1. Organization and identities #
The foundations.
Rules #
- Several accounts (at least production, non-production, security, logs) under Organizations.
- Root user protected by MFA and never used; human access through Identity Center.
- Roles for applications, no access keys in the code.
- SCPs: allowed regions, forbidding disabling CloudTrail or GuardDuty.
2. Security and reliability #
Protecting and holding up.
Rules #
- Resources in private subnets; only load balancers and CloudFront are exposed.
- Encryption everywhere (S3, EBS, RDS) with KMS, TLS in transit.
- Secrets in Secrets Manager, never in the code or in plain-text variables.
- Everything across at least two AZs; tested AWS Backup backups; RTO and RPO defined.
- GuardDuty, Security Hub, Config and CloudTrail active everywhere.
3. Operations and costs #
Lasting without drifting.
Rules #
- All infrastructure as code, deployed through a pipeline; no manual changes in production.
- Mandatory tags (project, environment, owner) for cost allocation.
- Budgets and anomaly detection on every account.
- CloudWatch alarms on user symptoms (errors, latency), log retention defined.
- Annual Well-Architected review of critical workloads.
aws sts get-caller-identity
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
aws guardduty list-detectors
aws securityhub get-findings --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}' --max-items 5
aws s3control get-public-access-block --account-id 123456789012
aws ce get-cost-forecast --time-period Start=2026-10-28,End=2026-11-30 --metric UNBLENDED_COST --granularity MONTHLY