Setting secure defaults on AWS and avoiding misconfigurations 

This blog post outlines AWS security guardrails and SCP examples to enforce secure defaults across accounts, including blocking public S3 buckets, preventing public AMIs and SSM document sharing, requiring IAM-authenticated Lambda URLs, restricting RAM external sharing, disabling S3 ACLs via BucketOwnerEnforced, prohibiting IAM users/access keys in favor of roles, enforcing IMDSv2, limiting network egress paths (e.g., IGW/peering/global accelerator), enabling and locking EBS encryption-by-default, and constraining admin role use by source IP; it advises assessing CloudTrail/Access Advisor for usage, creating scoped exceptions, and combining SCPs due to policy quotas.