Day 21: AWS Security Hardening Practice

Here's the hardening script I run on every new AWS account. It catches the misconfigurations that show up in 90% of security audits.

Audit IAM Users for Console Access Without MFA

Before touching infrastructure, check identity:

aws iam generate-credential-report > /dev/null 2>&1 sleep 5 aws iam get-credential-report --query 'Content' --output text | \ base64 -d | \ awk -F ',' 'NR>1 && $4=="true" && $8=="false" {print "NO MFA:", $1}'

Enter fullscreen mode

Exit fullscreen mode

This pulls the credential report and finds every IAM user who has console access but no MFA enabled. These accounts are one phished password away from full compromise.

Detect Unused Access Keys

Access keys that haven't been used in 90+ days are a liability:

import boto3 from datetime import datetime , timezone , timedelta

iam = boto3 . client ( ' iam ' ) threshold = datetime . now ( timezone . utc ) - timedelta ( days = 90 )

for user in iam . list_users ()[ ' Users ' ]: keys = iam .…