12 Insecure AWS Default Settings Every Engineer Should Know and Fix

AWS default configurations are optimized for ease of use in tutorials, not for production security, leaving real infrastructure silently exposed. A healthcare infrastructure engineer documented twelve common misconfigurations after repeatedly fixing the same overlooked settings across Terraform deployments. Key risks include the absence of persistent CloudTrail logging for S3 data events, RDS instances created without encryption that cannot be encrypted in place after the fact, and unforced SSL on older PostgreSQL engines allowing silent plaintext connections. Load balancers provisioned without an explicit TLS policy default to accepting outdated TLS 1.0 and 1.1 connections, a finding that can stall enterprise security reviews. Each issue can be resolved with a single targeted configuration change, but automated tools like checkov and tfsec often miss these gaps because they result from absent settings rather than incorrect ones.