# AWS account lockdown, November 2026

Companion files for [AWS Lockdown (Nov 2026): Close Three Paths This Week](/blog/aws-account-lockdown-november-2026/).

These files are illustrative. Replace every placeholder. Apply them in one test OU and one test bucket before you touch the rest of the organization. Service control policies do not affect the management account.

| File | What it is |
| --- | --- |
| `deny-create-access-key.scp.json` | SCP that denies `iam:CreateAccessKey` unless the caller is `arn:aws:iam::*:role/break-glass-admin`. |
| `cloudtrail-log-bucket-policy.json` | Organization-trail bucket policy. CloudTrail may write. Other principals may not delete, except one role in the log-archive account. |

## This week

1. Export the IAM credential report in each member account and list active access keys.
2. Register a FIDO2 authenticator for every admin and enforce MFA in IAM Identity Center.
3. Point CI at CodeArtifact and fail the job when the lockfile is missing.
4. Create one organization trail into the log-archive bucket, with log file validation on.
5. Apply the bucket policy to a test bucket. Confirm CloudTrail can write, the admin role can delete, and a workload role cannot.
6. Attach the SCP to one OU. Confirm the break-glass role can still sign in without an access key. Confirm a normal role cannot create one.
7. In GuardDuty, turn off protection plans you have not priced. Leave foundational detection on.

## Credential report

AWS CLI v2 and Python 3, against one account. The report is not organization-wide. Run it in each member account.

```bash
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text \
  | python3 -c 'import sys,base64; sys.stdout.buffer.write(base64.b64decode(sys.stdin.read()))' \
  > credential-report.csv
```

Expected columns include `user`, `access_key_1_active`, `access_key_1_last_used_date`, `access_key_2_active`, and `access_key_2_last_used_date`.

## Prove the SCP

Replace `break-glass-admin` in the JSON if your role name differs. Attach the policy to a test OU from the management account.

As a role in a member account that is not the break-glass role:

```bash
aws iam create-access-key --user-name REPLACE_WITH_A_TEST_USER
```

Expected result: `AccessDenied`.

As the break-glass role, the same call is not denied by this SCP. Delete any key that call creates before you finish the test.

Rollback: detach the SCP from the OU.

## Prove the bucket policy

Replace `amzn-s3-demo-bucket`, `region`, `managementAccountID`, `trailName`, `o-organizationID`, `logArchiveAccountID`, and `cloudtrail-log-admin` before you attach the policy.

After CloudTrail delivers an object:

- A role named `cloudtrail-log-admin` in the log-archive account can delete a test object you created yourself.
- A workload role in a member account receives `AccessDenied` on `s3:DeleteObject`.

If CloudTrail stops delivering, you denied `s3:PutObject` or the `aws:SourceArn` does not match the trail. Restore the Allow statements. AWS retries a broken delivery for 30 days and bills those attempts.

Do not add S3 Object Lock compliance mode in the same change. A compliance-mode retention period cannot be shortened.