AWS Lockdown (Nov 2026): Close Three Paths This Week

On 4 November 2026 the prices and controls below were checked against the AWS pages linked in the key facts. A normal AWS account still fails in three ordinary ways. Someone leaves an access key on a laptop. CI resolves packages from the public internet. The account that runs the workload can delete the CloudTrail objects.

The standing catalog is 10 AWS cloud security practices. What to page on, and how GuardDuty groups findings, stays in the incident response runbooks. There is no client silhouette in this post. The dollars are list prices.

This week

Do the three changes in this order. The SCP is last on purpose. You want a working sign-in that does not depend on an access key before you deny the creation of new ones.

1. Remove long-lived access keys. Humans get an Identity Center permission set and a FIDO2 authenticator. Generate the IAM credential report in each member account and list every active access key.
2. Install from a registry you operate. Point CI at CodeArtifact, commit the lockfile, and stop resolving npm, PyPI, or Maven from the public internet on the runner.
3. Deny delete on the trail bucket. Deliver one organization trail to a bucket in a log-archive account. The bucket policy allows cloudtrail.amazonaws.com to write, and denies delete to every other principal except one admin role in that account.

Access keys

Identity Center is the front door for people. Require a FIDO2 authenticator (a built-in authenticator or a security key). The user guide also allows virtual authenticator apps and a RADIUS implementation through AWS Managed Microsoft AD. FIDO2 is the one the same page calls phishing-resistant. Turn on MFA device enforcement after you have registered a key for every admin, so you do not lock the workforce out of the console on a Tuesday.

Then find the keys that already exist. The credential report is per account. In AWS CLI v2, against one account:

aws iam generate-credential-report
aws iam get-credential-report --query Content --output text \
  | python3 -c 'import sys,base64; sys.stdout.buffer.write(base64.b64decode(sys.stdin.read()))' \
  > credential-report.csv

Open credential-report.csv and filter access_key_1_active and access_key_2_active. Deactivate keys whose last-used date you cannot explain. Applications that still need a key move to a role. People do not get a replacement key.

The SCP denies iam:CreateAccessKey in member accounts unless the caller is the break-glass role. Service control policies do not affect the management account, so this statement does nothing there. Attach it to one OU, confirm a deploy that must not mint keys still works, and only then attach it to the rest of the organization. The JSON is in the artifact. It uses a placeholder role name, break-glass-admin. Rename it to the role you actually created.

Packages

A lockfile that CI ignores is a wish. Configure the pipeline to install from CodeArtifact, with the public registry as an upstream of that repository, and fail the job if the lockfile is absent. The first 2 GB and the first 100,000 requests each month are in the free tier listed above. Past that, use the storage and request tables on the pricing page. This post does not quote a per-gigabyte storage rate.

The same week, search the repo for key material. From the repository root:

grep -RIn --exclude-dir=.git -E 'AKIA[0-9A-Z]{16}' .

Expect false positives in old docs and in this kind of article. A hit in application code or a committed .env is a rotation, not a tidy-up. AWS CLI v2 is not required for the grep. The pattern matches the shape of a long-lived access key ID.

The trail bucket

Create the organization trail so management events land in a bucket owned by the log-archive account. One copy of those management events is the free copy. Do not add a second trail that delivers the same events again unless you have accepted the $2.00 per 100,000 price. Turn on log file validation. The mechanics of a multi-Region trail are already in CloudTrail in production.

The bucket policy has two jobs. CloudTrail’s service principal may s3:GetBucketAcl and s3:PutObject only when aws:SourceArn is the organization trail in the management account. Every other principal is denied s3:DeleteObject, s3:DeleteObjectVersion, and s3:DeleteBucket, except one role in the log-archive account. AWS’s own organization-trail example is the Allow half. The Deny half is ours, and it is illustrative until you replace the placeholders. Both are in the artifact.

