12 AWS security best practices

Amazon Web Services (AWS) is the world’s largest cloud computing platform, used by millions of companies. However, using it requires new security skills. Without proper controls, companies risk malware attacks and data breaches.

Securing AWS-hosted apps and databases is not the same as guarding on-premises or remote networks. Cloud computing has specific challenges and requires specialized techniques for data protection. Our guide introduces AWS security best practices to help you use the cloud safely and productively.

Key takeaways

• AWS uses a shared responsibility model. AWS secures the cloud infrastructure, while service users protect their data, applications, and access settings.
• Security teams should maintain visibility across AWS assets, services, data, and required controls.
• IAM, MFA, least-privilege access, network segmentation, and strict controls for root accounts and EC2 services reduce the risk of unauthorized access.
• Sensitive data in AWS should be encrypted.
• Backing up critical data and patching AWS assets is essential for cloud security.
• AWS security services, such as Amazon GuardDuty, Amazon Inspector, AWS Security Hub, and AWS IAM, can help detect threats, find vulnerabilities, and manage access.

Challenges of working with AWS

Moving to the cloud requires a complete change in how you manage security. Security teams must consider more than just traditional perimeter and endpoint protection, as overlooking cloud-specific challenges can leave sensitive data exposed.

Core cloud challenges related to Amazon Web Services include:

• Understanding your role in the AWS cloud security. The cloud service provider and the service user have different security roles. AWS secures the cloud infrastructure, while the user secures their data, apps, and access settings.
• Ensuring visibility of AWS services. Security teams may lose track of the services they maintain. They may not even be aware when departments create new AWS containers or add services. A transparent and visible cloud service strategy helps companies control AWS security.
• AWS compliance. Companies using AWS must ensure cloud deployments meet relevant data protection regulations. Security teams must assess every app and storage solution against compliance goals and audit every cloud asset.
• Consistent security policy management. An organization’s cloud-based assets may include multiple IaaS platforms and large application portfolios. User communities also vary, including local staff, remote workers, and external partners, all of whom need to be managed. Security management systems and AWS native tools help apply policies consistently.

Understanding the AWS shared responsibility model

Amazon describes the AWS security services as a shared responsibility model. Security is divided between the client and AWS.

AWS provides security for the hosting infrastructure containing cloud applications. This includes regional data centers and the cloud infrastructure needed to access them worldwide.

Inside the cloud, AWS security covers the operating system and virtualization layer of the AWS environment. The foundations of IaaS platforms are strong, with active threat monitoring, logging, and constant software updates.

What does this leave for clients to secure? Everything else.

First, AWS users must secure their customers’ sensitive data. This includes data at rest locally, as it passes through cloud portals, and on the AWS environment itself. If a breach results from customer-controlled areas such as misconfigured access, exposed credentials, insecure applications, or unencrypted data, the AWS user may be responsible.

Customers are also responsible for access management. AWS provides guidance about blocking malicious actors. However, clients must implement user access controls at AWS endpoints.

Clients who choose an IaaS solution based on Amazon EC2 have greater security responsibilities. They must also manage cloud apps and ensure code integrity. Any guest apps added to an AWS cloud must be secured on the client side.

Additionally, AWS users must protect their operating systems, network configurations, and firewall configurations. They need to apply encryption and network traffic monitoring. Finally, clients must handle threat neutralization outside the cloud.

These AWS cloud security responsibilities may sound overwhelming. But by following AWS security best practices, companies can carry out digital transformations and minimize security risks.

AWS security best practices

AWS cloud security brings new challenges. Companies need to integrate the shared responsibility model into everyday planning. Here are some AWS security best practices to guide your strategy:

1. Use Amazon’s learning tools to build a knowledge foundation

Amazon is aware that AWS clients need assurance and strong security. That’s why the company has created its AWS Well-Architected Framework. The company created its AWS Well-Architected Framework (WAF) to help cloud security architects build secure and well-performing AWS cloud infrastructure.

Focus on the Security Pillar of the WAF as a starting point. This paper outlines recommendations for securing AWS apps, including basic security controls, incident response, and threat management. It also introduces the shared responsibility model, explaining what Amazon provides and what users need to do themselves.

2. Create a visibility plan for your AWS assets

AWS users must have an overview of their apps and storage containers before deploying security controls. A visibility plan that maps out your AWS assets is important.

This plan should include the purpose of each asset. It helps to create categories of cloud assets linked to workgroups and functions. Assign a security classification to each asset and consider the value of the data it processes or stores. Also, assess the importance of each asset to everyday workflows.

A good visibility plan makes it easy to assign security controls and secure cloud endpoints. It also simplifies the expansion of cloud deployments in the future without adding extra security vulnerabilities.

