---
title: AWS Lockdown (Nov 2026): Close Three Paths This Week
description: As of 4 November 2026, the first CloudTrail copy of management events to S3 is $0, and GuardDuty's published US East (N. Virginia) example prices analysis of those events at $4.00 per million. Close laptop access keys, public package installs, and a deletable trail bucket this week.
url: https://www.bravelo.co/blog/aws-account-lockdown-november-2026/
datePublished: 2026-11-04T00:00:00.000Z
dateModified: 2026-11-04T00:00:00.000Z
author: palaniappan-p
category: Security & Compliance
tags: aws-security, iam, cloudtrail, guardduty, aws
---

# AWS Lockdown (Nov 2026): Close Three Paths This Week

> As of 4 November 2026, the first CloudTrail copy of management events to S3 is $0, and GuardDuty's published US East (N. Virginia) example prices analysis of those events at $4.00 per million. Close laptop access keys, public package installs, and a deletable trail bucket this week.

On 4 November 2026 the prices and controls below were checked against the AWS pages linked in the key facts. A normal AWS account still fails in three ordinary ways. Someone leaves an access key on a laptop. CI resolves packages from the public internet. The account that runs the workload can delete the CloudTrail objects.

The standing catalog is [10 AWS cloud security practices](https://www.bravelo.co/blog/10-aws-cloud-security-best-practices-implementation-guide/). What to page on, and how GuardDuty groups findings, stays in the [incident response runbooks](https://www.bravelo.co/blog/aws-security-incident-response-runbooks-2026/). There is no client silhouette in this post. The dollars are list prices.

> **Short answer:** Close three paths this week: long-lived IAM access keys, package installs that bypass a registry you operate, and a CloudTrail bucket a workload role can delete. Humans sign in through IAM Identity Center with a FIDO2 authenticator, which makes ad-hoc CLI use slower. That delay is the control.

## Key facts (verified 2026-11-04)

- IAM Identity Center is provided at no additional cost. The 19 October 2026 announcement says so in the same sentence as the identity-store change. [Announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/iam-identity-store-optimistic-locking/)
- FIDO2 credentials in Identity Center are phishing-resistant because they are bound to the site that created them, such as AWS. A user can register up to eight MFA devices. [MFA types](https://docs.aws.amazon.com/singlesignon/latest/userguide/mfa-types.html)
- You can deliver one copy of ongoing CloudTrail management events to S3 for free. Limits may apply. Further copies of management events are $2.00 per 100,000 events delivered. Data events are $0.10 per 100,000. [CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/)
- The GuardDuty pricing page's US East (N. Virginia) example charges $4.00 per million CloudTrail management events. Forty million events in that example are $160. A 30-day trial covers accounts that have not tried GuardDuty, and each protection plan you have not enabled before. [GuardDuty pricing](https://aws.amazon.com/guardduty/pricing/)
- The Secrets Manager pricing examples use $0.40 per secret per month and $0.05 per 10,000 API calls. [Secrets Manager pricing](https://aws.amazon.com/secrets-manager/pricing/)
- CodeArtifact's pricing page lists a monthly free tier of the first 2 GB stored and the first 100,000 requests. An asset it downloads from npm, PyPI, Maven Central, or NuGet counts as a request. [CodeArtifact pricing](https://aws.amazon.com/codeartifact/pricing/)

> **Modeled comparison (not a cited client):** Take one million CloudTrail management events in US East (N. Virginia), using only the rates above. The first S3 copy is $0. GuardDuty analysis of that million is $4.00. A second S3 copy is $20, because extra copies are $2.00 per 100,000 events. This is rate math. It is not a bill we observed. Re-check both pricing pages before you put a number in a budget.

## This week

Do the three changes in this order. The SCP is last on purpose. You want a working sign-in that does not depend on an access key before you deny the creation of new ones.

