{
  "id": 10105960,
  "title": "12 AWS Defaults That Ship Insecure (and the One Line That Fixes Each)",
  "url": "https://urgent.news/2026/09/27/12-aws-defaults-that-ship-insecure-and-the-one-line-that-fixes-each",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T01:19:02.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vadim_albarov/12-aws-defaults-that-ship-insecure-and-the-one-line-that-fixes-each-127f"
  },
  "original_language": "en",
  "account": "Twelve AWS defaults are insecure out of the box, but each one has a one-line fix. Checkov and tfsec can scan your code, but many of these issues come from what you didn't write. Here are the twelve defaults, ranked by how likely they are to harm you:\n\n1. CloudTrail only keeps events for 90 days. No audit log of what happened in March if someone phished a credential in March and downloaded a sensitive bucket in September. Enable is_multi_region_trail and set audit logs to all data resource types, then you'll have a proper audit trail.\n\n2. RDS storage is unencrypted by default, and you can't change it later. Enable encryption at creation time with storage_encrypted = true and a specific KMS key. Doing so later becomes a maintenance nightmare.\n\n3. Postgres allows plaintext connections by default. Set rds.force_ssl to 1 to enforce TLS. Some clients may still fall back to plaintext, so make sure everyone knows the flag.\n\n4. Load balancers use an insecure TLS version by default. Set ssl_policy to ELBSecurityPolicy-TLS13-1-2-2021-06 and enable access logs with deletion protection. This will prevent external scans from finding major security issues.\n\n5. VPC Flow Logs are missing by default. Create them to log all network traffic and route them to CloudWatch Logs. This will give you visibility into which instances are talking to known-bad IPs and help with incident response.\n\n6. Services create log groups with default settings that you never asked for. Pre-create every log group a service will write to, using aws_cloudwatch_log_group. This will prevent orphan log groups from accumulating unnecessary data.\n\n7. The default security group allows all traffic between members and outbound. Strip it bare to prevent lateral movement if one of those services gets compromised.",
  "summary": "Every AWS default answers exactly one question: will the tutorial work? No surprise bill. No failed API call. No \"access denied\" on step three. That is a great default for a tutorial. It is a terrible default for the thing you spun up \"just for staging\" that is now production, on the day someone asks who downloaded that bucket in March. I run infrastructure for a healthcare company. People with…",
  "key_points": [
    "CloudTrail retains events for 90 days only",
    "RDS storage unencrypted by default",
    "Postgres allows plaintext connections"
  ],
  "editors_take": "Setting default security configurations in AWS requires deliberate action to prevent common security issues, as many default settings leave resources vulnerable to exploitation and data breaches.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}