Principle of least privilege
Grant only the permissions a workload needs — nothing more.
Prefer roles
Use IAM roles for services and short-lived credentials instead of long-lived access keys.
Checklist
- Enable MFA on all users.
- Rotate credentials.
- Audit with CloudTrail.
- Avoid using the root account for daily work.