ABRAR ASLAM

Thanks, this is a great addition. You're right about handovers. The contractor-built account is exactly where "not sure" comes from. For the orphaned keys, one thing that helps before deleting anything is to deactivate the key first rather than delete it. The credential report and "last used" data show when it was last active. If nothing breaks after a week or two, it's safe to delete. If something does break, you can switch it back on in seconds, and you've found its owner. I really like the "definition of done" idea. It turns security from a later audit into an acceptance criterion, and it's easy to check at handover with a handful of read-only CLI commands. I might borrow that for a follow-up post. On GuardDuty: when I find it enabled, it's often only in the main region the team works in. It has to be turned on per region (or auto-enabled across accounts through a delegated administrator in AWS Organizations), so the regions nobody uses are usually left uncovered. Those are the ones attackers like, because nobody is looking there. That's why the bonus loop in the article checks every region.