Designate a security tooling account as the GuardDuty delegated administrator and enable the service. Read the protection-plan page before you leave the console. Foundational analysis stays on. The other plans come on by default for a new account, except Runtime Monitoring. Turn off the ones you have not estimated. Page a person on the critical correlated findings the runbook already defines. Do not add a second paging philosophy in the same week.

Within 30 days

Move production secrets you found on laptops and in repos into Secrets Manager. The $0.40 per secret per month figure is the one in AWS’s pricing examples. Cache the value in the process. A Lambda that calls GetSecretValue on every invocation will show up in the $0.05 per 10,000 calls line.

Replace any remaining laptop deploy token with a GitHub Actions OIDC role. The role trusts token.actions.githubusercontent.com, and the sub claim is pinned to one repository and one branch. The workflow side of that pattern is in GitHub Actions on AWS. A developer laptop then holds a short-lived Identity Center session, not a key that can deploy.

Turn on Amazon Inspector for the ECR repositories and Lambda functions you actually ship. Read the Inspector pricing page first. This post does not quote an Inspector rate.

Editor extensions and local tools that can run shell commands inherit whatever the laptop session can do. Treat an MCP server on a developer machine as that kind of tool. Which tools a commerce agent may call, and where the permission actually sits, is a different article: MCP security for enterprise commerce agents. The control in this post is smaller. The laptop role cannot create access keys, and it cannot delete the trail.

Browser and editor allowlists are a corporate control. AWS does not sell that checkbox. If the endpoint itself is the problem, the decision between WorkSpaces Secure Browser, application streaming, and a full desktop is already written in VDI on AWS. Buy that after the three paths above are closed, not instead of them.

What breaks if you rush the policy

The SCP has its own trap. Attach Deny on iam:CreateAccessKey while a member-account pipeline still calls that action, and the next deploy fails with AccessDenied. You will see the denied call in the trail you just protected. Detach the SCP from that OU. That is the rollback. There is no customer story behind this paragraph. It is the failure the JSON is built to make obvious in a test account first.

What we would not spend this week on

A language rewrite does not remove an access key. Turning on every GuardDuty protection plan does not fix a bucket policy, and the S3 data-event meter is a different price from the $4.00 per million management-event example. Do the three paths. Estimate the protection plans. Leave the rewrite for a quarter where you can name the code that is actually exposed.

Object Lock in compliance mode is also the wrong add-on this week. A retention period in that mode cannot be shortened, and a protected version cannot be deleted by anyone, including the root user. Use the bucket-policy Deny first. You can still delete an object with the log-archive admin role when a bad prefix lands.

What to do this week

1. Export the credential report in each member account and list active access keys.
2. Register a FIDO2 authenticator for every admin and enforce MFA in Identity Center.
3. Point CI at CodeArtifact and fail the job when the lockfile is missing.
4. Create one organization trail into the log-archive bucket, with log file validation on.
5. Apply the bucket policy from the artifact in a test bucket, write one object as CloudTrail, and delete one object as the admin role and as a workload role.
6. Attach the SCP to one OU. Confirm the break-glass role can still sign in. Confirm a normal role cannot create an access key.
7. Open GuardDuty protection plans and turn off every plan you have not priced, leaving foundational detection on.

FactualMinds is an AWS Select Tier Services Partner. If you want this sequence applied in your organization, start with AWS cloud security or contact us.

What this post doesn’t cover

Endpoint MDM and EDR products, a memory-safe rewrite, a penetration test, and any measured detection rate. We did not apply the SCP or the bucket policy in a customer account for this post. Inspector, WorkSpaces, and Security Hub pricing are out of scope here. The JSON files are placeholders. They are not a policy you should paste into the management account unchanged.

Sources

• IAM Identity Center, 19 October 2026 announcement
• Identity Center MFA types
• CloudTrail pricing
• CloudTrail organization trail bucket policy
• GuardDuty pricing
• Secrets Manager pricing
• CodeArtifact pricing
• S3 Object Lock

Frequently asked questions