Two basic principles will take you far with regards to AWS security:
1. Avoid long lived credentials (access key/secret key pairs) and IAM users whenever possible, and instead have everything assume roles for access to resources in the same as well as other accounts. Temporary credentials from STS are the way to go.
2. Turn on IMDSv2 by default for EC2 instances. v1 is susceptible to SSRF attacks so even if you’re attaching an instance profile to an instance and doing everything else right, you’ve got a problem if somebody finds a weakness in the app running on the instance.
1. Avoid long lived credentials (access key/secret key pairs) and IAM users whenever possible, and instead have everything assume roles for access to resources in the same as well as other accounts. Temporary credentials from STS are the way to go.
2. Turn on IMDSv2 by default for EC2 instances. v1 is susceptible to SSRF attacks so even if you’re attaching an instance profile to an instance and doing everything else right, you’ve got a problem if somebody finds a weakness in the app running on the instance.
Also heavily recommend checking out Scott Piper’s SCP Best Practices (https://summitroute.com/blog/2020/03/25/aws_scp_best_practic...) that still hold up even if being a few years old at this point.