AWS Security Hardening for Red Team Infrastructure

Red team infrastructure on AWS has a unique threat model: it needs to be functional enough for operations, hardened enough that it doesn't get hijacked by other threat actors, and disposable enough to tear down without leaving traces. This skill covers the security practices that matter most in this context.

IAM — Identity and Access Control

The root account is the crown jewel of your AWS setup. If it gets compromised, an attacker owns everything — your infrastructure, your billing, and potentially your operational security.

• Create a dedicated IAM user for RedC operations. Never use the root account for day-to-day work
• Apply least-privilege policies. Start with AWS managed policies (like AmazonEC2FullAccess) and narrow them down based on what RedC actually needs
• Enable MFA on all IAM users — this is the single most effective protection against credential theft
• Rotate access keys every 90 days. Set a calendar reminder because you will forget
• Use IAM roles for EC2 instances instead of embedding access keys. Roles auto-rotate credentials and the keys never appear in Terraform state files

Example — minimal IAM policy for RedC:

{
  "Version": "2012-10-17",
  "Statement": [