should match your identity setup, including centrally managed identities where applicable.
Fix: Enforce MFA through the account’s identity provider or access-management controls for the human access paths you use, and verify that administrators and other privileged users are covered. Do not assume that enabling MFA for one IAM user secures every identity path.
12. AWS connections: use supported TLS versions
AWS states in its CloudTrail data-protection guidance: “We require TLS 1.2 and recommend TLS 1.3.” The practical control depends on the client and service endpoint: an older SDK, command-line client, or application may not negotiate the version you expect.
Fix: Use current AWS SDKs, CLI versions, and client settings, and check endpoint or service policies where applicable. Verify the actual client-to-service path rather than treating one account-wide switch as a universal TLS control.
Quick Recap
How to apply the fixes without causing an outage
- Identify scope. Determine whether the control belongs at account, organization, Region, bucket, snapshot, trail, or identity-provider level.
- Check existing state. Review current policies, permissions, encryption settings, trail selectors, and client behavior before changing them.
- Test the effect. Use a non-production resource or a limited rollout where possible. Confirm required applications, integrations, and audit workflows still work.
- Verify the result. Check the effective setting and, for logging controls, confirm expected events reach the destination with the intended access restrictions.
- Record exceptions. Document any intentional public access, account sharing, excluded event scope, or retention choice, including its owner and reason.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
