The majority of AWS security incidents trace back to identity and access management, not zero-days. IAM is powerful and easy to get subtly wrong. Here are six mistakes that show up in account after account.
1. Attaching AdministratorAccess Everywhere
It is the fastest way to make an error go away — and the fastest way to a total compromise. A leaked key attached to AdministratorAccess owns your whole account. Grant only the actions a principal actually needs:
{ "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::app-uploads/*" }
2. Using Long-Lived Access Keys
Static access keys get committed to Git, pasted into Slack, and baked into images. Prefer IAM roles with temporary credentials — for EC2, for Lambda, for CI via OIDC. If you must use a key, rotate it and scope it tightly.
3. Wildcards in Resource and Action
"Action": "*" on "Resource": "*" is admin by another name. Wildcards feel convenient during development and become the hole an attacker walks through. Be explicit about both the actions and the resources.
4. No MFA on Privileged Users
A password alone protects a console user with real power. Enforce MFA on every human, and especially on the root account — then lock the root credentials away and stop using them for daily work.
5. Ignoring the Root Account
The root user can do anything, including things IAM policies cannot restrict. Enable MFA on it, delete its access keys entirely, and set up alerts on any root activity — root logging in should be a rare, alarming event.
6. Never Reviewing Access
Permissions accrete. People change teams, projects end, and the grants stay. Use IAM Access Analyzer and the last-accessed data to find and remove permissions nobody uses:
IAM → Access Analyzer → review external access + unused permissions
Summary
AWS security is mostly IAM hygiene: grant least privilege, prefer roles over static keys, avoid wildcards, enforce MFA, treat root as radioactive, and prune access regularly. None of these are advanced — they are the boring discipline that keeps a leaked credential from becoming a breach. Get the six right and you have closed the doors attackers actually use.