1. **Remove long-lived access keys.** Humans get an Identity Center permission set and a FIDO2 authenticator. Generate the IAM credential report in each member account and list every active access key.
2. **Install from a registry you operate.** Point CI at CodeArtifact, commit the lockfile, and stop resolving npm, PyPI, or Maven from the public internet on the runner.
3. **Deny delete on the trail bucket.** Deliver one organization trail to a bucket in a log-archive account. The bucket policy allows `cloudtrail.amazonaws.com` to write, and denies delete to every other principal except one admin role in that account.

### Access keys

Identity Center is the front door for people. Require a FIDO2 authenticator (a built-in authenticator or a security key). The user guide also allows virtual authenticator apps and a RADIUS implementation through AWS Managed Microsoft AD. FIDO2 is the one the same page calls phishing-resistant. Turn on MFA device enforcement after you have registered a key for every admin, so you do not lock the workforce out of the console on a Tuesday.

Then find the keys that already exist. The credential report is per account. In AWS CLI v2, against one account:

```bash
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text \
  | python3 -c 'import sys,base64; sys.stdout.buffer.write(base64.b64decode(sys.stdin.read()))' \
  > credential-report.csv
```

Open `credential-report.csv` and filter `access_key_1_active` and `access_key_2_active`. Deactivate keys whose last-used date you cannot explain. Applications that still need a key move to a role. People do not get a replacement key.

The SCP denies `iam:CreateAccessKey` in member accounts unless the caller is the break-glass role. Service control policies do not affect the management account, so this statement does nothing there. Attach it to one OU, confirm a deploy that must not mint keys still works, and only then attach it to the rest of the organization. The JSON is in the [artifact](https://www.bravelo.co/examples/architecture-blog-2026/aws-account-lockdown-november-2026/README.md). It uses a placeholder role name, `break-glass-admin`. Rename it to the role you actually created.

### Packages

A lockfile that CI ignores is a wish. Configure the pipeline to install from CodeArtifact, with the public registry as an upstream of that repository, and fail the job if the lockfile is absent. The first 2 GB and the first 100,000 requests each month are in the free tier listed above. Past that, use the storage and request tables on the pricing page. This post does not quote a per-gigabyte storage rate.

The same week, search the repo for key material. From the repository root:

```bash
grep -RIn --exclude-dir=.git -E 'AKIA[0-9A-Z]{16}' .
```

Expect false positives in old docs and in this kind of article. A hit in application code or a committed `.env` is a rotation, not a tidy-up. AWS CLI v2 is not required for the grep. The pattern matches the shape of a long-lived access key ID.

### The trail bucket

Create the organization trail so management events land in a bucket owned by the log-archive account. One copy of those management events is the free copy. Do not add a second trail that delivers the same events again unless you have accepted the $2.00 per 100,000 price. Turn on log file validation. The mechanics of a multi-Region trail are already in [CloudTrail in production](https://www.bravelo.co/blog/aws-cloudtrail-production-setup-multi-region-validation-lake/).

The bucket policy has two jobs. CloudTrail's service principal may `s3:GetBucketAcl` and `s3:PutObject` only when `aws:SourceArn` is the organization trail in the management account. Every other principal is denied `s3:DeleteObject`, `s3:DeleteObjectVersion`, and `s3:DeleteBucket`, except one role in the log-archive account. AWS's own organization-trail example is the Allow half. The Deny half is ours, and it is illustrative until you replace the placeholders. Both are in the artifact.

Designate a security tooling account as the GuardDuty delegated administrator and enable the service. Read the protection-plan page before you leave the console. Foundational analysis stays on. The other plans come on by default for a new account, except Runtime Monitoring. Turn off the ones you have not estimated. Page a person on the critical correlated findings the [runbook](https://www.bravelo.co/blog/aws-security-incident-response-runbooks-2026/) already defines. Do not add a second paging philosophy in the same week.

