Whenever an account changes hands, there is a period in which more than one party knows the credentials. Your job is to make that period as short as possible and to leave behind an account only you can administer. The following sequence takes well under an hour and should be done before you provision anything.
The sequence
- Sign in and change the password to one generated by a password manager. Do not reuse anything.
- Update the recovery email and phone number to addresses you control. An account is only as secure as its password reset path.
- Enable multi-factor authentication on the root or owner identity immediately.
- Create your own administrative identity with its own multi-factor authentication, and start using that instead of the root account.
- Enumerate every existing identity, role and API key. Delete or deactivate anything you did not create.
- Review active sessions and revoke them if the provider offers that control.
- Enable logging so that everything from this point forward is recorded.
- Set a billing alert at a threshold that would surprise you.
- Inventory running resources and shut down anything unexplained.
API keys deserve particular attention
Console passwords are visible and memorable; API keys are neither, which is why they are the credential most often left behind. Any key you did not personally create should be deleted, not merely rotated, because rotation preserves whatever permissions it carried.
- List every access key on every identity, including ones that look inactive.
- Delete keys you did not create; create new ones only where automation needs them.
- Scope new keys to the narrowest permission set that works.
- Store them in a secret manager, never in a repository or a chat message.
- Set a reminder to rotate them on a schedule.
Logging before workloads
Enable the provider’s audit logging before you start building. Logs that begin on day one give you a clean baseline; logs enabled after an incident tell you very little. Send them somewhere you control and set a retention period that matches whatever obligations you have.
Billing alerts are a security control
What “done” looks like
Summary
None of these steps is technically demanding; the discipline is in doing all of them before the first workload lands. Once the baseline is in place, the account is simply an account, and you can get on with the work you bought it for.
