Key Settings One-Pager
The essential goal, the features that carry it, the mistake to avoid, and the proof to keep — for each of the ten Brilliant at the Basics requirements. A quick reference to pin up, not a substitute for the full step-by-step guide. Confirm every setting against Amazon Web Services’s own documentation.
For CUI and ITAR data, use AWS GovCloud (US) with FedRAMP High and DoD Impact Level 4–5 authorized services.
Phishing-Resistant Multi-Factor Authentication
Make a stolen password useless on its own.
Give each admin a second backup security key and store it safely, or a lost key can lock you out.
Identity Center authentication settings screenshot · List of users with registered FIDO2 devices · Root account MFA-enabled proof
Least-Privilege Access Control
Give each person only the access their job needs — and no more.
Never attach the AdministratorAccess policy for day-to-day work; start with almost nothing and add only what breaks.
IAM role and policy list · Service control policy documents · Access Analyzer unused-access report
Asset & Account Inventory
Keep a live list of every device, identity, and app you defend.
Enable Config in every Region, not just your main one, because forgotten resources in unused Regions are a classic blind spot.
AWS Config recorder status · Resource Explorer aggregator index confirmation · Exported resource inventory list
Logging, Monitoring & Audit
Record important events and watch for trouble.
Keep at least one year of CloudTrail logs; the default 90-day event history is not enough for most defense audits.
CloudTrail 'all Regions' trail configuration · GuardDuty enabled status · Security Hub CSPM findings and alarm history
Network Segmentation & Boundary Protection
Keep one compromised thing from reaching everything else.
Avoid the '0.0.0.0/0 allow all' rule on security groups; open sources are the most common cloud misconfiguration.
VPC and subnet diagram · Security group and NACL rule export · WAF web ACL configuration
Vulnerability & Patch Management
Find weak spots and fix the risky ones first.
Test patches on a small group first; auto-patching everything at once can break a critical app during business hours.
Inspector findings report by severity · Patch Manager compliance dashboard · Maintenance window and patch policy settings
Data Protection & Encryption
Scramble sensitive data so only the right people can read it.
Use customer managed KMS keys instead of AWS-owned keys so you can prove control and revoke access if needed.
KMS key list with rotation enabled · S3 default-encryption settings · Load balancer TLS/HTTPS configuration
Backup & Recovery
Be able to restore your data after an attack or outage.
A backup you have never restored is only a hope; schedule real restore drills so you know it works.
AWS Backup plan and schedule · Cross-Region copy job history · Successful restore test record
Secure Configuration Baseline
Start every service from a known-good, hardened setting.
Do not try to fix every finding at once; sort by severity and knock out Critical and High controls first.
Security Hub CSPM standards and score · AWS Config conformance pack results · Control Tower landing zone summary
Secure AI Adoption & Data Loss Prevention
Use AI and share files without leaking sensitive information.
Never paste CUI into a public AI tool; keep AI use inside Bedrock with guardrails so your data stays in your account.
Bedrock guardrail policy configuration · Macie sensitive-data findings report · IAM policies limiting Bedrock access