AWS security checklist for startups
Sabri Eddir · Founder, Secure Layer · 7+ years at AWS Security · Last reviewed 13 July 2026
This AWS security checklist for startups covers five areas: identity and access, data protection, infrastructure protection, detection, incident response. It follows the same structure AWS uses in its Well-Architected Security Pillar.
You own the AWS account, and a customer questionnaire is coming. Run every check below before anyone asks.
Work through each section once. Then read why a static list is not the same as knowing your own architecture actually passes.
The checklist, by Well-Architected area
Identity and access
- Turn on Multi-Factor Authentication (MFA) on the root account.
- Turn on MFA for every human user, not just root.
- Stop signing in as root for daily work.
- Give each person and each service only the access it needs.
- Avoid long-lived access keys. Use roles and temporary credentials instead.
- Review unused permissions on a schedule, not only when something breaks.
Data protection
- Encrypt data at rest, on S3, EBS, RDS, and DynamoDB.
- Encrypt data in transit. Enforce TLS on every public endpoint.
- Block public access on S3 buckets by default.
- Open a bucket only on purpose, and only as far as you mean to.
- Know where your sensitive data lives before a customer asks.
Infrastructure protection
- Restrict security groups to the ports and sources that actually need them.
- Never open SSH or a database port to the whole internet.
- Put databases and backend services in private subnets.
- Keep your base images and dependencies patched.
Detection
- Turn on CloudTrail in every region, with log file validation on.
- Send those logs somewhere your own workload cannot overwrite.
- Turn on GuardDuty to watch your account for unusual activity.
- Turn on AWS Config to track what changed, and when.
- Set a billing alert. A cost spike is often the first sign something is wrong.
Incident response
- Decide who gets called first, before you need to know.
- Keep your account contact details current, so AWS can reach you.
- Practice revoking one credential, so it is not the first time during a real incident.
AWS publishes its own checklist too
The AWS Startup Security Baseline is AWS's own guide for exactly this stage. A single AWS account, early revenue, no dedicated security team yet. It groups controls into two categories, account and workload, and it maps directly to the Security Pillar this checklist follows. Read it for the fuller, AWS-authored version with console steps: AWS Startup Security Baseline.
AWS also ships a free Well-Architected Tool in the console. It walks you through a manual self-assessment across all six pillars, security included. It gives you the questions. It does not check your actual configuration for you.
What a checklist cannot tell you
A checklist tells you what to check. It does not tell you whether your architecture passes.
You still have to open every resource by hand, and compare its real configuration against every checklist item. Change one resource, add one service, and the review starts over.
Nobody keeps that up on their own. It is manual work, repeated every time something changes.
From checklist to computed verdict
Secure Layer turns this same checklist into a computed verdict, resource by resource. Import your CloudFormation template, or draw the architecture from scratch on a canvas.
Every property gets checked against a rule set built from AWS's own published guidance for CloudFormation. Each check lands in one of three states: clean, violated, or needs review. Needs review means the property could not be honestly assessed, and you see that state instead of a false green.
A guided questionnaire, organized along the same Well-Architected pillars, turns your answers into a maturity score. Answer that encryption is on, while the diagram shows an open bucket, and the product flags the contradiction.
When you are ready, one click generates the Infrastructure as Code (IaC): CloudFormation, CDK, or Terraform.
Start on the free plan. One project, unlimited versions, six real questionnaire questions, one per pillar. No card required.
Questions about this checklist
- Is this the same as the AWS Well-Architected Framework?
- No, but it follows the same structure. The framework covers six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. This checklist covers the security pillar, the one most startups need first.
- Do I need a security engineer to run this checklist?
- No. Every item here is something one engineer can check directly in the AWS console. The work is manual, not specialized. What you need is time, and a way to repeat it every time the architecture changes.
- Does Secure Layer need access to my AWS account?
- No. Secure Layer never holds your AWS credentials. Only the template you import, or the diagram you draw, ever reaches us.
- What if my infrastructure is Terraform, not CloudFormation?
- Import only works with CloudFormation today. You can still draw your architecture on the canvas by hand, and generate Terraform as output either way.
- How often should I redo this checklist?
- Every time your architecture changes. A new resource, a new region, or a questionnaire landing on your desk are all good reasons to check again.