The myth that "AWS is secure by default" for SMBs

The AWS Security Blog patiently repeats that Amazon secures the cloud; the customer secures what they put in the cloud. In consulting with SMBs in San Juan and Miami, we hear the same line: "we are on AWS, we are already secure." Then we find public S3 buckets with payroll, active root IAM keys, and security groups with 0.0.0.0/0 on port 22.

Shared responsibility means you configure encryption, identi

Shared responsibility means you configure encryption, identity, logging, and network. AWS provides certified infrastructure; not the judgment to leave an RDS database reachable from the internet because "it was easier for the remote developer." NIST SP 800-53 and the CIS AWS Foundations Benchmark exist because default configuration optimizes speed, not healthy paranoia.

Three high-return controls: remove day-to-day root credentia

Three high-return controls: remove day-to-day root credentials, enable CloudTrail in all regions with SNS alerts, and use AWS Config or equivalent to detect drift (public S3, missing MFA on IAM users). For a 30-person SMB, this is days of work, not a six-month program.

The cultural mistake is treating AWS as cheap hosting instead of a platform with its own attack surface. Developers in LatAm often inherit accounts without a landing zone; each project is a silo with excessive permissions. Consolidating identity with SSO, environment roles, and least privilege is cheaper than a fine or incident.

Read the shared responsibility model as a contract, not marketing. If you cannot explain who is responsible for encryption on a specific bucket in your account, you are not ready for audit or serious cyber insurance.