The root account is not an operator account. First 60 minutes: rotate the root password, force-retire every access key under root, enable MFA (hardware preferred), and enforce an SCP that denies root usage for anything except the handful of tasks that genuinely require it (billing signup, account close, root-only service endpoints).

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyRootUserActions",
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
      "StringLike": {
        "aws:PrincipalArn": "arn:aws:iam::*:root"
      }
    }
  }]
}

Long-lived IAM users are an anti-pattern in 2026. Every human operator gets federated access through IAM Identity Center (formerly AWS SSO) with short-lived credentials. Every remaining IAM user gets deleted or disabled. Every long-lived access key gets rotated to a role-based assumption pattern.

# Find every active long-lived access key older than 90 days
aws iam list-users --query 'Users[*].UserName' --output text \
  | tr '\t' '\n' \
  | xargs -I {} aws iam list-access-keys --user-name {} \
      --query 'AccessKeyMetadata[?Status==`Active`]' \
      --output table

The attacker had AdministratorAccess because the compromised identity had it. Rewrite every policy to grant the minimum set of actions on the minimum set of resources. Restrict IAM creation itself to a small, named admin group — protected by both MFA and an SCP boundary.

Fastest path: use IAM Access Analyzer's policy generation to diff intended vs. actual privileges, then prune.

Enable Block Public Access at the account level, not just per-bucket. Audit every bucket policy for "Principal": "*" and kill it on sight. Every object upload triggers a malware scan (GuardDuty Malware Protection or an S3 EventBridge → Lambda → ClamAV pipeline).

aws s3control put-public-access-block \
  --account-id $AWS_ACCOUNT_ID \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,\
BlockPublicPolicy=true,RestrictPublicBuckets=true

Databases move to private subnets with no public ingress. API Gateway endpoints enforce JWT authorization at the edge, validated against a managed auth layer (Cognito or equivalent). Client data is never served through an unauthenticated path.

Sandbox SES. Explicit sending authorization policies. Configuration sets with per-send quotas and bounce/complaint tracking. Anomaly detection on send volume (in this case, anything above 2× rolling 7-day baseline pages on-call immediately).

Organization-wide CloudTrail, multi-region, log file validation enabled, delivered to a dedicated log-archive account with S3 Object Lock in compliance mode. If an attacker can rewrite your audit trail, you don't have an audit trail.

Continuous threat detection via GuardDuty. Findings aggregated in Security Hub across every account. EventBridge rules route high-severity findings to PagerDuty with a documented on-call rotation. No silent findings.

Customer-managed KMS keys for every tier of sensitive data. Key policies scoped to specific IAM principals. Automatic annual rotation. Client transcripts, PII, and payment data never stored in plaintext anywhere.

No plaintext secrets in env vars, config files, or repos. Every credential lives in Secrets Manager with Lambda-backed rotation (we default to 58-day cycles to stay well inside the 60-day quarterly audit window). Applications pull at runtime, not at deploy.

Every infrastructure change lands through Terraform/Terragrunt with peer review. Console access is read-mostly. Drift detection runs nightly. This is the same IaC-first pattern we implemented during our multi-account AWS modernization — it pays compounding dividends the minute an incident happens.

AWS WAF in front of every internet-facing API with managed rule groups (OWASP Top 10, bad bots, known-bad IPs) and custom rate-limit rules scoped per authenticated identity.

The first IR engagement is always the most expensive, because there's no runbook. We left the client with documented runbooks for root compromise, data exfiltration, SES abuse, and account suspension — plus quarterly tabletop drills that test them.

Security is never done. Quarterly reviews walk the full attack surface, audit new IAM policies added since last cycle, re-validate that GuardDuty/Security Hub have no stale findings, and update the threat model as the platform evolves.