Zero trust has been sold badly. Stripped of the marketing, it says one thing: stop granting access based on where a request came from, and start granting it based on who or what is asking, verified every time. Being inside the VPC is not a credential.
On AWS that translates into a fairly specific set of changes. Here is the order we implement them, because doing this out of order tends to lock someone out on a Friday.
Identity first, because everything else depends on it
Long-lived IAM access keys are the single biggest liability in most accounts. They get committed to repositories, pasted into Slack, and left on laptops of people who left the company.
- Move human access to IAM Identity Center with your existing identity provider. People get short-lived credentials through a login, not a key in a config file.
- Applications use IAM roles — instance profiles on EC2, task roles on ECS, IRSA on EKS. No keys in environment variables.
- CI/CD pipelines outside AWS use OIDC federation. GitHub Actions can assume a role directly without a stored secret.
- MFA on the root account, root access keys deleted, and the root credentials in a safe rather than a password manager everyone shares.
Least privilege, arrived at honestly
Nobody writes a perfect policy on the first attempt. What works: start broader than you want, then use IAM Access Analyzer to generate a policy from what the principal actually called over the last ninety days, and tighten to that.
Above the account, service control policies in AWS Organizations set the ceiling — no disabling CloudTrail, no launching in regions you do not operate in, no deleting security tooling. Even an administrator cannot cross an SCP, which is the point.
Segmentation that assumes the network is hostile
Flat VPCs where everything can reach everything are the norm and they are indefensible once one instance is compromised.
- Private subnets for anything that does not need to be reachable from the internet. Databases, always.
- Security groups referencing other security groups rather than CIDR blocks. The application tier group is allowed to reach the database group on one port — no IP ranges to maintain.
- VPC endpoints for S3, DynamoDB, Secrets Manager, and the rest. Traffic to AWS services stays on the AWS network instead of going out through a NAT gateway, which is better for security and cheaper on data processing.
- Endpoint policies restricting which buckets can be reached through the endpoint at all.
Encryption with keys you control
Encryption at rest is largely a checkbox now — EBS, RDS, S3 all support it and there is no reason to leave it off. The distinction worth making is between AWS-managed keys and customer-managed keys in KMS.
Customer-managed keys cost a little per month and give you a key policy: an explicit list of who can decrypt, auditable in CloudTrail. For anything holding customer data or falling under DPDP scrutiny, that separation is worth having.
Assume breach, so instrument for it
Zero trust without detection is just a tighter set of doors. The baseline:
- CloudTrail in every region, logging to a bucket in a separate account that production roles cannot write to.
- GuardDuty on. It reads CloudTrail, DNS, and VPC flow logs, and finds credential use from unusual locations and cryptomining patterns without you writing rules.
- Security Hub for aggregated findings against the AWS Foundational Security Best Practices standard. Expect an ugly score in week one.
- AWS Config with rules for the things that must never drift — public buckets, unencrypted volumes, security groups open to 0.0.0.0/0 on port 22.
Where teams stall
Two places, consistently. The first is the legacy application that needs an IAM user with a static key because it cannot assume a role — genuinely, sometimes, that is true, so scope the key to one action on one resource and rotate it on a schedule.
The second is the alert volume in month one. Security Hub will surface hundreds of findings. Triage by severity, fix the criticals, suppress what does not apply with a written reason, and get to a state where a new finding means something. A dashboard nobody reads is not a control.