What security basics should every AWS environment have on day one?
Enforce MFA and least‑privilege IAM, encrypt data in transit and at rest with KMS, restrict network access with security groups and WAF, enable CloudTrail and GuardDuty, and back up critical data. Map these controls to your compliance needs and test restores and incident response.