## Within 30 days

Move production secrets you found on laptops and in repos into Secrets Manager. The $0.40 per secret per month figure is the one in AWS's pricing examples. Cache the value in the process. A Lambda that calls `GetSecretValue` on every invocation will show up in the $0.05 per 10,000 calls line.

Replace any remaining laptop deploy token with a GitHub Actions OIDC role. The role trusts `token.actions.githubusercontent.com`, and the `sub` claim is pinned to one repository and one branch. The workflow side of that pattern is in [GitHub Actions on AWS](https://www.bravelo.co/blog/github-actions-aws-cicd-security-best-practices/). A developer laptop then holds a short-lived Identity Center session, not a key that can deploy.

Turn on Amazon Inspector for the ECR repositories and Lambda functions you actually ship. Read the Inspector pricing page first. This post does not quote an Inspector rate.

Editor extensions and local tools that can run shell commands inherit whatever the laptop session can do. Treat an MCP server on a developer machine as that kind of tool. Which tools a commerce agent may call, and where the permission actually sits, is a different article: [MCP security for enterprise commerce agents](https://www.bravelo.co/blog/mcp-security-enterprise-ai-2026/). The control in this post is smaller. The laptop role cannot create access keys, and it cannot delete the trail.

Browser and editor allowlists are a corporate control. AWS does not sell that checkbox. If the endpoint itself is the problem, the decision between WorkSpaces Secure Browser, application streaming, and a full desktop is already written in [VDI on AWS](https://www.bravelo.co/blog/aws-vdi-secure-remote-workforce-workspaces-2026/). Buy that after the three paths above are closed, not instead of them.

## What breaks if you rush the policy

> **What broke** — Documented CloudTrail behavior, not a client incident: if the bucket policy denies `s3:PutObject` to `cloudtrail.amazonaws.com`, or the `aws:SourceArn` does not match the trail, delivery stops. CloudTrail retries for 30 days, and those attempted deliveries are charged at standard trail rates. Detection is a trail whose last delivery time stops moving, plus a bill for events you never stored. Recovery is to restore the Allow statements from the AWS organization-trail example, confirm a new object lands under `AWSLogs/`, and delete a trail you broke and do not intend to keep.

The SCP has its own trap. Attach `Deny` on `iam:CreateAccessKey` while a member-account pipeline still calls that action, and the next deploy fails with `AccessDenied`. You will see the denied call in the trail you just protected. Detach the SCP from that OU. That is the rollback. There is no customer story behind this paragraph. It is the failure the JSON is built to make obvious in a test account first.

> **Reproduce this** — Open [`/examples/architecture-blog-2026/aws-account-lockdown-november-2026/README.md`](https://www.bravelo.co/examples/architecture-blog-2026/aws-account-lockdown-november-2026/README.md). Replace every placeholder in `deny-create-access-key.scp.json` and `cloudtrail-log-bucket-policy.json`. Attach the SCP to a single test OU and attempt `aws iam create-access-key` as a role that is not the break-glass role. The expected API result is `AccessDenied`. The break-glass role is the one caller that must still succeed.

## What we would not spend this week on

A language rewrite does not remove an access key. Turning on every GuardDuty protection plan does not fix a bucket policy, and the S3 data-event meter is a different price from the $4.00 per million management-event example. Do the three paths. Estimate the protection plans. Leave the rewrite for a quarter where you can name the code that is actually exposed.

Object Lock in compliance mode is also the wrong add-on this week. A retention period in that mode cannot be shortened, and a protected version cannot be deleted by anyone, including the root user. Use the bucket-policy Deny first. You can still delete an object with the log-archive admin role when a bad prefix lands.

## What to do this week

1. **Export the credential report** in each member account and list active access keys.
2. **Register a FIDO2 authenticator** for every admin and enforce MFA in Identity Center.
3. **Point CI at CodeArtifact** and fail the job when the lockfile is missing.
4. **Create one organization trail** into the log-archive bucket, with log file validation on.
5. **Apply the bucket policy** from the artifact in a test bucket, write one object as CloudTrail, and delete one object as the admin role and as a workload role.
6. **Attach the SCP** to one OU. Confirm the break-glass role can still sign in. Confirm a normal role cannot create an access key.
7. **Open GuardDuty protection plans** and turn off every plan you have not priced, leaving foundational detection on.