3. Plan an overall AWS cloud security strategy

You now know what needs to be protected. The next step is to create a cloud security architecture that secures cloud resources.

This step aims to provide consistent security policies across all cloud resources. Assess every cloud asset and assign appropriate security controls. Users must have sufficient privileges to access the critical workloads they require, but nothing more.

At this stage, security teams must think beyond traditional cybersecurity. Source cloud-native security tools and management systems that cover every endpoint and allow easy expansion when new services come online.

If you use Continuous Integration (CI) or Continuous Delivery (CD) for your AWS infrastructure, include it in the security strategy from the start. DevOps teams must know their security responsibilities, and security teams must have a plan to handle shadow IT.

4. Apply cloud security controls

Of all the AWS security best practices, this is the most important. Some applicable AWS security controls include:

• Protecting AWS accounts and cloud portals from unauthorized access with Identity and Access Management (IAM) tools. IAM tools assign role-based and temporary privileges to each AWS user. When you use IAM, users should have access only to the resources they need during specific projects or periods of employment.
• Securing access to AWS resources with multi-factor authentication (MFA). Your security strategy must also include password hygiene. Users should only use complex passwords that are time-limited and regularly updated. Permission timeouts can also prevent extended access outside project timeframes. They are useful for managing third-party access.
• Ensuring user accounts are revoked and rendered unusable when employees leave the organization or contractor partnerships end. Scheduled privilege audits are a reliable way to ensure this happens routinely and efficiently.
• Using the AWS account root user only for tasks that require root credentials, and protect root sign-in with multi-factor authentication (MFA). AWS recommends not creating root user access keys. If root access keys already exist, replace them with credentials for an appropriate IAM identity. Because the root user has full access to AWS services and resources in the account, compromised root credentials can expose the entire AWS account.
• Considering using network micro-segmentation to separate cloud access portals. Keep each AWS application in its own compartment to limit movement between them. If one access portal is breached, attackers won’t be able to move across your network and access other AWS services.
• Controlling access to Amazon Elastic Compute Cloud (EC2) on the AWS cloud. Attackers often use compromised Amazon EC2 instances to plant malware. Protecting your login credentials and access keys is essential. You can limit access based on the principle of least privilege to keep exposure minimal.

5. Encrypt data inside and outside the cloud

AWS offers the option to add an encryption layer for sensitive data stored in cloud containers and applications. Users can assign key management to Amazon or manage their own keys. APIs also make managing on-cloud encryption simple.

However, AWS customers must encrypt data both inside and outside the cloud. While AWS provides tools for on-cloud encryption, businesses must apply client-side encryption on local WANs and secure remote connections using VPNs. Unencrypted data flows may expose data to outsiders. Attackers can harvest credentials and use them to access cloud assets, making even strong on-cloud encryption worthless.

6. Train staff and make security policies accessible

AWS security policies must be visible to all stakeholders. This includes employees, third parties, management users, and regulatory authorities. Create a centralized repository for AWS security documentation stored on a secure internal server.

Documents might include encryption rules, backups, DevOps protocols, and access management processes. Ensure that every base is covered, resulting in consistent security policies for all cloud assets.

This security documentation should be adaptive. Security needs to change with cloud environments. For example, you may want to add new AWS services to security documents when they come online. Or IAM users may need guidance about multi-factor authentication. That way, every user knows how to use the cloud safely.

Provide fresh cybersecurity training for staff when transitioning to AWS. Include reminders of password hygiene and phishing awareness. And provide the information users need to access their workloads without compromising security.

7. Stage regular backups of critical data

Regular backups are a vital insurance policy against data loss and application failure. Amazon’s own AWS Backup service is a good starting point. It allows users to schedule backups of storage containers, databases, and file systems in their cloud environment. AWS Backup also includes a useful compliance tool that compares your current practices to relevant data protection regulations.

Consider enabling versioning and, where applicable, MFA Delete on an Amazon S3 bucket to add protection against accidental or unauthorized object deletion. Also, use IAM policies to restrict who can delete buckets or objects.

8. Implement a threat response system

AWS security best practices are not limited to threat prevention. Users must also have a strong plan to manage and neutralize attacks when they occur. Attackers can compromise even the strongest perimeter protections. Planning for failure is essential.

Collaborate with reputable security partners that offer real-time threat monitoring. Use threat intelligence to identify current risks. Proactive threat hunting is also advisable. This probes AWS assets for known malware, using cloud-based data analytics to detect advanced persistent threats.

Your on-cloud security systems should work smoothly with off-cloud security. Combine audits of local network infrastructure and remote devices with cloud inspection to cover every entry point and potential weakness.

