A Security Baseline for a New AWS Account

Detection must be switched on before an incident. A practical baseline:

Service	What it gives you
CloudTrail	Record of API calls; create a multi-region trail to an S3 bucket in a separate account
GuardDuty	Threat detection from CloudTrail, VPC flow and DNS logs
AWS Config	Resource inventory and rules such as “S3 buckets must not be public”
IAM Access Analyzer	Finds resources shared outside your account
Security Hub	One place to see findings and benchmark checks

aws cloudtrail create-trail --name org-trail --s3-bucket-name acme-trail-logs \
  --is-multi-region-trail --enable-log-file-validation
aws cloudtrail start-logging --name org-trail
aws guardduty create-detector --enable --region ap-south-1

Add the basics beside them: MFA for every human, no root access keys, S3 Block Public Access, and EBS default encryption (aws ec2 enable-ebs-encryption-by-default). Send alerts to a channel people actually read, and rehearse the response. With AWS Organizations you can enable most of these for all accounts at once.