FactualMinds is an AWS Select Tier Services Partner. If you want this sequence applied in your organization, start with [AWS cloud security](https://www.bravelo.co/services/aws-cloud-security/) or [contact us](https://www.bravelo.co/contact-us/).

## What this post doesn't cover

Endpoint MDM and EDR products, a memory-safe rewrite, a penetration test, and any measured detection rate. We did not apply the SCP or the bucket policy in a customer account for this post. Inspector, WorkSpaces, and Security Hub pricing are out of scope here. The JSON files are placeholders. They are not a policy you should paste into the management account unchanged.

## Sources

- [IAM Identity Center, 19 October 2026 announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/iam-identity-store-optimistic-locking/)
- [Identity Center MFA types](https://docs.aws.amazon.com/singlesignon/latest/userguide/mfa-types.html)
- [CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/)
- [CloudTrail organization trail bucket policy](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html)
- [GuardDuty pricing](https://aws.amazon.com/guardduty/pricing/)
- [Secrets Manager pricing](https://aws.amazon.com/secrets-manager/pricing/)
- [CodeArtifact pricing](https://aws.amazon.com/codeartifact/pricing/)
- [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html)

## FAQ

### When should we not attach the access-key SCP?
Do not attach it while a member-account pipeline still calls iam:CreateAccessKey, and do not attach it until a human has signed in as the break-glass role without an access key. The SCP does not affect the management account. If the only admin path in a member account is an access key, create the Identity Center permission set and prove a sign-in before you deny CreateAccessKey.

### What could go wrong with the CloudTrail bucket policy?
A Deny that also covers s3:PutObject stops delivery. AWS documents that a misconfigured trail retries delivery for 30 days, and those attempted deliveries are billed at standard CloudTrail rates. The fix is to remove the bad Deny, confirm cloudtrail.amazonaws.com can PutObject only for the organization trail ARN, and delete a trail you do not intend to keep. A second failure is a Deny with the wrong admin role ARN, which blocks the people who are supposed to delete objects.

### Does the free CloudTrail copy include data events?
No. The pricing page says you can deliver one copy of ongoing management events to S3 for free, and that limits may apply. Data events delivered to S3 are priced at $0.10 per 100,000 events. Leave data events off until you have named the buckets worth recording.

### Should we enable every GuardDuty protection plan in the same change?
No. Foundational threat detection, including CloudTrail management-event analysis, cannot be turned off. The pricing page says a first-time enablement also turns on the available protection plans, except Runtime Monitoring. Turn off S3, EKS, RDS, Lambda, and Malware protection until you have read the meter for your Region. Each plan you have not enabled before has its own 30-day trial. Malware Protection for S3 is called out separately: it has a free tier and is not part of that trial.

### Where should production secrets go after they leave the laptop?
AWS Secrets Manager. The pricing examples charge $0.40 per secret per month and $0.05 per 10,000 API calls. Confirm the figure for your Region before you budget. Do not leave the secret in a repository, a shell history file, or a Lambda environment variable.

### Does this replace endpoint security software?
No. MDM and EDR are not AWS services, and this post does not pick a vendor for them. Amazon WorkSpaces is a separate decision, covered in the VDI post. It is the wrong first purchase when the open paths are an access key and a trail bucket a workload role can delete.

### Do we have a measured detection rate for this setup?
No. We have not applied this SCP or bucket policy in a customer account for this post. The dollar figures are published AWS rates and one unit of rate math. They are not a bill we observed and not a detection rate.

---

*Source: https://www.bravelo.co/blog/aws-account-lockdown-november-2026/*