9. Choose cloud-native AWS security solutions

AWS offers built-in security tools for detecting threats, finding vulnerabilities, managing access, and checking configurations. Services such as Amazon GuardDuty, Amazon Inspector, AWS Security Hub, and AWS IAM help teams monitor workloads, protect identities, and reduce security risks across AWS environments.

Cloud-based security systems provide visibility of all storage buckets and connected applications on your AWS platform. These tools reside next to cloud assets, covering endpoints that standard security tools may overlook. The result is strong security and optimized cloud access.

10. Make sure AWS assets are up to date

AWS users should prioritize application patching. Cloud-based apps are vulnerable to exploits and new threats, just like any other application. The latest version should be designed to mitigate new threats.

The AWS Systems Manager Patch Manager simplifies update management. This includes Windows and macOS apps, as well as virtual machine software and Linux operating systems. Users can patch fleets of EC2 devices and run scans of existing assets to identify necessary actions.

11. Manage devices with IP address allowlisting

IP allowlisting is a client-side control that allows access only from approved source IP addresses. Connections from IP addresses that aren’t on the allowlist can’t access AWS web gateways.

URL allowlisting can restrict which web destinations users may access. To limit inbound access to AWS resources, use controls such as security groups, network ACLs, private connectivity, VPNs, and IP allowlisting.

12. Conduct periodic security reviews

Taking charge of security in your AWS environment means scheduling regular security assessments and penetration testing. This helps you pinpoint and fix existing vulnerabilities efficiently.

By following a consistent review schedule, you ensure that your company’s defenses are always up to date. These regular reviews are key to continuous improvement, helping you stay ahead of modern cybersecurity challenges.

Follow best practices to create a secure cloud environment

Cloud security is challenging. But following the AWS security best practices outlined above can help prevent cloud security incidents. Implement cloud-native security solutions, apply the appropriate controls, and prepare your workforce to ensure optimal security. AWS offers a secure cloud hosting environment with the right measures in place.

Consider AWS security certification

Amazon realizes that clients have security concerns, and migrating to AWS presents a technical problem for existing security teams. The company has introduced various certification courses designed for AWS developers and security technicians.

Certification is recommended but not mandatory for AWS users. AWS certifications can assure clients that companies take data security seriously, while security courses teach security staff to manage threats and ensure the availability of cloud services. Together, they build organizational knowledge and strengthen a company’s security foundations.

Amazon organizes its certifications into the following levels: Foundational, Associate, Professional, and Specialty.

• Foundational qualifications apply to basic AWS Cloud and AI knowledge. These include the AWS Certified Cloud Practitioner and the AWS Certified AI Practitioner certifications.
• Associate certifications cover specific technical roles, such as Solutions Architect, Developer, CloudOps Engineer, Data Engineer, and Machine Learning Engineer.
• Professional certifications assess more advanced skills in areas such as solutions architecture, DevOps, and generative AI development.
• Specialty qualifications focus on specific technical areas. The AWS Certified Security – Specialty certification validates the skills of security professionals in areas such as detection, incident response, infrastructure security, identity and access management, data protection, and security governance. AWS introduced the current SCS-C03 version of this exam in December 2025.

AWS certification exam fees currently range from $100 for Foundational exams to $300 for Professional and Specialty exams, with Associate exams costing $150.

After passing the AWS examinations, candidates must recertify their skills every 3 years. This makes sense in a fast-moving security environment, and recertification should be added to cloud security plans.

AWS also offers fundamental training materials on security best practices. These materials introduce potential candidates to valuable topics and cover course content. Participants can attend virtual classes, although in-person training is also available.

Secure access to AWS with NordLayer

Cloud environment security is a key aspect of cybersecurity. Huge amounts of confidential data reside in the cloud. DevOps teams collaborate via cloud resources, while companies communicate using SaaS tools. These cloud resources are tempting targets for attackers.

NordLayer offers cloud-based tools that go beyond traditional security solutions. Customers can set up site-to-site VPN connections with AWS Transit Gateway using a NordLayer server with a dedicated IP. This encrypts traffic through the site-to-site VPN tunnel between NordLayer and AWS, helping protect data in transit between connected environments.

Our IP allowlisting tools allow you to allowlist the IP address of your NordLayer private gateway in AWS, helping restrict access to specific AWS resources. Create a dedicated secure connection for a NordLayer private gateway, with minimal access for outsiders.

Together, encryption, IP allowlisting, and access controls strengthen secure access to your AWS resources.

Resolve your cloud security issues and enjoy secure AWS hosting. Get in touch with the NordLayer team and explore our cloud-based products today.