I find AWS security "primers" are usually quite brief - and necessarily so, because otherwise they wouldn't be a "primer". But that brevity leads to a common se

I find AWS security "primers" are usually quite brief - and necessarily so, because otherwise they wouldn't be a "primer". But that brevity leads to a common set of rules which, in the absence of a full explanation, lose something. For example, just every AWS environment I look at, someone knew that should create an IAM account, and never use the root account. Which is why there is a root account that's never used, and one IAM account with "Administrator" permission that everyone shares. If you ever propose we review it, someone will point me at an AWS security guide and say "it's fine, we're not using the root".